Secure access
Harden SSH without locking yourself out
Test key access, keep a recovery channel, disable unnecessary authentication paths, and validate configuration before reloading SSH.
8 minute lesson
SSH changes can lock you out. Keep the current session open and prove a second connection before closing it.
After key login works, disable direct root login and password authentication when the environment supports it. Restrict users where useful and keep provider-console recovery ready. Validate the configuration before reload and never experiment first on the only production path.
sudo sshd -tDisabling passwords before testing key login can leave the server unreachable. Keeping an open session helps, but a provider console is the independent recovery path.
Test the effective daemon configuration, not only the edited file. Included configuration fragments can override a setting and make a clean-looking file provide false confidence.
Validate the SSH configuration and open a second key-only session before reloading. Test password and root login failures, then prove the provider recovery path remains available.
Lesson completed