Runbook — SSH hardening

Extracted from the master document on 2026-09-04. The §N numbering is kept so cross-references are not broken.

8. SSH — hardening and safe procedure

Administrative key created on Windows and reused on every VM:

ssh-keygen -t ed25519 -a 100 -f "$HOME\.ssh\homelab_balsero" -C "balsero@homelab"

Configuration in /etc/ssh/sshd_config.d/99-homelab-security.conf:

PasswordAuthentication no
PermitRootLogin no
PubkeyAuthentication yes

The procedure matters more than the contents of the file. Applied the same way on pve, VM 100 and VM 101:

 1. install the public key on the target
      │
 2. TEST that the key gets in  ───────────────► if it fails, stop here
      │
 3. write the hardening
      │
 4. sudo sshd -t            (validates syntax)
      │
 5. sudo systemctl reload ssh
      │
 6. KEEP the old session open  ◄─── the parachute
      │
 7. open a SECOND test session
      │
 8. only then is the change considered valid

Copy the key to a new VM:

Get-Content $HOME\.ssh\homelab_balsero.pub | ssh balsero@192.168.2.10 "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"