Hardening SSH with Linux Kernel's Built-in Features and a Few Surprising sysctl Tweaks

 Posted on 13 May 2026  |  4 minutes  |  646 words  |  Carla Brown

Introduction to SSH Hardening

Securing your SSH connection is crucial - I’ve seen this go wrong when a friend of mine had his server compromised due to a weak SSH setup. In today’s world, with cyber threats lurking around every corner, hardening your SSH setup using Linux kernel’s built-in features and sysctl tweaks is essential. This article will guide you through the process of securing your SSH connection using practical examples and commands.

Understanding SSH

SSH (Secure Shell) is a protocol used to securely access and manage remote systems. It provides a secure way to login, transfer files, and execute commands on a remote system. However, if not properly configured, SSH can be vulnerable to attacks. To harden your SSH setup, you need to understand the basics of SSH and its configuration. Don’t bother with SSH if you’re not going to take the time to configure it properly - it’s a waste of time and can leave your system exposed.

Linux Kernel’s Built-in Features

The Linux kernel provides several built-in features to secure your SSH connection. One of the most important features is the tcp_syncookies parameter, which helps prevent SYN flood attacks. To enable this feature, you can use the following command:

sysctl -w net.ipv4.tcp_syncookies=1

This command enables the tcp_syncookies parameter, which helps prevent SYN flood attacks by generating a cookie for each incoming SYN packet. I usually start with this command when setting up a new server - it’s a simple but effective way to add an extra layer of security.

sysctl Tweaks

sysctl is a command used to configure kernel parameters at runtime. You can use sysctl to tweak various kernel parameters to secure your SSH connection. Here are a few examples:

  • net.ipv4.tcp_keepalive_time: This parameter sets the time interval between keepalive probes. You can set it to a lower value to detect and disconnect idle connections:
sysctl -w net.ipv4.tcp_keepalive_time=30
  • net.ipv4.tcp_keepalive_intvl: This parameter sets the time interval between keepalive probes. You can set it to a lower value to detect and disconnect idle connections:
sysctl -w net.ipv4.tcp_keepalive_intvl=10
  • net.ipv4.tcp_keepalive_probes: This parameter sets the number of keepalive probes sent before disconnecting an idle connection. You can set it to a lower value to detect and disconnect idle connections:
sysctl -w net.ipv4.tcp_keepalive_probes=3

The real trick is finding the right balance between security and usability - you don’t want to disconnect legitimate connections, but you also don’t want to leave your system vulnerable to idle connections.

SSH Configuration

In addition to kernel parameters, you can also configure your SSH setup to secure your connection. Here are a few examples:

  • Port: You can change the default SSH port to a non-standard port to prevent automated attacks:
sudo nano /etc/ssh/sshd_config

Add the following line to the file:

Port 2222
  • PermitRootLogin: You can disable root login to prevent unauthorized access to your system:
sudo nano /etc/ssh/sshd_config

Add the following line to the file:

PermitRootLogin no
  • PasswordAuthentication: You can disable password authentication to prevent brute-force attacks:
sudo nano /etc/ssh/sshd_config

Add the following line to the file:

PasswordAuthentication no

This is where people usually get burned - they think that changing the default port is enough, but it’s just the beginning. You need to take a holistic approach to securing your SSH connection.

Additional Security Measures

In practice, securing your SSH connection is an ongoing process. In addition to kernel parameters and SSH configuration, you can also take additional security measures to secure your SSH connection. Here are a few examples:

  • Use a firewall to block incoming connections on non-standard ports.
  • Use a VPN to encrypt your SSH connection.
  • Use two-factor authentication to add an extra layer of security to your SSH connection.
  • Regularly update your system and SSH software to prevent vulnerabilities.

For more information on SSH hardening, you can refer to the official OpenSSH documentation. You can also check the Linux kernel documentation for more information on kernel parameters and sysctl tweaks.

linux  ssh  security  sysctl  hardening 

See also