SSH hardening complet pour VPS Linux en 2026.

/etc/ssh/sshd_config

Port 22
PermitRootLogin prohibit-password
PasswordAuthentication no
PubkeyAuthentication yes
ChallengeResponseAuthentication no
PermitEmptyPasswords no
X11Forwarding no
AllowAgentForwarding no
AllowTcpForwarding no
ClientAliveInterval 300
ClientAliveCountMax 2
MaxAuthTries 3
MaxSessions 5
LoginGraceTime 30
AllowUsers deploy admin
PermitTunnel no
GatewayPorts no

# Algorithmes modernes uniquement
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com

sshd -t  # tester la config
systemctl restart ssh

Clefs Ed25519

# Sur votre laptop
ssh-keygen -t ed25519 -C "votre@email.sn"

# Push sur VPS
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@VPS_IP

2FA SSH (optionnel)

apt install libpam-google-authenticator
google-authenticator  # configurer en interactif

# /etc/pam.d/sshd : ajouter
auth required pam_google_authenticator.so

# /etc/ssh/sshd_config
ChallengeResponseAuthentication yes
AuthenticationMethods publickey,keyboard-interactive