SSH server configuration is controlled by sshd_config. Edit /etc/ssh/sshd_config, test syntax, then restart the service.

Key security settings:

Port 22                          # SSH port (consider 2222 for less noise)
PermitRootLogin no               # disable root login
PubkeyAuthentication yes         # allow public-key auth
PasswordAuthentication no        # disable password auth (use keys)
ChallengeResponseAuthentication no
X11Forwarding no                 # disable X11 if not needed
AllowAgentForwarding no          # disable agent forwarding if not needed
PermitTTY no                     # disable PTY for non-interactive commands

User access control:

AllowUsers alice bob [email protected]/24
DenyUsers root mal@*
AllowGroups ssh-users

Client keepalive and idle timeout:

ClientAliveInterval 300          # send keepalive every 300 seconds
ClientAliveCountMax 2            # close if no response after 2 pings
LoginGraceTime 30                # timeout before authentication complete

Logging:

LogLevel VERBOSE                 # detailed log output
SyslogFacility AUTH              # use AUTH facility for syslog

Key-based authentication hardening:

AuthorizedKeysFile .ssh/authorized_keys
AuthorizedKeysFile none          # if using only ~/.ssh/authorized_keys
StrictModes yes                  # require secure file permissions

Advanced options:

MaxAuthTries 3                   # max auth attempts per connection
MaxSessions 10                   # max sessions per authenticated user
UsePAM yes                       # use PAM for authentication
GatewayPorts no                  # restrict remote port forwarding
AllowTcpForwarding no            # disable port forwarding

Test configuration:

$ sudo sshd -t

Restart SSH:

$ sudo systemctl restart ssh

or on older systems:

$ sudo service ssh restart

View active configuration:

$ sudo sshd -T

Check logs:

$ sudo tail -f /var/log/auth.log       # Linux
$ sudo log stream --predicate 'process == "sshd"'  # macOS

Never disable authentication entirely. Use keys, not passwords.