OpenSSH Hardening Generator
Generate a production-ready, hardened sshd_config with security explanations for every directive
Security profile
Modern
Maximum security. Ed25519 only, no legacy. For new deployments.
Intermediate
Strong security with broader client compatibility. Recommended for most.
Legacy-compatible
Supports older clients (RHEL 7, PuTTY < 0.75). Use only if required.
Authentication & access
A
Excellent hardening
All critical security directives are configured properly.
Generated sshd_config
Pre-flight checklist — test before restarting sshd
Validate syntax:
sudo sshd -t — must print no errors Keep your current SSH session open while testing
Open a second terminal and test:
ssh -v your-server If using AllowUsers/AllowGroups, verify your user is listed
If disabling password auth, ensure your public key is in
~/.ssh/authorized_keys Restart:
sudo systemctl restart sshd (keep old session open!) Only close old session after new connection succeeds
Never expose SSH ports again
With OnePAM, your servers don't need inbound SSH ports at all. Access flows through OnePAM's Zero Trust platform with identity-based authentication and session recording.