Warning
Use a sudo-capable account, keep shell history for audit, and back up critical paths before changing boot, SSH, or package state.
What you will achieve
Lock down SSH without locking yourself out — test every change in a second session.
1) Configure secure sshd defaults
sudo nano /etc/ssh/sshd_config2) Recommended directives
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
AllowUsers youradmin3) Test before closing active session
sudo sshd -t
sudo systemctl restart ssh
sudo systemctl status ssh