How to harden SSH in your server?

Discussion in 'Security' started by olddocks, Apr 25, 2008.

  1. #1
    SSH attacks are quite common if you are running SSH on Port 22. Most automated robots try to login as root with various brute force and dictionary combinations to get access to your server. Further these robots put a lot of load on your server with thousands of retries to break in to your system. It can be prevented with simple steps.

    i have published the article here

    Leave me a feedback if my work is of any help :D
     
    olddocks, Apr 25, 2008 IP
    argothiusz likes this.
  2. bucasia

    bucasia Peon

    Messages:
    50
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    0
    #2
    Good tutorial.

    I also install denyhosts on my servers too. This blocks IP addresses that make repeated failed attempts to log in.

    Matt
     
    bucasia, Apr 26, 2008 IP
  3. milesbparty

    milesbparty Peon

    Messages:
    148
    Likes Received:
    7
    Best Answers:
    0
    Trophy Points:
    0
    #3
    A couple other things:

    Specify AllowUsers user@host
    Allow only specific users from specific hosts, deny everyone else.

    Do not turn off PrivilegeSeparation and do not turn on X11Forwarding. Make sure you set password aging on user accounts that will be able to log into your server from the internet, and also lock accounts after a certain number of unsuccessful login attempts.

    Use TCPWrappers.

    There are so many other security related items that should be configured throughout a server; security is an ongoing effort.

    Nice tutorial.
     
    milesbparty, Apr 26, 2008 IP
  4. rootbinbash

    rootbinbash Peon

    Messages:
    2,198
    Likes Received:
    88
    Best Answers:
    0
    Trophy Points:
    0
    #4
    google > port knocking
     
    rootbinbash, Apr 27, 2008 IP
  5. argothiusz

    argothiusz Well-Known Member

    Messages:
    1,500
    Likes Received:
    79
    Best Answers:
    0
    Trophy Points:
    140
    #5
    I like method 2 but let say what if you accidentally lost your key which saved in your PC. What can you do? or you screw and have to reload the OS
     
    argothiusz, May 18, 2008 IP
  6. and_y

    and_y Active Member

    Messages:
    287
    Likes Received:
    4
    Best Answers:
    0
    Trophy Points:
    58
    #6
    i think using method 2 (SSH Public/Private Key Authentication) is the best way to prevent brute force attacks.
     
    and_y, May 18, 2008 IP
  7. xous

    xous Active Member

    Messages:
    173
    Likes Received:
    11
    Best Answers:
    0
    Trophy Points:
    60
    #7
    If you lost the key you would have to get someone with physical access to the machine (or kvm console) to login with the password that is still set on the account.

    If you also forgot that password you would need to boot in single user mode and reset the password.

    I would recommend not losing your key file and or keeping a backup in a safe place.
     
    xous, May 22, 2008 IP
  8. SPARKS MAN

    SPARKS MAN Peon

    Messages:
    13
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #8
    install
    logwath on ur server to tell u a full report of failler trying and all other using of SSH
     
    SPARKS MAN, May 24, 2008 IP