tendbotRisky SSH settings
SSH is how people log in to your server to manage it. Some common settings — like letting root log in with a password — make it much easier for an attacker to get in. They’re easy to miss because everything works fine until it doesn’t.
- At a glance
- Group
- Security
- Tendbot
- Explains, you decide
- What it does
- Explains the risk and the safe settings, step by step.
- Approval
- You make the change
What you’ll notice
- Root can log in directly with a password
- Password logins are allowed for every user
- Many failed login attempts in the logs
- Old, unused user accounts can still log in
Why it usually happens
- Default settings from the hosting provider were never changed
- Password login was turned on for convenience
- SSH keys were never set up
- Settings were copied from an old tutorial
Fix it yourself
How to fix it by hand
Comfortable with a terminal? Here’s what an experienced admin would do. Start with the read-only commands.
- 01
Check your current SSH settings
Shows the settings that matter most.
sudo sshd -T | grep -E "permitrootlogin|passwordauthentication|pubkeyauthentication" - 02
Make sure you have a working SSH key first
Your public key should be listed here before you turn off passwords.
cat ~/.ssh/authorized_keys - 03
Change the settings
In the SSH settings, set PasswordAuthentication no and PermitRootLogin prohibit-password. Keep your current session open while you test.
sudo nano /etc/ssh/sshd_config - 04
Test the settings and reload SSH
Only reload if the test prints nothing, then log in again from a new window.
sudo sshd -t && sudo systemctl reload ssh
With Tendbot
How Tendbot helps
- Checks your SSH settings for the common risky ones.
- Explains each risk in plain English and what the safe setting is.
- Walks you through the change step by step — Tendbot never changes SSH settings itself.
- Re-checks afterwards so you can see the risk is gone.
FAQ
Risky SSH settings: common questions
Should I disable root login over SSH?
Disabling password login for root is one of the most effective changes you can make. Set up an SSH key first so you don’t lock yourself out.
Why doesn’t Tendbot change SSH settings for me?
A wrong SSH setting can lock everyone out of the server. That’s why SSH changes are always yours to make, with Tendbot guiding you.
Private alpha · invites in small waves
Let Tendbot look after your server
Join the alpha with one email address. Early testers help shape Tendbot and keep the founding-member perks after launch.
- No card needed
- Leave any time