SSH Hardening for RHEL/CentOS: The Automated Way

Meta Description

Learn how to harden SSH on RHEL/CentOS servers. Automate SSH security configuration with Ansible instead of manual sshd_config editing.

Content

SSH (Secure Shell) is how you access Linux servers. It’s also a common attack target.

If you’re still manually editing /etc/ssh/sshd_config on every server, you’re leaving room for mistakes. This guide covers SSH hardening and how to automate it.

 Default SSH Is Not Secure

Out of the box, RHEL/CentOS SSH has settings that make it vulnerable:

• Root login allowed – Attackers can try to brute-force root
• Password authentication – Weak passwords = compromised servers
• SSH on standard port 22 – Every script can find it
• Weak key exchange algorithms – Old cryptography
• Protocol version 1 (older systems) – Known vulnerabilities Critical SSH Hardening Controls

1. Disable Root Login

PermitRootLogin no

Prevents direct root SSH access. Use sudo instead.

2. Require Key-Based Authentication

PubkeyAuthentication yes
PasswordAuthentication no

Only SSH keys work, not passwords. Passwords can be guessed.

3. Disable Empty Passwords

PermitEmptyPasswords no

Prevents accounts with no password from SSH’ing in.

4. Set Strong Key Exchange

KexAlgorithms curve25519-sha256

Uses modern, secure algorithms instead of weak ones.

5. Set Strong Ciphers

Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com

Uses strong encryption algorithms.

6. Set Strong MAC Algorithms

MACs hmac-sha2-512-etm@openssh.com

Strong message authentication codes.

7. Disable X11 Forwarding (if not needed)

X11Forwarding no

Reduces attack surface.

8. Limit Login Attempts

MaxAuthTries 3
MaxSessions 5

Prevents brute-force attacks.

• Set Client Alive Interval

ClientAliveInterval 300
ClientAliveCountMax 2

Drops idle connections, prevents resource exhaustion.

10. Use Strong Host Keys

HostKey /etc/ssh/ssh_host_ed25519_key

Uses modern Ed25519 keys instead of older RSA.

 Manual SSH Hardening = Error-Prone

To manually harden SSH on a single server:

1. SSH into server
2. Backup /etc/ssh/sshd_config (just in case)
3. Edit /etc/ssh/sshd_config
4. Find and modify 10+ settings
5. Restart SSH service
6. Test SSH still works
7. Verify each setting was applied correctly
8. Document what changed Time: 30-45 minutes per server

If you manage 20 servers, that’s 10+ hours of manual work.

And if you miss a setting? You’re not fully hardened.

 Automated SSH Hardening

Ansible playbooks automate this:

1. Define hardening requirements once
2. Deploy to any server (10 seconds per server)
3. Consistent configuration everywhere
4. Automatic verification
5. Easy to update all servers at once

Instead of 30 minutes per server, hardening takes 60 seconds.

 Example: Ansible SSH Hardening Task

- name: Harden SSH Configuration
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^PermitRootLogin'
    line: 'PermitRootLogin no'
    state: present
  notify: restart ssh

One task, applied to all servers consistently.

 Getting Started with SSH Hardening

If you need to harden SSH across multiple RHEL/CentOS servers, automation is the way to go.

Our STIG baseline hardening playbooks include complete SSH hardening configured automatically.

→ Get STIG Baseline Hardening Playbooks – $199

Includes:

• Complete SSH hardening configuration
• All 10+ hardening controls automated
• Works on RHEL 8, 9, Rocky, AlmaLinux
• Full documentation
• Deploy in minutes, not hours For custom SSH policies or compliance verification, we offer consulting at $150-250/hour. Summary

SSH hardening is critical for server security. Manual configuration is slow and error-prone.

Automation advantages:

• Deploy hardening in 60 seconds per server
• Consistent across all infrastructure
• Easy to modify and scale
• Automatic verification

If you manage multiple RHEL servers, automate SSH hardening instead of doing it manually.

About The Author

admin

See author's posts