SSH is reachable from the internet

InfoHigh confidencenet.ports.ssh-exposed

What this check looks for

Port 22 on ‹host› accepts connections. This is normal — it is how most servers are administered — and it is worth knowing, because it guarantees a continuous stream of automated login attempts.

Why it matters

An internet-facing SSH port is not a fault and this finding deducts nothing. What it does mean is that the machine's security rests entirely on SSH's own authentication, so it is worth confirming that password logins are off.

What it costs your score

This check never deducts. It reports a fact — or reports that something could not be verified — and is shown on the report without moving the score.

Severity: info
Default confidence: high
Status when triggered: info
Deduction: 0 points
Family cap: none
Category: Network
Module: Net ports
Fix owned by: user
In the ruleset since: 2026.09

How the whole score is calculated

How to fix it

Confirm password authentication is disabled for SSH.

Key-only authentication makes the continuous automated password guessing against this port irrelevant rather than merely survivable.

Check the effective setting: sudo sshd -T | grep -i passwordauthentication.
If it reports yes, add your public key to ~/.ssh/authorized_keys and confirm you can log in with it — in a second session, before changing anything.
Set PasswordAuthentication no and KbdInteractiveAuthentication no in sshd_config, then sudo systemctl reload sshd.
Check for a drop-in file under /etc/ssh/sshd_config.d/ that re-enables it; cloud images frequently ship one.

How to confirm it worked

sudo sshd -T | grep -i passwordauthentication — expect passwordauthentication no
ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no ‹host› — should be refused

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Remediation by platform

Linux host

# Check the effective configuration, not just the file — drop-ins override it.
sudo sshd -T | grep -iE 'passwordauthentication|permitrootlogin|kbdinteractive'

# /etc/ssh/sshd_config.d/99-hardening.conf
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin prohibit-password

# Verify the config parses before reloading, so a typo does not lock you out.
sudo sshd -t && sudo systemctl reload sshd

Keep a second session open until you have confirmed a key login works. sshd -t catches a syntax error; it cannot catch having no working key.

Technical detail

A TCP connection to ‹host›:22 completed. SSH is encrypted from the first exchange, has no plaintext fallback, and is the intended way to administer a Unix machine, so an open port 22 is reported as information rather than as a defect. Presenting it as a problem would be wrong, and would train you to ignore the ports on this list that genuinely are problems.

The one thing worth checking is authentication. PasswordAuthentication no in sshd_config turns the continuous background of automated password guessing from a risk into noise, because there is no password to guess. Key-based authentication is the default on most current distributions and on every major cloud image, so on many machines this is already true — confirm it rather than assume it.

Two things often suggested here are worth being honest about. Moving SSH to a non-standard port reduces log volume and nothing else; the scanners that matter scan every port. Blocking repeated failures with fail2ban is useful against noise and is not a substitute for disabling password authentication.

If the machine does not need to be administered from arbitrary addresses, restricting port 22 to a VPN or a bastion is a genuine improvement — but it is an improvement over something already reasonable, not a fix for something broken.