» Five Tips for Securing SSH

These snippets are all options in the sshd_config file, located at /etc/ssh/sshd_config on most Linux distros.

In order of increasing security

1. Dissallow SSHv1 and force SSHv2 connections
   Protocol 2

   SSHv1 is now considered unsecure.

2. Limit the number of SSH connection attempts at one time
   MaxStartups 2

   or

   MaxStartups start:rate:full

   From the sshd_config manpage

   Alternatively, random early drop can be enabled by specifying the three colon separated values "start:rate:full" (e.g., "10:30:60"). sshd will refuse connection attempts with a probability of "rate/100" (30%) if there are currently "start" (10) unauthenticated connections. The probability increases linearly and all connection attempts are refused if the number of unauthenticated connections reaches "full" (60).

   This one is good to slow up automated brute force password bots.

3. Dissallow direct root login
   Permit no root login attempts
   PermitRootLogin no

   or
   Permit root login attempts only via keys in authorized_keys file

   PermitRootLogin without-password

   This is the method I usually go for. It prevents brute-force root attempts but still allows for easy enough access. If someone has your private key, you have more problems anyway.

4. Change the port SSH listens to. If a hacker cannot find what port SSH is listening on, he cannot very easily try to brute force the password. Change the default port 22 to random non-used port number
   Port 22

   All valid users will need to adjust their SSH connections to use the new SSH port.

5. Disable all password authentication and rely solely on public key authentication
   PasswordAuthentication no

   All valid users must have a public/private key pair installed on the remote host and their local workstation or any other client that they will access the remote host with.

Make sure you load these changes by restarting the SSH server. On most Linux systems this can be accomplished with:

or

More information on each of these settings can be found in the sshd_config manpage

Popularity: 20%

Share This