Debian 12 – SSH login fails after hardening changes – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Administrators cannot authenticate after SSH policy updates, causing operational lockout risk.

Environment & Reproduction

Usually follows edits to sshd_config, key policy, or PAM restrictions.

sudo sshd -t
sudo systemctl status ssh
ssh -vvv localhost

Root Cause Analysis

Invalid directives, disabled auth methods, or restrictive PAM/access rules block login.

Quick Triage

Validate effective sshd configuration and recent auth errors.

sudo sshd -T | head -n 80
sudo journalctl -u ssh -n 120 --no-pager
sudo tail -n 120 /var/log/auth.log

Step-by-Step Diagnosis

Check auth method compatibility and account restrictions.

grep -E 'PasswordAuthentication|PubkeyAuthentication|PermitRootLogin' /etc/ssh/sshd_config
getent passwd 
grep -RIn "sshd|authentication" /var/log 2>/dev/null | tail -n 20

Solution – Primary Fix

Restore valid sshd directives and restart service.

sudo cp -a /etc/ssh/sshd_config /var/tmp/sshd_config.bak.$(date +%s)
sudoedit /etc/ssh/sshd_config
sudo sshd -t
sudo systemctl restart ssh

Solution – Alternative Approaches

Apply safe overrides in include files and keep base config minimal.

sudo mkdir -p /etc/ssh/sshd_config.d
sudoedit /etc/ssh/sshd_config.d/90-hardening.conf
sudo sshd -t

Verification & Acceptance Criteria

Authentication succeeds for approved users with intended methods.

ssh -o PreferredAuthentications=publickey localhost true
ssh -o PreferredAuthentications=password localhost true
sudo systemctl status ssh

Rollback Plan

Revert to backup sshd configuration and restart service.

sudo cp -a /var/tmp/sshd_config.bak.* /etc/ssh/sshd_config
sudo sshd -t
sudo systemctl restart ssh

Prevention & Hardening

Validate sshd syntax and test a second session before closing primary access.

sudo sshd -t
ss -lntp | grep :22
who

Related Errors & Cross-Refs

May overlap with nftables lockout and PAM misconfiguration issues.

Related tutorial: View the step-by-step tutorial for Debian 12.

View all Debian 12 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Debian OpenSSH server configuration and hardening references.