Port=<port#> ;change port number
PermitRootLogin no ;not allow root login
AllowUsers <username> ;allow user login not root
systemctl restart sshd
systemctl enable sshd
sudo firewall-cmd --add-port=22/tcp --permanent

Authorized Keys
Gen key in remote PC
#ssh-keygen -t rsa -b 4096 ; Gen keys
:) id_rsa and id_rsa.pub created and save <user_home path>/.ssh/ e.g. /home/jame/.ssh/,
:) rename id_rsa.pub to authorized_keys
:) transfer authorized_keys to SSH server

SSH server
copy authorized_keys to <user_home path>/.ssh/ e.g. /home/jame/.ssh/authorized_keys
If your SSH folder does not yet exist, create it manually:

$ mkdir ~/.ssh
$ chmod 0700 ~/.ssh
$ touch ~/.ssh/authorized_keys
$ chmod 0644 ~/.ssh/authorized_keys

edit sshd_config file #vim /etc/ssh/sshd.conf , change

PubkeyAuthentication yes
PasswordAuthentication no
UsePAM no

systemctl restart sshd

Gen public key by puttygen for putty

1) "number of bits in a generated key" : 2048 or 4096 , mark "RSA: option , click "Gen"

2) save Private Key into local PC

3)on top puttygen , “Public key for pasting into OpenSSH authorized_keys file" , below box : “ssh-rsa …" codes, directly Copy and paste to a text file

4) edit this text file , remove new line character ，change whole coding into a one line.
5) move this text file to SSH server /home/~/.ssh/ , cat id_dsa >> authorized_keys。

putty setting :

In the Host Name field, enter the IP address of your VPS or its fully qualified domain name

Enter the port number in the Port field (for added security, consider changing your server's SSH port to a non-standard port.)

Select SSH under Protocol;

Along the left-hand side of the window, select the Data sub-category, under Connection;

Specify the username that you plan on using, when logging in to the SSH server, and whose profile you're saving, in the Auto-login username field;

Expand the SSH sub-category, under Connection;

Highlight the Auth sub-category and click the Browse button, on the right-hand side of the PuTTY window;

Browse your file system and select your previously-created private key;

Return to the Session Category and enter a name for this profile in the Saved Sessions field, e.g. user@123.456.78.9 or user@host.yourdomain.tld;

Enter current password for root (enter for none):
OK, successfully used password, moving on...
Setting the root password ensures that nobody can log into the MariaDB
root user without the proper authorization.
New password: password
Re-enter new password: password
Password updated successfully!
Reloading privilege tables.. ... Success!