6.2Configuring and Managing the OpenSSH Server

Remote administration hinges on sshd, the OpenSSH server daemon. Left at defaults and exposed externally, it becomes a brute-force target, so L2 tests whether you can precisely apply the standard hardening moves—disabling root login, standardizing on key auth, and restricting which users may connect—down to the exact directive spelling.

6.2.1Key sshd_config directives

• The config file is /etc/ssh/sshd_config. After editing, check syntax (sshd -t) before systemctl reload sshd—restarting with a broken config risks locking yourself out.
• PermitRootLogin controls direct root login: no disables it entirely, prohibit-password disables password auth for root while still allowing key-based root login. The standard hardening choice is no.
• PubkeyAuthentication toggles public key authentication (often yes by default). PasswordAuthentication toggles password authentication; to enforce key-only auth, set PasswordAuthentication no.
• AllowUsers lists space-separated users allowed to connect (e.g., AllowUsers alice bob)—a whitelist: anyone not listed is denied.