Migration in progress. api.legendary-arena.com and PostgreSQL are moving from Render to a self-hosted DigitalOcean Ubuntu host behind Cloudflare. Render remains rollback-ready until decommission phase.

SSH Hardening

Lock remote access to key-only operator login, disable root SSH, and verify access continuity before closing old sessions.

Summary

This page owns infra/scripts/05-user-and-ssh.ps1, which enforces:

• non-root operator account with sudo
• PermitRootLogin no
• PasswordAuthentication no
• sshd config validation and reload

Safety sequence

Always keep at least two active SSH sessions open during changes.

1. Open session A and session B as operator.
2. Run the script in session A.
3. Start a new session C to confirm fresh login works.
4. Only then close session A/B.

Execute

	sudo pwsh -File infra/scripts/05-user-and-ssh.ps1

Optional username override:

	sudo OPERATOR_USER=operator pwsh -File infra/scripts/05-user-and-ssh.ps1

Verification

# confirm config directives
sudo grep -E '^(PermitRootLogin|PasswordAuthentication)' /etc/ssh/sshd_config.d/99-la-hardening.conf

# verify sshd config is valid
sudo sshd -t

# verify service health
sudo systemctl status ssh --no-pager

Expected values:

• PermitRootLogin no
• PasswordAuthentication no
• sshd -t exits zero

Mechanics

The script writes a managed drop-in file at /etc/ssh/sshd_config.d/99-la-hardening.conf instead of editing distro defaults inline. This keeps changes explicit, idempotent, and easy to audit.

Failure and rollback

If new login fails after running the script:

1. Stay on an existing open SSH session.
2. Restore previous file from backup under /etc/ssh/sshd_config.d/ if created.
3. Re-run sudo sshd -t.
4. Reload SSH service and test a new login again.

References

• Plan section 4.1 (ssh-hardening.md stub)
• Plan section 5.1 (Access hardening safety sequence)