Harden SSH.
SSH is the front door to your server, and every public box gets its handle rattled around the clock. Pick your settings and get a hardened sshd_config — key-only auth, no root login, limited attempts — with the safe commands to apply it.
sshd -t to validate before reload.The door everyone tries
You don't have to imagine attacks on SSH; just tail the auth log on any public server and watch the login attempts roll in from around the world, every minute, forever. They're automated, they're relentless, and they're cheap to defeat: require a key instead of a password and the brute force has nothing to brute. Add no-root-login and a couple of limits and the front door goes from constantly-tried to effectively closed.
The config is a one-time change. The harder task is monitoring each relevant host for later edits and drift. A control plane can contribute selected managed-host evidence, but it does not establish a standing fleet-wide assurance.
Harden once. Stay hardened, provably.
Infraveil can report selected state for configured managed hosts, but it does not enforce or prove a universal SSH baseline. Verify the generated configuration, monitor each host through an appropriate channel, and plan for drift outside managed evidence.
See how it works