SSH Key-Only Access SOP

SSH Key-Only Access SOP
Kill password auth on the server before automated scanners find it.

— Step 1: Generate an ed25519 key: ssh-keygen -t ed25519 -a 100. RSA is fine at 4096 but ed25519 is shorter and strong.
— Step 2: Copy the public key: ssh-copy-id deploy@host. Confirm login works.
— Step 3: In sshd_config: PasswordAuthentication no and PermitRootLogin no.
— Step 4: Restrict to a deploy user; admins escalate via sudo with logging.
— Step 5: Move SSH off port 22 to cut log noise — defense in depth, not a control.
— Step 6: systemctl reload sshd from a second open session.
— Verify: a password login attempt is refused.

Run this every time.