Securing Servers with SSH Hardening

SSH (Secure Shell) is a protocol used to securely access servers over a network. While SSH is inherently secure, implementing certain hardening practices can significantly enhance its security against unauthorized access and attacks. This tutorial will outline effective strategies for hardening your SSH configuration.

1. Disable Root Login

Disabling root login via SSH is a crucial step in improving server security. To do this, edit the SSH configuration file:

sudo nano /etc/ssh/sshd_config

Find the line:

PermitRootLogin yes

Change it to:

PermitRootLogin no

Then restart the SSH service:

sudo systemctl restart sshd

2. Change the Default SSH Port

Changing the default SSH port (22) can help reduce the number of automated attacks on your server. In the same sshd_config file, change the port number:

Port 2222

Make sure to update your firewall settings accordingly and restart the SSH service.

3. Use SSH Key Authentication

Using SSH keys rather than passwords greatly enhances security. To set up SSH key authentication:

ssh-keygen -t rsa -b 4096 -C "[email protected]"

This command generates a public/private key pair. Upload your public key to the server:

ssh-copy-id user@your_server_ip

Once the key is copied, disable password authentication by editing the sshd_config file:

PasswordAuthentication no

4. Implement Fail2Ban

Fail2Ban is a tool that helps prevent brute-force attacks by monitoring login attempts and blocking suspicious IPs. Install Fail2Ban:

sudo apt install fail2ban

Configure Fail2Ban by editing its configuration file:

sudo nano /etc/fail2ban/jail.local

Add the following lines:

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3

Restart the Fail2Ban service to apply the changes:

sudo systemctl restart fail2ban

5. Keep Your System Updated

Keeping your server’s software up to date is essential for security. Regularly check for updates by running:

sudo apt update && sudo apt upgrade -y

6. Configure Firewall Rules

Use a firewall to restrict access to your server. To configure UFW (Uncomplicated Firewall), use:

sudo ufw allow 2222/tcp
sudo ufw enable

Replace 2222 with your custom SSH port.

7. Conclusion

By implementing these best practices for SSH hardening, you can significantly enhance the security of your servers. Remember to regularly review your security configurations and stay updated with the latest security practices to protect your infrastructure from potential threats.

About the Author

Dorian Kane

Author

View All Posts