How to restrict who can log in — AllowUsers, MaxAuthTries, and changing the port safely

Only two accounts should be able to log in at all, failed attempts should be cut off early, and the port move must not lock you out.

Every flag and config keyword was checked against the OpenSSH 9.6 man pages, and the config examples were parsed for real with ssh -G.

AllowUsers deploy ops
MaxAuthTries 3
Port 2222
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak   # 1. backup
sudo sshd -t                                            # 2. syntax check — silence means OK
# (and open the new port in your firewall before step 3, if you changed it)
sudo systemctl reload ssh                               # 3a. Debian/Ubuntu: service name is "ssh"
sudo systemctl reload sshd                              # 3b. RHEL family: service name is "sshd"
# reload keeps existing sessions alive — verify a fresh login works before logging out

Good to know

AllowUsers whitelists accounts; MaxAuthTries drops a connection after that many failed attempts (the default is 6). The safe drill: back up the config, syntax-check with sshd -t (silence means OK), open the new port in the firewall if you changed it, then reload — a reload keeps existing sessions alive, and the service is called ssh on Debian/Ubuntu, sshd on the RHEL family.

SSH Cheatsheet one-page card — commands that actually work — The full one-page card — SSH Cheatsheet. Get the complete cheatsheet on GitHub