SSH Configuration

OpenSSH Server

Field	Value
Service	ssh.service
Port	22/tcp
Protocol	SSH-2
Auth Methods	Public key, Password (via PAM)

Configuration (/etc/ssh/sshd_config)

Include /etc/ssh/sshd_config.d/*.conf
PermitRootLogin prohibit-password
KbdInteractiveAuthentication no
UsePAM yes
X11Forwarding yes
PrintMotd no
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server

Authorized Keys

User ty

Key	Comment
ED25519	ty@penguin
ED25519	hudso@InspiroBot
ED25519	hermes.cloud@neuralmeadow.xyz

User root

No authorized keys configured for direct root login.

Security Notes

• Root login restricted to key-only (prohibit-password)
• PAM is enabled (see UsePAM yes) — keyboard-interactive auth is disabled
• X11 forwarding is enabled
• SSH brute-force attempts from external IPs are handled by Fail2Ban (10-minute ban after 5 failed attempts)
• Recent auth failure logs show attempts from 212.0.217.14

Recommendations

• Consider disabling password authentication entirely (PasswordAuthentication no)
• Evaluate whether X11 forwarding is needed on a production server
• Consider moving SSH to a non-standard port or behind a VPN