Dave's bare-minimum SSH hardening
ToolsSSH hardening baseline (keys only, no root, UFW allowlist, Tailscale)
Quote
need to disable root login, disable password login, disable interactive keyboard login. Only put your SSH server on a different port than 22. Then make, and then enable only key pair authentication, public key authentication.
Episode 236: No Nancy Here (episode page, opens in a new tab) 00:09:17 (play audio from this timestamp, opens in a new tab)
Voice-matched
Summary
After Adam's server was compromised, Dave lays out his standard protocol for anyone running Linux servers: disable root login, password login and keyboard-interactive login; move SSH off port 22; allow only public-key authentication; and go further by restricting the SSH port with UFW to specific IPs. With Tailscale and his home CIDR block, the restriction is less of a pain on the road.