← All tutorials

How to Harden SSH on Ubuntu 24.04 with Key-Based Authentication

Published October 27, 2026 · 6 min read

Password logins are the most common way attackers gain access to exposed servers: automated bots try common passwords around the clock. Key-based authentication with a few hardened settings removes that risk. This guide configures OpenSSH on Ubuntu 24.04 safely, without locking you out.

Prerequisites

• Ubuntu 24.04 server with sudo access and a non-root user
• A second terminal window or console access as a safety net
• A client computer with OpenSSH (Linux, macOS, or Windows 10/11)

Step-by-Step Guide

Step 1: Create an SSH key on your computer

ssh-keygen -t ed25519 -C "server-access-key"

Accept the default location and set a strong passphrase when asked.

Step 2: Copy the public key to the server

ssh-copy-id -i ~/.ssh/id_ed25519.pub YOUR_USER@YOUR_SERVER_IP

Replace YOUR_USER and YOUR_SERVER_IP with your real username and server address.

Step 3: Test key login in a new terminal

ssh YOUR_USER@YOUR_SERVER_IP

Do not continue until this works without asking for the account password. Keep this session open.

Step 4: Add a hardening configuration

Run this on the server. The file name starts with 00 so it is read before other drop-in files, because OpenSSH uses the first value it finds. $USER expands to your current username.

sudo tee /etc/ssh/sshd_config.d/00-hardening.conf > /dev/null <<EOF
PasswordAuthentication no
PermitRootLogin no
PubkeyAuthentication yes
MaxAuthTries 3
LoginGraceTime 30
AllowUsers $USER
EOF

Step 5: Validate and apply

sudo sshd -t
sudo systemctl reload ssh

No output from sshd -t means the syntax is valid.

Step 6: Verify the effective settings

sudo sshd -T | grep -E 'passwordauthentication|permitrootlogin|allowusers'

Then open a new terminal and confirm key login still works before closing your original session.

Conclusion

The server now accepts only key-based logins from the named user, with root login disabled and fewer authentication attempts allowed. Review /var/log/auth.log periodically, rotate keys when people leave, and retest access after every OpenSSH update.