Infrastructure Notes: Tightening SSH Baselines and Alert Noise

Quick infrastructure notes from a recent audit. Nothing groundbreaking, but the kind of baseline hygiene that most servers skip.

SSH Hardening Wins

Default SSH configs are... permissive. Here's what I lock down on every new server:

# /etc/ssh/sshd_config
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
MaxAuthTries 3
LoginGraceTime 30
ClientAliveInterval 300
ClientAliveCountMax 2
AllowUsers deploy nikhil
X11Forwarding no
AllowAgentForwarding no

After editing, always validate before restarting:

sshd -t && systemctl restart sshd

Never skip the -t check. Saved me from lockouts more than once.

UFW Defaults

Start strict, open what's needed:

ufw default deny incoming
ufw default allow outgoing
ufw allow from YOUR_IP to any port 22
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable

The key: restrict SSH to your IP(s) only. If you have a static IP, use it.

Fail2Ban for SSH

apt install fail2ban -y

/etc/fail2ban/jail.local:

[sshd]
enabled = true
port = 22
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600
findtime = 600

systemctl enable --now fail2ban
fail2ban-client status sshd

Alert Noise Reduction

One thing that kills monitoring culture is too many false-positive alerts. Here's how I cleaned up alert routing:

1. Grouped alerts by severity — Critical goes to PagerDuty, warnings to Slack, info to a low-priority channel
2. Added inhibition rules — If the host is down, suppress all service alerts from that host
3. Set minimum durations — Alerts must fire for 5 minutes before notifying (eliminates transient spikes)

# Alertmanager inhibit rule
inhibit_rules:
  - source_match:
      alertname: HostDown
    target_match_re:
      alertname: ".+"
    equal: [instance]

Net Result

After these changes: 3 alerts per week instead of 40. The ones that fire now actually matter.