grade your SSH server config in 30 seconds

your ssh server has been quietly collecting bad defaults for years

you set up that vps in 2019, ran the setup script, forgot about it. ssh has been sitting there ever since, still offering key exchange algorithms and ciphers that were considered sketchy even back then. nobody told you because nobody's grading your homework. that's what ssh-audit is for. it's a free tool that connects to your ssh server, pulls the list of algorithms it's willing to negotiate, and tells you flat out which ones are fine and which ones are an embarrassment.

installing it

it's a python tool, so it installs in one line on basically anything.

pip install ssh-audit

no cloning repos, no dependency chasing. if pip gives you grief, pipx install ssh-audit works too and keeps it in its own little sandbox.

running the scan

ssh-audit your-server-ip-or-hostname

that's the whole command. no flags required. within a few seconds it prints out every piece of the ssh handshake your server is willing to do: key exchange algorithms, host key types, ciphers, mac algorithms. each one gets a tag next to it, fail, warn, or good. fail means it's genuinely weak, warn means it's aging out and you should plan to drop it, good means it's current and sane. you'll also get a banner check and a note on whether your ssh version itself is outdated.

this is the same kind of information an attacker scanning your server would look at to figure out how stubborn your config is going to be. the difference is you're the one reading the report first, and you're the one who gets to act on it.

fixing what it finds

don't edit /etc/ssh/sshd_config directly if you can avoid it, it gets messy and hard to track. drop your changes in a separate file instead so it's obvious what you changed and why.

sudo nano /etc/ssh/sshd_config.d/hardening.conf

in there you explicitly list the algorithms you want to keep, which automatically excludes everything you didn't list. something like this, adjusted to whatever ssh-audit actually told you is good on your system:

KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com

copy the exact names ssh-audit marked as good, don't guess at the syntax, one typo and sshd won't start.

reload without locking yourself out

this is the step people skip and then spend their saturday on a recovery console. before you reload ssh, open a second terminal session and leave it connected. don't close it.

sudo systemctl reload sshd

reload, not restart, it applies the config without dropping existing connections. now, in a third window, try connecting fresh.

ssh your-server-ip-or-hostname

if the new connection works, great, you can close the safety session. if it fails, your old session is still alive and you can revert the config file before you lock yourself out permanently. this is the cheapest insurance you'll ever buy, it costs one extra terminal tab.

re-run and aim for zero fails

once the new connection works, run ssh-audit again:

ssh-audit your-server-ip-or-hostname

warns are okay to leave for compatibility with old clients if you genuinely need them. fails shouldn't exist. if you're still seeing a fail, go back to the hardening.conf file, pull that algorithm out of the list, reload, repeat. it's a short loop and you'll get to zero fails in two or three passes.

the takeaway

ssh is the front door to almost every server you run, and most people set it up once and never check it again. ssh-audit turns an invisible config into a visible grade, and the fix is a text file and a reload, not a rebuild. keep that second session open every time you touch sshd_config, scan again after any os upgrade since defaults change, and do this on every box you're responsible for, not just the one you remembered exists. if you've got a vps, a homelab box, or a raspberry pi exposed to the internet, run the scan today. it takes less time than reading this post did.