# SSH hardening drop-in for an Ubuntu server.
# Install to: /etc/ssh/sshd_config.d/00-hardening.conf
#
# The "00-" prefix matters. sshd uses the FIRST value it sees for each
# option, and files in sshd_config.d are read in name order. Ubuntu's
# 50-cloud-init.conf sets "PasswordAuthentication yes", so this file has to
# sort before it or the setting below is ignored.
#
# Before installing, change the two lines marked CHANGE ME.

# Only key-based logins
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes

# Never allow root over SSH
PermitRootLogin no

# Only this account may log in.            <-- CHANGE ME (your username)
AllowUsers admin

# Slow down brute force; drop idle/half-open sessions
MaxAuthTries 3
MaxSessions 4
LoginGraceTime 30
ClientAliveInterval 300
ClientAliveCountMax 2

# No forwarding features a headless server doesn't need
X11Forwarding no
AllowAgentForwarding no
AllowTcpForwarding no
PermitEmptyPasswords no

# Only listen on the LAN IPv4 address.     <-- CHANGE ME (your server's IP)
# This stops sshd from also listening on a public IPv6 address if the server
# has one. Comment it out if you want sshd on every address.
# Re-check with: ss -tlnp | grep :22
ListenAddress <server-ip>