SSHD Hardening Config Generator
Generate production-grade, CIS and Mozilla compliant OpenSSH server (sshd_config) hardening configurations.
# ==============================================================================
# OpenSSH Server Hardened Configuration (sshd_config)
# Generated for modern Linux / BSD server deployments
# ==============================================================================
# --- Network & Port Binding ---
Port 22
AddressFamily any
ListenAddress 0.0.0.0
ListenAddress ::
# --- Authentication Hardening ---
Protocol 2
PermitRootLogin no
PubkeyAuthentication yes
PasswordAuthentication no
PermitEmptyPasswords no
KbdInteractiveAuthentication no
UsePAM yes
MaxAuthTries 3
MaxSessions 10
# --- Connection & Keepalive ---
ClientAliveInterval 300
ClientAliveCountMax 2
TCPKeepAlive yes
# --- Forwarding & Tunneling ---
X11Forwarding no
AllowTcpForwarding no
AllowAgentForwarding no
# --- Logging & Diagnostics ---
SyslogFacility AUTH
LogLevel VERBOSE
# --- Cryptographic Primitives (Mozilla Modern Standard) ---
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com
Do it offline:$
How to use it
- Select your target SSH port (default 22 or custom non-standard port to mitigate automated brute-force scans).
- Configure authentication controls: disable root SSH login and disable password authentication in favor of public keys.
- Toggle cryptographic suites to enforce Mozilla Modern standards (ChaCha20-Poly1305, Curve25519, AES-GCM).
- Review proactive security advisories, copy the resulting sshd_config file, and deploy it to /etc/ssh/sshd_config.
Generate hardened OpenSSH daemon (sshd_config) configuration files. Enforce key-only authentication, modern cryptographic algorithms, non-root logins, and proactive connection limits.
How it works
OpenSSH is the backbone of remote server administration. Default distributions often leave password authentication or root login enabled for backwards compatibility.
Hardening the SSH daemon drastically reduces server attack surface against botnets and brute-force password spraying.
This generator follows CIS Linux benchmarks and Mozilla Server Side TLS/SSH guidelines to construct clean, directive-validated configuration files.
All configuration files are assembled client-side in pure TypeScript without collecting server hostnames, IP addresses, or secrets.
Examples
Every example on this page is executed against the same engine that powers the tool, on every build.
Gotchas worth knowing
Common errors
FAQ
Will disabling password authentication lock me out of my server?
Yes, if you have not first installed your public SSH key in ~/.ssh/authorized_keys! Always test your SSH key login in a separate terminal window before closing your active session or restarting the SSH daemon.
How do I test my new sshd configuration before restarting the service?
Run 'sudo sshd -t' on your Linux server. This command parses the configuration file and verifies syntax without interrupting running connections. If it returns 0 with no output, the syntax is valid.
How do I apply changes to sshd_config?
On systemd-based Linux systems (Ubuntu, Debian, CentOS, RHEL), run 'sudo systemctl reload ssh' (or 'sudo systemctl reload sshd'). Reloading does not terminate existing active SSH sessions.