diff --git a/modules/base/base.sh b/modules/base/base.sh
index d742898..e7d546e 100755
--- a/modules/base/base.sh
+++ b/modules/base/base.sh
@@ -9,9 +9,12 @@ run_base() {
     timedatectl set-timezone Europe/Lisbon || true
   fi
 
-  if [[ -f /etc/ssh/sshd_config ]]; then
-    sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config || true
-    sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config || true
+  local sshd_config="${SSHD_CONFIG:-/etc/ssh/sshd_config}"
+
+  if [[ -f "$sshd_config" ]]; then
+    backup_file "$sshd_config"
+    sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' "$sshd_config" || true
+    sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/' "$sshd_config" || true
     systemctl reload ssh || systemctl reload sshd || true
   fi
 
diff --git a/tests/modules_base.bats b/tests/modules_base.bats
new file mode 100644
index 0000000..006208c
--- /dev/null
+++ b/tests/modules_base.bats
@@ -0,0 +1,29 @@
+#!/usr/bin/env bats
+
+setup() { cd "$BATS_TEST_DIRNAME/.."; }
+
+@test "run_base does not overwrite sshd_config backup" {
+  sshd_dir="$BATS_TEST_TMPDIR/etc/ssh"
+  mkdir -p "$sshd_dir"
+  sshd_config="$sshd_dir/sshd_config"
+  echo 'PasswordAuthentication yes' >"$sshd_config"
+  rm -f "$sshd_dir"/sshd_config.bak.mona.*
+
+  for cmd in timedatectl systemctl ufw; do
+    printf '#!/usr/bin/env bash\nexit 0\n' >"$BATS_TEST_TMPDIR/$cmd"
+    chmod +x "$BATS_TEST_TMPDIR/$cmd"
+  done
+
+  run bash -lc "export PATH='$BATS_TEST_TMPDIR':\$PATH; export MONA_DIR=$(pwd); export SSHD_CONFIG=$sshd_config; . modules/base/base.sh; run_base"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"[mona] backup:"* ]]
+  first_backup=$(ls "$sshd_dir"/sshd_config.bak.mona.*)
+
+  sleep 1
+
+  run bash -lc "export PATH='$BATS_TEST_TMPDIR':\$PATH; export MONA_DIR=$(pwd); export SSHD_CONFIG=$sshd_config; . modules/base/base.sh; run_base"
+  [ "$status" -eq 0 ]
+  backups=("$sshd_dir"/sshd_config.bak.mona.*)
+  [ -f "$first_backup" ]
+  [ "${#backups[@]}" -eq 2 ]
+}