xyz.sh adds no telemetry and performs no hidden actions. Read the full source on the page or download it with curl -fsSL xyz.sh/ .sh first; every script has a / .sh.sha256 checksum. Piping a remote script to bash is still a risk — review the source first. Lock-out protection: a failed sshd -t restores the backup; the new port is added next to the old one; --disable-password is refused without a key; sshd is reloaded, not restarted. You still need to open the new port in your cloud security group.

Which operating systems are supported?

Declared support: Debian, Ubuntu, CentOS, Rocky Linux, and AlmaLinux. The script detects the distribution and warns on an unknown one. It was tested in Docker containers of these systems (syntax, --dry-run, and whatever can run in a container; see tests/RESULTS.md); parts that need systemd, kernel modules, or the public internet still need a real VPS.

Yes. Run it as root or via sudo bash; it exits with a message otherwise. --dry-run and --status show what it would do first.

I can't connect on the new port — what now?

The old port is still open by default: log in on it, check that your cloud security group / firewall allows the new port, or run --rollback. If you already closed the old port, use your provider's VNC/console to run --rollback.

SSH Hardening Tutorial: Port Change and Key Login

This tutorial walks through hardening SSH on a VPS with xyz.sh/ssh without locking yourself out.

Prerequisites

Root access and an SSH session you keep open.

A public key if you will disable passwords (for example the keys on your GitHub account).

Know where your provider's security group and VNC/console are.

Steps

Optional: read the source with curl -fsSL xyz.sh/ssh.sh and compare xyz.sh/ssh.sh.sha256.

Show current settings: curl -fsSL xyz.sh/ssh | bash -s -- --status

Add a port (old one kept): curl -fsSL xyz.sh/ssh | bash -s -- --port 2222 -y, open 2222 in the security group, and test ssh -p 2222 from a new terminal.

Import keys and disable passwords: curl -fsSL xyz.sh/ssh | bash -s -- --github yourname --disable-password -y

After the new port works, close the old one: curl -fsSL xyz.sh/ssh | bash -s -- --port 2222 --close-old -y

How to verify

Keep this terminal open and from a new one run ssh -p NEW_PORT user@server to confirm. curl -fsSL xyz.sh/ssh | bash -s -- --status shows the effective sshd -T values.

How to undo or uninstall

curl -fsSL xyz.sh/ssh | bash -s -- --rollback -y removes the xyz.sh block, restores commented Port lines and reloads sshd; keys added to authorized_keys are kept — remove them manually if needed.