Review SSH access before hardening it

Preserve a recovery path

Before changing authentication or access rules, confirm working console or out-of-band access and keep an existing administrative session open. Test on a non-production host first. These checks assume OpenSSH on Linux.

Inspect the effective configuration

Validate syntax and inspect effective settings, including included configuration files. Some Match rules require connection context with sshd -T -C; a plain -T listing may not describe every user. These commands require appropriate permissions.

sudo sshd -t
sudo sshd -T | grep -E "^(permitrootlogin|passwordauthentication|pubkeyauthentication) "

Verify a second session

Confirm a separate session can authenticate using the intended account and key before restricting any fallback mechanism. Use named administrative accounts with approved privilege escalation and maintain an inventory of authorized keys.

Apply and observe

Use the distribution’s documented reload procedure only after syntax validation. Unit names vary between ssh and sshd. Recheck access from a new session and inspect authentication logs. Keep the recovery session until you have demonstrated the intended access works.