Hardening

Why disabling unused systemd units matters

Every fresh install of a modern distro ships dozens of systemd units.
Bluetooth, CUPS, smart‑card readers, legacy daemons—you name it.
On a headless server most of those are overkill. They still eat a bit of RAM,
they create audit events that you’ll never look at, and they’re an extra attack surface.

The quickest way to shrink that surface and keep the journal from turning into a log‑dump is to disable the unit in one go and clean up its log space.

Why SSH Still Asks for a Password After Adding a Key

Adding a public key to ~/.ssh/authorized_keys is the first step toward password‑less login, but the SSH daemon can still fall back to password authentication for a handful of reasons. The most common culprit is a mis‑configured PubkeyAuthentication setting in /etc/ssh/sshd_config or a permissions problem that causes the server to ignore the key file.

1. Verify the Key Is Accepted by the Server

# On the client
ssh -vvv user@host

The -vvv flag prints the entire authentication dance. Look for lines like: