Case: Key-Only SSH Ended 12k Daily Root Probes

Case: Key-Only SSH Ended 12k Daily Root Probes
A VPS logged 12,300 SSH brute-force attempts/day against root over password auth.

SSH SOP:

— Step 1: Add your key, test login in a second session before locking anything.
— Step 2: PermitRootLogin no
— Step 3: PasswordAuthentication no
— Step 4: AllowUsers deploy ops — explicit allowlist only.
— Step 5: Move the port off 22 to cut log noise (defense in depth, not the fix).
— Step 6: sshd -t, then reload, then re-test from a fresh session.

Outcome: Password-auth attempts went from 12,300/day to 0 (the auth method no longer exists). Log volume from /var/log/auth.log dropped 91%, making real anomalies visible.

Run this every time.