OpenBSD SSH Hardening - Beginner Guide

OpenBSD SSH Hardening - Beginner Guide

Securing your SSH connection is critical. Here's how to protect your OpenBSD server.

Why SSH Hardening Matters

SSH is the primary way to remotely manage your server. If not properly secured, attackers could:
- Guess your password
- Gain unauthorized access
- Take control of your server

Step 1: Disable Root Login

This is the most important security step.

Edit the configuration:
vi /etc/sshd_config

Find this line: #PermitRootLogin yes
Change to: PermitRootLogin no

Why: Prevents hackers from trying to guess the root password.

Important: Make sure you have another user with administrative privileges before disabling root login, or you could lock yourself out!

Step 2: Disable Password Authentication

After you've set up SSH keys (see Lesson 12), disable password-based login.

In /etc/sshd_config, find and change:
#PasswordAuthentication yes → PasswordAuthentication no

This forces everyone to use SSH keys:
- Keys are much harder to guess than passwords
- Even if someone knows your password, they can't SSH in without your key file
- You can add a passphrase to your key for extra security

Step 3: Limit Login Attempts

Prevent automated password guessing attacks.

In /etc/sshd_config, add or modify:
MaxAuthTries 3 - allows maximum 3 login attempts
LoginGraceTime 60 - gives 60 seconds to complete login

Example configuration section:

# Authentication:
LoginGraceTime 60
PermitRootLogin no
StrictModes yes
MaxAuthTries 3

Step 4: Change the Default Port (Optional)

The default SSH port is 22. Changing it can reduce automated attacks.

In /etc/sshd_config, find and change:
#Port 22 → Port 2222 (or any port above 1024)

Note: This provides "security by obscurity" - it won't stop determined attackers, but it reduces log noise from automated bots scanning port 22.

If you change the port: Don't forget to specify the port when connecting:
ssh -p 2222 user@your-server-ip

Step 5: Configure Firewall for SSH

OpenBSD's PF firewall can restrict who can attempt SSH connections.

In /etc/pf.conf, add:
pass in on egress proto tcp from any to any port 22

To restrict by IP address:
pass in on egress proto tcp from 192.168.1.0/24 to any port 22

This means: Only computers on your home network (192.168.1.0/24) can try to SSH into your server. Others will be blocked.

Step 6: Test Your Configuration

Test SSH after each change: Try connecting from another computer.

Check configuration syntax:
sshd -t - checks for configuration errors

Reload SSH after changes:
rcctl restart sshd

Common Mistakes to Avoid

Mistake 1: Disabling root login AND password auth before setting up keys.
Result: Locked out of your own server!
Fix: Always test SSH keys first, then disable passwords.

Mistake 2: Opening port 22 to the whole internet without firewall rules.Result: Constant attack attempts!
Fix: Use PF to restrict SSH access to trusted IPs only.

Mistake 3: Using weak passwords.
Fix: Use SSH keys with passphrases, or strong 16+ character passwords.

Advanced SSH topics? Proceed to Lesson 29: SSH Hardening.

Next: OpenBSD Package Management - Beginner Guide

Article author: Arthur Isaev