# /etc/ssh/sshd_config.d/hardening.conf   (episode 10)
# Keys only. Password guessing is what the 130k login attempts in eight days were.
PasswordAuthentication no
KbdInteractiveAuthentication no
# Root stays reachable by key on this single-admin box. On a box with a real
# ops user, set this to "no" and log in as that user instead.
PermitRootLogin prohibit-password
#
# After editing: sshd -t && systemctl reload ssh
# TEST A SECOND SSH SESSION BEFORE YOU CLOSE THIS ONE.