OpenSSH Hardening Generator
Generate a production-ready, hardened sshd_config with security explanations for every directive
Security profile
Modern
Maximum security. Ed25519 only, no legacy. For new deployments.
Intermediate
Strong security with broader client compatibility. Recommended for most.
Legacy-compatible
Supports older clients (RHEL 7, PuTTY < 0.75). Use only if required.
Authentication & access
A
Excellent hardening
All critical security directives are configured properly.
Generated sshd_config
Pre-flight checklist — test before restarting sshd
Validate syntax:
sudo sshd -t — must print no errors Keep your current SSH session open while testing
Open a second terminal and test:
ssh -v your-server If using AllowUsers/AllowGroups, verify your user is listed
If disabling password auth, ensure your public key is in
~/.ssh/authorized_keys Restart:
sudo systemctl restart sshd (keep old session open!) Only close old session after new connection succeeds
See how OnePAM automates this
Never expose SSH ports again — OnePAM's Zero Trust platform handles identity-based authentication, session recording, and hardening with zero server-side configuration.