Team Hydra

Harden SSH

Linux / macOS

Build a customized SSH hardening command with your own key and the phases you want, then run it as root on the server you are locking down.

Your SSH public key *

Phases

Deploy your SSH key

Adds your public key to /root/.ssh/authorized_keys. Always on, it is the point of the script.

Harden sshd

Disable password login except from your trusted subnet, and set PermitRootLogin prohibit-password. Unchecking leaves password auth exactly as it is.

Trusted subnet (password auth stays allowed from here)

Rotate root password

Set a new random 32-character root password and print it once. Unchecking keeps the current password.

Manual test + rollback

Pause so you can verify SSH still works, and automatically roll back every change if it does not. Unchecking runs unattended with no rollback gate.

Run this command (as root)

Enter your SSH public key above to build the command

Preview without changing anything by adding --dry-run to the end.

Your key never touches Hep.gg. The downloaded script is the same generic script for everyone. Your public key and choices are assembled into the command here in your browser, and only travel to your own server when you run it.