SSH Configuration Generator

Hardening a Linux server usually starts with /etc/ssh/sshd_config — and that file is where most people either give up or lock themselves out. This generator builds a clean, commented sshd_config starting point for the security requirements that actually matter on a public server: key-only authentication instead of passwords, root login restricted to keys (or disabled outright), forwarding features turned off unless you need them, sane login grace periods and auth attempt limits, and a modern key-exchange/cipher list. Pick a preset, adjust the handful of directives that matter, and you get a copy-ready config plus the install commands to drop it in as a drop-in file under /etc/ssh/sshd_config.d/. The validation panel explains every risky choice in plain English — including the two Ubuntu traps that silently undo your work: 50-cloud-init.conf overriding your settings, and 24.04’s socket activation ignoring a changed Port. Already have a config? Paste it in and the parser fills the form back in. Everything runs in your browser.

🔒 100% private — nothing is uploaded or stored. Configs are assembled entirely in your browser. Your port numbers, usernames, hostnames and any pasted sshd_config are processed locally and never sent to a server — so you can safely build a config for a machine that holds private data.

1 · Starting point

Pick a preset to fill the form with a working baseline. Choosing a preset replaces the current values — everything stays editable afterwards.

🛡 Hardened baseline Ubuntu 22.04/24.04 default port, keys only, no root password login, forwarding off. The sensible default for a fresh VPS. 🔒 Minimal exposure Same as baseline but tighter: 2 auth tries, 3 sessions, 30s grace period, tunnel and agent forwarding off. For internet-facing boxes. 🔑 Password logins kept For a server you can’t move to keys yet: passwords on, root login off, tighter limits and fail2ban advice. 🔄 Tunnels & forwarding Keys only, but local port forwarding and agent forwarding stay on (SSH tunnels, rsync over SSH, git through a bastion).

2 · Access & authentication

Port Changing this only helps against blind scanners. Open the new port in the firewall before reloading sshd. AddressFamily Leave on any unless the server has no IPv6 at all. PermitRootLogin Ubuntu’s default is prohibit-password. no is stricter; use it once you have a sudo user. PubkeyAuthentication Key auth is the whole point. Only turn this off if you know why. PasswordAuthentication Password auth is what gets brute-forced. Turn it off after your key works. KbdInteractiveAuthentication This is PAM’s password prompt — leaving it on undoes PasswordAuthentication no on many distros. PermitEmptyPasswords There is no reason to allow this. UsePAM yes is required for PermitRootLogin no plus sudo/account checks to behave normally.

AllowUsers (optional, space separated) An allow-list. Empty means every system account can attempt SSH. AllowGroups (optional) Usually easier to maintain than AllowUsers. Group membership is checked at login. DenyUsers (optional) Checked before AllowUsers. Leave empty unless you have a specific account to block.

3 · Limits, forwarding & logging

MaxAuthTries Failed auth attempts per connection. Ubuntu default is 6. MaxSessions Multiplexed sessions per connection. 1–3 blocks most tunnelling. LoginGraceTime Time to finish authenticating. 30s or 1m for exposed servers. MaxStartups start:rate:full — unauthenticated connections before random/complete dropping. ClientAliveInterval (seconds) Idle keepalive ping. 0 disables it (dead sessions linger). ClientAliveCountMax Unanswered keepalives before the session is closed. X11Forwarding Only needed for GUI apps over SSH. Ubuntu’s shipped default is yes. AllowAgentForwarding A forwarded agent on a shared host lets anyone there reuse your keys. AllowTcpForwarding local keeps client-side tunnels (databases, dashboards) without remote ones. PermitTunnel Layer-2/3 VPN tunnels. Almost never needed on a normal server. LogLevel VERBOSE logs the key fingerprint used — the record you want in an audit. Banner (optional path) Pre-login warning text. The file must exist or sshd logs a warning at every connect. Ciphers / KexAlgorithms / MACs Ubuntu 22.04+ (OpenSSH 8.9+) supports the modern list. Pick legacy only for old appliances.

Extra directives to keep verbatim (optional) Anything pasted here is appended unchanged — use it for Match blocks the form doesn’t model.

4 · Import an existing sshd_config

Paste your current /etc/ssh/sshd_config (or a file from /etc/ssh/sshd_config.d/) and the known directives are mapped back into the form. Unknown lines, Match blocks and Include statements are kept in the extra-directives box so nothing is lost. Parsing happens in your browser.

Existing config

5 · Your sshd_config

Generated configuration OK

Install it

Keep your current SSH session open while you test a new config in a second terminal. A drop-in file that locks you out is survivable from the session you already have — and a provider’s web console is the fallback if you close it.

How it works

Start from a preset. Each preset is a coherent set of directives — not just one switched-off feature. The hardened baseline matches Ubuntu’s intent (keys only, no root password login) while closing the forwarding features Ubuntu leaves open.
Adjust the directives that matter. The form covers the settings that change your attack surface: port, root login, password vs key authentication, allow/deny lists, auth attempts, session limits and forwarding. Everything else stays at the daemon’s safe default.
Read the findings. Every combination is checked for the ways a config actually bites: a combination that leaves no working auth method (instant lockout), password auth left on, KbdInteractiveAuthentication quietly re-enabling PAM passwords, tunnel forwarding on a public box, or an allow-list that names root.
Install as a drop-in file. The generated block goes in /etc/ssh/sshd_config.d/10-hardening.conf, which is included from the top of the main config. Validate with sshd -t, reload with systemctl reload ssh, then confirm what the daemon actually resolved with sshd -T.
Verify, don’t assume. sshd_config uses first value wins, and Ubuntu’s cloud-init writes 50-cloud-init.conf with PasswordAuthentication yes. A 60- file loses to it; a 10- file wins. The install block below includes the one-line check that proves the effective value.

Directive reference

Directive	What it controls	Why it matters
PermitRootLogin	Whether root may authenticate, and with what.	`yes` exposes the highest-value account to password guessing; `prohibit-password` or `no` removes it.
PasswordAuthentication	Whether an account password can authenticate.	The single biggest source of successful SSH breaches. Keys cannot be guessed.
KbdInteractiveAuthentication	PAM interactive prompts (including password via PAM).	On many distros this is a second door to password login, so disabling one without the other achieves nothing.
PubkeyAuthentication	Public-key authentication.	Turn this off while password auth is also off and nobody can log in at all.
AllowUsers / AllowGroups	An allow-list of accounts or groups.	Without one, every system account with a shell is reachable. Group-based lists survive staff changes better.
MaxAuthTries	Failed auth attempts per connection.	Lower values cut brute-force throughput per connection. Ubuntu default is 6.
LoginGraceTime	Seconds allowed to complete authentication.	Un-authenticated connections tie up daemon slots; a short grace period frees them.
MaxStartups	Concurrent unauthenticated connections (start:rate:full).	Caps connection-flooding; dropping starts at 10 is a sane default.
ClientAliveInterval	Idle keepalive interval.	Clears dead sessions so abandoned shells stop holding an authorised channel.
AllowTcpForwarding	SSH port forwarding (tunnels).	Turns a compromised account into a network pivot. `local` keeps client tunnels without remote ones.
AllowAgentForwarding	Forwarding your local ssh-agent to the server.	Anyone with access to that server can use your loaded keys while you’re connected.
PermitTunnel	Layer-2/3 VPN tunnels over SSH.	A full network path in; leave it off unless you built it deliberately.
X11Forwarding	X11 display forwarding.	Legacy GUI path with a long history of bugs; Ubuntu ships it on for compatibility.
LogLevel	How much sshd logs.	`VERBOSE` records which key was used — the line you need when investigating an intrusion.
UsePAM	Whether sshd goes through PAM.	Needed for normal account/session handling on Ubuntu; turning it off breaks more than it hardens.

Related tools

Spot a bug or want a custom utility built? I'd love to hear from you. Get in touch
Luke Keam | techgeek.biz