Securing SSH Access and Configuration in Linux

In today’s digital landscape, securing your server's access points is more critical than ever. This article will provide you with in-depth insights and practical steps to enhance your SSH security on Linux systems. You can get training on our comprehensive approach to securing SSH access and configuration as we explore best practices, key configurations, and the implementation of two-factor authentication.

Best Practices for SSH Security

When it comes to SSH (Secure Shell), following best practices is vital for protecting your systems from unauthorized access. Below are some fundamental measures to consider:

1. Change the Default SSH Port

By default, SSH runs on port 22, which is well-known and often targeted by attackers. Changing the SSH port can help reduce the number of automated attacks. You can modify the SSH configuration file located at /etc/ssh/sshd_config:

# Open the SSH configuration file
sudo nano /etc/ssh/sshd_config

# Change the port from 22 to a custom number, e.g., 2222
Port 2222

2. Disable Root Login

Allowing root login via SSH increases risks. Instead, you should create a user with sudo privileges:

# Disable root login in the sshd_config
PermitRootLogin no

3. Use Strong Passwords and Key-Based Authentication

If you must allow password authentication, ensure that all user accounts have strong, complex passwords. However, the preferred method is to use SSH key-based authentication, which is more secure than passwords alone.

4. Implement Fail2Ban

Fail2Ban is an intrusion prevention software that scans log files and bans IP addresses that show malicious signs. Installing and configuring Fail2Ban can significantly reduce the risk of brute-force attacks:

# Install Fail2Ban
sudo apt-get install fail2ban

You can configure it by editing the jail configuration files located in /etc/fail2ban/jail.local.

Configuring SSH Keys for Authentication

SSH keys provide a more secure method for logging into an SSH server than using a password. Here’s how to set up SSH key-based authentication:

Step 1: Generate SSH Key Pair

On your local machine, generate a key pair using the following command:

ssh-keygen -t rsa -b 4096

Follow the prompts to save the key pair in the default location (~/.ssh/id_rsa) and optionally set a passphrase.

Step 2: Copy the Public Key to the Server

Once the key pair is created, copy the public key to the server using ssh-copy-id:

ssh-copy-id user@server_ip_address

This command will append the public key to the ~/.ssh/authorized_keys file on the server.

Step 3: Disable Password Authentication

To enhance security further, disable password authentication in the SSH configuration:

# Open the SSH configuration file
sudo nano /etc/ssh/sshd_config

# Disable password authentication
PasswordAuthentication no

After making these changes, restart the SSH service:

sudo systemctl restart sshd

Limiting SSH and Using Two-Factor Authentication

To further secure SSH access, consider implementing the following strategies:

1. Limit User Access

Restrict SSH access to only specific users who require it. You can do this by adding a line in your sshd_config file:

# Allow only specific users
AllowUsers user1 user2

2. Use Two-Factor Authentication (2FA)

Two-factor authentication adds an additional layer of security. Here's how to set it up using Google Authenticator:

Step 1: Install Google Authenticator

On your server, install the Google Authenticator PAM module:

sudo apt-get install libpam-google-authenticator

Step 2: Configure Google Authenticator for Your User

Run the following command for each user who requires 2FA:

google-authenticator

Follow the prompts to configure the settings. This will generate a QR code that you can scan with your Google Authenticator app.

Step 3: Update PAM Configuration

Edit the /etc/pam.d/sshd file to include the Google Authenticator module:

# Add this line at the top
auth required pam_google_authenticator.so

Step 4: Update SSH Configuration

Ensure that the SSH configuration allows for both public key and 2FA authentication:

# Open the SSH configuration file
sudo nano /etc/ssh/sshd_config

# Allow public key and 2FA authentication
ChallengeResponseAuthentication yes

Restart the SSH service for the changes to take effect:

sudo systemctl restart sshd

Summary

Securing SSH access and configuration is essential in safeguarding your Linux systems from unauthorized access and potential breaches. By changing the default SSH port, disabling root login, using strong passwords and SSH keys, implementing Fail2Ban, limiting user access, and incorporating two-factor authentication, you can significantly enhance the security of your servers.

By following these best practices and configurations, you’ll not only protect your data but also build a robust security posture for your Linux environment. Always remember that security is an ongoing process, and regularly reviewing and updating your security measures is vital in the ever-evolving landscape of cyber threats.

Last Update: 20 Jan, 2025