### Creating sudo users

Use adduser command 

adduser newuser

You will be prompted to set and confirm the new user password.

Next, add the new user to the sudo group
By default on Ubuntu systems, members of the group sudo are granted with sudo access. To add the user you created to the sudo group use the usermod command:

usermod -aG sudo username

Testing sudo access,

su - username

Use sudo to run the whoami command

sudo whoami

### disabling root user access over SSH

Open sshd_config File with a text editor which is located at /etc/ssh Directory.

nano /etc/sshd/sshd_config

Now Find and Uncomment, the line PermitRootLogin then change its value to “no”.

PermitRootLogin no

Then save changes and restart the ssh service with systemctl command.

systemctl restart sshd.service

### Disabling password based logins

To disable password authentication, edit /etc/ssh/sshd_config file on the remote server.

nano /etc/ssh/sshd_config

Find this line:

#PasswordAuthentication yes
Change it to:
PasswordAuthentication no

Then find the ChallengeResponseAuthentication line. Make sure it’s value is set to no like below. If it’s set to yes, you can still use password to login.

ChallengeResponseAuthentication no

Save the file and restart SSH service.

systemctl restart sshd
Using SSH key based logins

 To add an SSH key pair, first, create a hidden folder to your user account home directory on your cloud server with the following command.

mkdir -p ~/.ssh

Then restrict the permissions to that directory to just yourself with the command below.

chmod 700 ~/.ssh

Using OpenSSH to generate a key pair

Generate a new key pair in a terminal with the next command.

ssh-keygen -t rsa

The key generator will ask for the location and file name to which the key is saved. Enter a new name or use the default by pressing enter.
Copy the public half of the key pair to your server using the following command

Replace the user and server with your username and the server address you wish to use the key authentication on.

ssh-copy-id -i ~/.ssh/id_rsa.pub user@server
need correction for this guide ^^
Changing the SSH port to something else

Edit the SSH configuration file located in /etc/ssh/sshd_config.

nano /etc/ssh/sshd_config

Find the line that reads #Port 22. Either uncomment the line and replace 22 with the desired port number or enter a new line below with the new default SSH port:

#Port 22Port <number>

Adding a new line allows you to revert to the default settings later by deleting the line. Save the changes and exit the file.

Alternatively, open the port using iptables.

Replace [port_number] with the port you want to open.

sudo /sbin/iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport [port_number] -j ACCEPT

Update Firewall Rules,
Use the following commands, and replace with the actual port number

firewall-cmd --add-port=<port number>/tcpfirewall-cmd --reload

Restart the SSH service

systemctl restart sshd

### Using firewalls like CSF

install fail2ban to automatically block failed login attempts

Refer to the guide - https://wiki.crowncloud.net/?How_To_Protect_SSH_With_Fail2Ban_on_CentOS_7 

### limit ssh access to certain IP addresses only

Using TCP wrappers, you may also control which hosts are allowed to connect. TCP wrappers allow you to utilise hostnames in rules in addition to IP addresses.

TCP Wrappers essentially use of two files: /etc/hosts.allow and /etc/hosts.deny

create a empty file by using the following command:

sudo touch /etc/hosts.{allow,deny}  

#### Deny all hosts

Open the file /etc/hosts.allow file by using a text editor

vi /etc/hosts.allow   

Add the following line to deny all incoming SSH connections to the server

sshd: ALL    

Save and close the file.

This disables all SSH connections to the host.

#### Allow IP addresses

Open the file /etc/hosts.allow file by using a text editor

vi /etc/hosts.allow   

Add an sshd line to allow the IP address of your choice to connect by using public SSH. For example,
the following line allows network 23.163.0.21:

sshd: 23.163.0.21

Save and close the file.

You can append addresses to the first entry in this section because the TCP Wrapper files permit a list of entries separated by commas,

sshd: 23.163.0.21,72.169.0.24, 104.83.33.66, 10.85.152.54, 58.12.10.12, 66.82.192.26

You can allow the complete 23.163.0.0/24: They also accept partial IP addresses as subnets.

sshd: 23.163.0.
    

sshd : localhost
sshd : 23.163.0
sshd : 99.66.5.72

https://docs.rackspace.com/docs/restrict-ssh-login-to-a-specific-ip-or-host

https://unix.stackexchange.com/questions/406245/limit-ssh-access-to-specific-clients-by-ip-address