HowTo: SSH hardening + bastion on Debian

SSH is the server's front door. You secure it with keys, no password/root, optional 2FA, and a bastion you go through to reach internal servers. Step by step.

1. ed25519 keys

# pe statia ta: genereaza o cheie ed25519
ssh-keygen -t ed25519 -C 'admin@laptop'
# copiaz-o pe server
ssh-copy-id -i ~/.ssh/id_ed25519.pub admin@server

2. Harden sshd

# /etc/ssh/sshd_config.d/99-hardening.conf
sudo tee /etc/ssh/sshd_config.d/99-hardening.conf >/dev/null <<'EOF'
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
KbdInteractiveAuthentication no
AllowUsers admin
X11Forwarding no
MaxAuthTries 3
EOF
sudo sshd -t && sudo systemctl reload ssh

3. 2FA (optional)

# optional: 2FA (TOTP) pt SSH
sudo apt -y install libpam-google-authenticator
google-authenticator      # ruleaza ca userul; scaneaza QR in app
# apoi activeaza in PAM + sshd (AuthenticationMethods publickey,keyboard-interactive)

4. Bastion / jump host

# bastion / jump host — te conectezi la serverele interne PRIN bastion
# ~/.ssh/config pe statie:
Host bastion
    HostName bastion.example.com
    User admin
Host intern-*
    ProxyJump bastion
    User admin
# apoi: ssh intern-db   (trece automat prin bastion)

5. Anti brute-force

# protectie brute-force (fail2ban SAU crowdsec)
sudo apt -y install fail2ban
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd

6. Verify

sudo sshd -T | grep -Ei 'permitroot|passwordauth|pubkey|allowusers'
ssh -J bastion admin@intern-db   # test bastion

Conclusion

You now have hardened SSH: keys only, no root, optional 2FA, bastion access and brute-force protection. NOTE: keep a session open while testing so you don't lock yourself out. We configure it for you.