Online Tool Store
SSH Hardening Checklist
A checklist of sshd_config hardening steps with the directive for each, ordered so you do not lock yourself out partway through.
🔒 This tool runs entirely in your browser. Your files are never uploaded to a server.
Security & Privacy
SSH Hardening Checklist
Frontend preview — no upload or external service.
Checklist
9 steps for a public host, starting with confirming key login works, then PasswordAuthentication no, PermitRootLogin no, and a restricted AllowUsers list.
How the SSH Hardening Checklist works
- Confirm key-based login works in a second, still-open session before changing anything.
- Apply the directives in the listed order and reload sshd after each group.
- Verify from a new connection each time — a broken config only reveals itself on the next login.
FAQ
What is the safest order to apply these?
Prove key login works first, keep an existing session open throughout, and disable password authentication last. Almost every lockout comes from reversing those steps.
Should the SSH port be changed?
It reduces log noise from opportunistic scanning but adds no real security — anyone targeting you will scan all ports. Do it for tidiness, not protection.
Is fail2ban still worth running?
On a public host with password login disabled it mostly saves log volume. Key-only access already defeats the brute-force attempts it blocks.
How we compare
| Feature | Online Tool Store | A command-line tool | A paid audit service |
|---|---|---|---|
| Lockout-safe ordering | ✓ | ✗ | Varies |
| Verification commands | ✓ | ✓ | Sometimes |
| No server access needed | ✓ | ✗ | ✗ |
| Explains what each step buys | ✓ | Varies | ✗ |
SSH Hardening Checklist is ordered around not locking yourself out, which matters more than any single directive on the list.