Hi, I have heard that changing the following makes my server more secure: Do you think I should change my current settings to these? What is the difference between PermitRootLogin being changed to 'no'? Thanks
Yes or use iptables to only allow access to port 22 from your network. Setting PermitRootLogin to no will stop anyone from logging in as root via SSH. If you need do do things as root, use sudo [google it].
Yes you should make that change. There is an excellent security 101 article at linux.com about securing ssh. Do not be dismayed by the title or the snide reactions by readers at that site. It is fairly complete newbie summary of steps needed to make for a more secure ssh environment. The most basic ones to implement are to disallow root access and only allow ssh access by a specified list of users. They have the interesting idea of setting up non-privileged dummy account and only allowing that user to start an ssh session. You then use the "su" command to switch to your user account. This two-step process is good because if the dummy account is compromised, it does not have the ability to do anything and the hackers needs to continue guessing the password for root. You also need to make sure the root password -- and all passwords for that matter -- is VERY hard to guess and unfriendly to dictionary attack.