SSH hardening

Establish working administrative access before restricting authentication. Keep the current session and provider console available until a fresh post-change login succeeds.

Inspect and establish access

1. Identify the active daemon/service/socket, actual listener ports, administrative and automation identities, Include order, and relevant Match rules. Record sshd -T -C results for the actual users, client addresses, and hostnames.

2. Use an existing non-root administrator. If account creation is needed, create it separately with the distribution's user/group conventions, install its public key, then prove key login and sudo in a separate session before any lockdown.

3. Generate personal keys on the local client with a passphrase or hardware-backed key. scripts/generate-ssh-keys.sh provides preview/no-overwrite behavior; its --interactive mode is for a human terminal and --no-passphrase is an explicit service-key choice.

4. Test the specific key without password fallback:

   ssh -o IdentitiesOnly=yes -o PreferredAuthentications=publickey -i ~/.ssh/server_admin administrator@server.example.com
   

   In that new session, verify the required sudo operation. Password fallback or an already-open session is not proof of usable key access.

Configure the authorized policy