Posted on
• commands

How to Secure SSH Access

Author
  • User
    Linux Bash
    Posts by this author
    Posts by this author

How to Secure SSH Access: Essential Steps for Safer Remote Connections

Secure Shell (SSH) is a cryptographic network protocol for secure remote login and other secure network services over an unsecured network. While it is a secure method by default, there are many ways it can be improved to ensure that your systems are less vulnerable to attacks. In this article, we will explore various strategies and practical steps to secure SSH access to your servers or infrastructure.

1. Use Strong Authentication Methods

Key-based Authentication: Ditch passwords in favor of SSH keys! SSH keys are a pair of cryptographic keys which can be used to authenticate to an SSH server as an alternative to using passwords. Key-based authentication is highly secure since it generates a private and a public key which are much harder to crack than plain passwords.

  • Generate SSH Key Pair: Use a command like ssh-keygen to generate a key pair.

  • Secure the Private Key: Keep your private key secure and ensure it is encrypted with a strong passphrase.

  • Deploy Public Key: Copy the public key to the ~/.ssh/authorized_keys file on the servers you need access to.

Two-factor Authentication (2FA): Add an extra layer of security by enabling two-factor authentication. This requires not only something you know (your password or key) but also something you have (a token or a mobile phone app authentication code).

2. Disable Root Login

Logging in as the root user (administrator) can be dangerous. If attackers gain access to your server as root, they have complete control.

  • Edit the SSH configuration file /etc/ssh/sshd_config and set PermitRootLogin no.

  • Restart the SSH service to apply changes.

3. Change the Default SSH Port

By changing the default SSH port (22), you can avoid a lot of automatic scan attacks:

  • Edit /etc/ssh/sshd_config:

    Port your_custom_port_number

  • Restart the SSH service.

  • Remember to update any firewall rules and port forwarding settings.

4. Use a Whitelist for SSH Access

Limiting access to your SSH server can be done by whitelisting IP addresses that are allowed to connect:

  • Edit /etc/ssh/sshd_config to include:

    AllowUsers username@ip_address

    You can also use subnets.

  • Restart the SSH service after saving the changes.

5. Install and Configure Fail2Ban

Fail2Ban is an intrusion prevention software that scans log files (e.g., /var/log/auth.log) and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc.

  • Install Fail2Ban.

  • Configure /etc/fail2ban/jail.local to protect SSH.

  • Enable and start the Fail2Ban service.

6. Regular Updates and Patch Management

Keep your server and SSH daemon regularly updated to ensure there are no known vulnerabilities.

  • Use your package manager to update the SSH package.

  • Subscribe to your operating system's security announcements to apply updates and patches promptly.

7. Monitor SSH Access

Regular monitoring and auditing of SSH access can help you identify unusual access patterns or potential security breaches.

  • Review SSH logs frequently.

  • Use security tools to monitor and alert on suspicious activities.

8. Limit SSH Access with Firewalls

Utilizing a firewall to restrict which machines can attempt to connect to your SSH server increases security significantly:

  • Only allow connections to the SSH port from trusted IPs.

  • Use tools like iptables, ufw (Uncomplicated Firewall), or cloud provider security groups to manage these rules.

Conclusion

While SSH is inherently secure, the security can and should be enhanced to prevent unauthorized access and potential breaches. By implementing the practices outlined above, such as using SSH keys instead of passwords, disabling root login, and changing the default SSH port, you can significantly bolster the security of your SSH implementations.

Remember, security is about layers; applying several of these steps together creates a much stronger defensive against potential intruders. Stay safe and ensure your data remains protected with these advanced SSH security practices!

Related posts