Ready-to-use /etc/ssh/sshd_config snippets for Ubuntu 16–26, Debian 12–13, Rocky Linux 9–10, Amazon Linux 2023, and OpenSSH 7.7–10.4. Sourced directly from ssh-audit's built-in policies — eliminate weak ciphers in minutes.
Use curve25519-sha256 and sntrup761x25519-sha512 (PQC-hybrid, OpenSSH 8.5+). Drop all DH-group1/14-sha1.
Use chacha20-poly1305 and aes256-gcm. Remove all CBC-mode, 3DES, and Blowfish ciphers.
ETM variants only: hmac-sha2-512-etm and hmac-sha2-256-etm. Drop MD5 and SHA-1 MACs.
Upgrade to OpenSSH 9.6+. Enables kex-strict that mitigates CVE-2023-48795. Ubuntu 26 ships OpenSSH 10.x.
Use ssh-ed25519 (preferred) and rsa-sha2-512. Remove ssh-dss, ssh-rsa, and ECDSA NIST curves.
Ubuntu 26.04 · Debian 13 · Rocky Linux 10 · OpenSSH 10.4 guides are included. Select via the tabs below.
Run sshd -t to validate, then systemctl restart sshd. Verify with sshaudit.online — aim for an A grade.
Always keep a second active SSH session open while editing sshd_config. Confirm key auth works before disabling PasswordAuthentication.
After applying these SSH hardening settings, use our free
online SSH audit scanner
to verify your server scores an A grade. The
SSH security checker
will confirm all weak algorithms have been removed and flag any remaining issues with exact
sshd_config fixes. Also useful for SSH compliance audits,
SSH encryption audits, and verifying hardening guide results on live servers.