6.1 OpenSSH Server Hardening
Robust directives for /etc/ssh/sshd_config.d/99-hardening.conf:
# Public key authentication only (Ed25519)
Port 2222
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
AllowGroups sysadmins