Before you SSH into a server from a laptop, a hotel or a phone, check six sshd_config settings: PasswordAuthentication, PermitRootLogin, AllowUsers, AuthenticationMethods, MaxAuthTries and the keepalive pair ClientAliveInterval and ClientAliveCountMax. The defaults are listed below, taken from the OpenBSD man page.
The settings and their defaults
- PasswordAuthentication. What it does: Allows password login. Default: yes.
- PermitRootLogin. What it does: Controls root login. Default: prohibit-password.
- AllowUsers. What it does: Limits who can log in. Default: all users.
- AuthenticationMethods. What it does: Methods a user must complete. Default: any.
- MaxAuthTries. What it does: Attempts per connection. Default: 6.
- ClientAliveInterval. What it does: Seconds before sshd probes an idle client. Default: 0, none sent.
Defaults can differ by distribution or package, so always check the effective configuration on your host. The sshd -T command prints it.
PasswordAuthentication
The default allows passwords. Anything on the internet that accepts passwords will be guessed at. If everyone who needs access can use keys, set this to no. Keep a console or other recovery path before you do, so a misconfiguration does not lock you out.
PermitRootLogin
The default, prohibit-password, disables password and keyboard-interactive login for root while allowing key login. The man page also lists forced-commands-only, which allows root key login only when a command option is set, and no. For most hosts, no is the right answer: log in as a named user and elevate, so logs show who did what.
AllowUsers
If AllowUsers is set, only matching users may log in. Entries can take the form USER@HOST, where HOST can include CIDR ranges. That lets you restrict an account to a known network range. Numeric user IDs are not recognized, and the list does not apply to users matched by DenyUsers. A short allow list turns a host with fifty accounts into one with three reachable ones.
AuthenticationMethods
The default, any, accepts any one enabled method. You can require a sequence instead. The man page example, publickey,password publickey,keyboard-interactive, requires a public key followed by either a password or a keyboard-interactive step. Methods must also be enabled separately. We cover a two step setup in requiring a key and a second factor for SSH.
MaxAuthTries
The default is 6 attempts per connection, and failures are logged once they reach half that value. Lowering it slows guessing on one connection, though an attacker can reconnect, so pair it with rate limiting or a ban tool and, better, no passwords at all.
Keepalives
ClientAliveInterval defaults to 0, so nothing is sent. With an interval of 15 and the default ClientAliveCountMax of 3, an unresponsive client is dropped after about 45 seconds. That cleans up dead sessions left by a phone that switched networks. See why SSH sessions drop on mobile networks.
A short review routine
- Run
sshd -Tand read the effective values. - Turn off password login if keys are in place.
- Set PermitRootLogin to no unless you have a stated reason.
- Add AllowUsers for the people who need the host.
- Test from a second session before closing your first one.
- Keep OpenSSH updated, since several of the tool's past vulnerabilities were fixed in releases rather than in configuration.
Quick check
Is turning off password login enough to secure SSH?
It removes the biggest guessing risk, but you still need protected private keys, current software, a user allow list and logging. Keys on laptops and phones need a screen lock and a passphrase.
How do I see which settings are actually in effect?
Run sshd -T as an administrator. It prints the effective configuration after defaults and includes are applied, which is more reliable than reading one file.
Sources
Last reviewed: 19 October 2026.
