ssh-hardening-incident-response

Name: ssh-hardening-incident-response
Availability: InStock
Author: ivanuser

Harden SSH configurations and respond to credential compromise incidents.

Updated Mar 20, 2026

Search Tags:#security #authentication #auditing #ssh #incident-response #ssh-hardening

Ready to run

npx skills add https://github.com/ivanuser/cortex-server-skills --skill ssh-hardening-incident-response

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ssh-hardening-incident-response
Source: https://github.com/ivanuser/cortex-server-skills/tree/main/security/ssh-hardening-incident-response
Command: npx skills add https://github.com/ivanuser/cortex-server-skills --skill ssh-hardening-incident-response

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

SSH access is frequently exposed to brute-force attempts and credential compromise; this Skill provides baseline SSH hardening and incident-response workflows to reduce risk and speed containment.

Core Features & Use Cases

Baseline SSH hardening: disable password authentication, enforce key-based login, and restrict access to trusted users.
Brute-force detection and containment: quick playbooks to identify offending IPs and isolate affected accounts.
Audit-ready configuration and rollback: versioned sshd_config backups and validated changes for compliance.
Use Case: rapidly lockdown SSH across a fleet of servers after a suspected credential exposure and rotate keys.

Quick Start

Apply the hardened SSH configuration to a remote host and verify the changes.

Frequently Asked Questions about ssh-hardening-incident-response

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I harden SSH configurations to prevent brute-force attacks on remote servers?▼

Harden SSH by disabling password authentication, enforcing key-based login, and restricting access to trusted users to prevent brute-force attacks on remote servers. This baseline configuration reduces exposure to credential compromise across cloud instances and server fleets.

What is the best way to respond to an SSH credential compromise incident?▼

Respond to an SSH credential compromise by using incident response workflows to identify offending IPs, isolate affected accounts, and rapidly rotate keys. These playbooks help contain brute-force events and secure remote servers quickly after suspected exposure.

Can I use this SSH hardening approach across a fleet of cloud instances?▼

Yes, this SSH hardening approach applies to cloud instances and remote server fleets requiring minimal privilege and key rotation. It supports phased rollout to apply validated configuration changes across multiple hosts while maintaining secure access.

How does SSH key rotation work during a security lockdown?▼

SSH key rotation during a lockdown involves replacing compromised credentials with new key-based authentication and enforcing minimal privilege access. Validated changes and versioned sshd_config backups ensure the rotation is tracked and can be rolled back if needed.

Does this SSH hardening process provide audit trails for compliance?▼

Yes, the SSH hardening process provides audit-ready configurations through versioned sshd_config backups and monitoring. Validated changes create audit trails that document exactly what security modifications were applied to remote servers for compliance verification.

What should I do if I need to rollback SSH configuration changes after hardening?▼

Rollback SSH configuration changes using the versioned sshd_config backups created during the hardening process. These validated changes ensure you can safely revert to previous settings if access issues occur while maintaining audit trails of the modifications.