When securing a Linux server, simply using SSH keys and disabling passwords isn’t always enough—especially for root access, which is a prime target for attackers. Restricting IPs or VPN is a good approach but not always possible. To enhance protection, you can implement Port Knocking, ProxyJump/Bastion Host, and Google Authenticator 2FA—but exclusively for root users, while allowing normal users to log in more conveniently.

1. Port Knocking for Root Access

Port Knocking keeps SSH invisible unless a specific sequence of connection attempts is made first. This ensures that only authorized users can expose the SSH port.

• Configure knockd to require knocking only for root login while normal users access SSH normally.
• Example sequence to open SSH:

  sequence = 7000,8000,9000
  command = iptables -A INPUT -p tcp --dport 22 -s %IP% -j ACCEPT
  

• Restrict SSH for root in sshd_config:

  Match User root
  Port 2222
  

Now, root users must “knock” to gain access, while normal users use standard SSH.

2. Google Authenticator 2FA for Root

Enforcing multi-factor authentication (MFA) for root ensures extra protection beyond SSH keys.

• Install Google Authenticator:

  apt install libpam-google-authenticator
  dnf install google-authenticato

• Require 2FA only for root in PAM:

  Match User root
  auth required pam_google_authenticator.so
  

• Enforce multiple authentication methods:

  Match User root
  AuthenticationMethods publickey,password publickey,keyboard-interactive
  

This setup ensures root users need an extra authentication step, while normal users continue with SSH keys.
If 2FA providers are unavailable, emergency bypass OTP backup codes or physical security tokens can restore access.

3. Bastion Host for Root

A Bastion Host (Jump Host) acts as an intermediary, ensuring direct SSH access to root is not possible.

• Restrict root login to only be allowed from the bastion:

  Match User root
  AllowTcpForwarding no
  AllowUsers root@bastion-ip
  

• On the client side, enforce ProxyJump:

  Host myserver
      User root
      ProxyJump bastion_host
  

With this setup, attackers cannot SSH directly to the server as root.

Pros & Cons
A Bastion Host is a great security solution, but it comes with both benefits and drawbacks. Here’s a balanced look at its pros and cons.
Pros of Using a Bastion Host

✅ Enhanced Security Layer – It prevents direct SSH access to critical servers, reducing the risk of brute-force attacks.
✅ Centralized Access Control – Acts as a single entry point, making user authentication and permissions easier to manage.
✅ Logging & Auditing – Bastion hosts can record SSH sessions, helping with security monitoring and compliance.
✅ Reduced Attack Surface – Since users must go through the bastion, fewer ports are exposed on the actual servers.
✅ Multi-Factor Authentication (MFA) Support – You can enforce 2FA or biometric authentication for extra security.
Cons of Using a Bastion Host

❌ Single Point of Failure – If the bastion goes down, users may lose access to the entire infrastructure unless backup access is in place.
❌ Performance Bottleneck – If not scaled properly, it can slow down connections, especially with large numbers of users.
❌ Additional Complexity – Requires extra configuration and maintenance, including access rules and monitoring.
❌ Target for Attackers – Since all SSH traffic goes through it, attackers may try to compromise the bastion itself.
Final Thoughts

Verdict: A Bastion Host is an excellent security tool, but it must be hardened properly, monitored, and paired with backups to ensure reliability. E.g.:

iptables -A INPUT -p tcp –dport 22 -s BACKUP_IP -j ACCEPT

Final Thoughts

By combining Port Knocking, Bastion Host restrictions, and 2FA, you can make SSH access to root far more secure while ensuring redundancy in case of root access failure and allowing normal users to log in more conveniently. These techniques significantly reduce the risk of unauthorized access while maintaining a balance between security and usability.