OpenSSH

OpenSSH provides encrypted remote shell access, file transfer, and tunnelling. It is the substrate under a great deal of everything else here: Ansible configures over it, cluster access is through it, and every deployment path assumes it.

The encryption is the part that receives attention and is not the part that needs it. Modern OpenSSH with default algorithms is cryptographically sound. Almost every real SSH compromise is an access management failure — a key that should have been revoked, an account nobody removed, a password that should not have been permitted.

What actually matters

Disable password authentication. PasswordAuthentication no removes the entire category of credential guessing that fills logs and occasionally succeeds. This is the single highest-value setting.

Manage keys as infrastructure. Keys accumulate. A developer leaves and their key remains in authorized_keys on twenty machines because nobody tracked where it was deployed. Keys should be distributed by configuration management, not added by hand, so removal is a single change rather than an archaeology exercise. This is the failure mode I would worry about most.

Use certificates at scale. An SSH certificate authority signs short-lived certificates, so hosts trust the CA rather than a list of keys. Revocation becomes not re-issuing, and expiry is automatic. Above a few dozen hosts this is a substantially better model than distributing authorized_keys files, and it is under-adopted.

Restrict root login. PermitRootLogin no, or prohibit-password where automation needs it. Named accounts with sudo produce an audit trail; shared root does not.

Jump hosts over exposure. One hardened bastion with everything else reachable only through it reduces the attack surface to one machine and gives one place to log access. ProxyJump makes this transparent on the client side.

Practical notes

Changing the port is not security and does reduce log noise from automated scanning — a maintenance benefit, not a defence. fail2ban or CrowdSec does the same job better.

Agent forwarding is convenient and lets root on the intermediate host use your agent to authenticate elsewhere. ProxyJump is the safer pattern and should be the default habit.

Port forwarding and SSHFS are genuinely useful and worth knowing before reaching for a VPN.

See also: nftables, fail2ban, host hardening patterns, and Ansible.