Leaving the default settings of SSH is not a good idea, here are a few steps you should consider to improve the security of your server.<\/p>\n
Default Settings<\/strong> Four minor items that should be changed at first boot of the server.<\/p>\n Improve SSH Security Disable\u00a0SSH\u00a0Protocol 1<\/strong> #Protocol 2,1 Restrict Root Login<\/strong> Setting the option to \u00a0\u201cno\u201d disables all direct root logins. If you rather only disable password logins, change the setting to \u201cwithout-password\u201d.<\/p>\n My preference is to set this option to \u201cno\u201d, but the important thing is to be consistent. If you on some servers allows direct root logins with or without passwords, you are only going to be confused on which ones are enabled and which ones who are not.<\/p>\n #PermitRootLogin yes Reduce Grace Time<\/strong> #LoginGraceTime 2m Default Port<\/strong> The vast majority of SSH attacks are directed by compromised zombie machines against SSH servers listening on the default port of \u201c22\u201d. By changing this port to something else you greatly reduce the risk of an automated break-in.<\/p>\n This is usually called security by obscurity and is in a way, giving you a false feeling of security. If you on the other hand see the changing of port as your number one security setting, you most likely have other security issues that should worry you. While you may reduce the number of attacks from \u201cblind\u201d zombies (or bots), it only takes a simple port-scanning of your server to identify what port you are using for SSH.<\/p>\n There is nothing wrong in changing the SSH port. The main thing, as already been pointed out: Be consistent!<\/p>\n If you for every server randomly selects a port, you will have a hard time to keep track of the ports yourself.<\/p>\n Not to mention that if you by accident (or willingly) changes the port to something that are often used by other applications, you might be flagged as a \u201csuspect\u201d by some security scanners.<\/p>\n Protect SSH with a Firewall<\/strong> Restrict Users<\/strong> AllowUsers root admin webmaster<\/p>\n OR<\/p>\n AllowGroup sshusers<\/p>\n <\/p><\/blockquote>\n Do not Use Passwords<\/strong> If you disable password-logins, it doesn\u2019t matter if the person knows it. They won\u2019t be able to login. When enabling this, be sure to test it more then once, you must be certain that your keys configured properly. Otherwise you will be locked out from oyur server. Do you often use SFTP\/SCP to send\/get files from your server? Many clients can also use keys, so there is no excuse not to use it. Search for your favourite SSH client and keys. You will find many guides on howto set it up.<\/p>\n To disable password authentication completly, set this directive:<\/p>\n PasswordAuthentication no<\/p><\/blockquote>\n
\nFirst of all, we look att the default settings as these apply to many (most?) distributions.<\/p>\n\n
\n<\/strong><\/p>\n
\nSSH\u00a0has two protocols, 1 and 2. Protocol 1 has a number of known flaws and should no longer be used.
\nDiisable Protocol 1 by editing \/etc\/ssh\/sshd_confi<\/code>g<\/code><\/p>\n
\nProtocol 2<\/p><\/blockquote>\n
\nThere are two options in restricting access to root logins. You can either disable root logins completly or you can force it to use SSH keys.<\/p>\n
\nPermitRootLogin no<\/p><\/blockquote>\n
\nThe default grace time for authenticating a user is 2 minutes. This is only necessary if you are on a very slow connection but often it will only result in holding unathenticated connections open for a very long time.\u00a0You can, and should reduce this to somewhere around 30 seconds, that is most likely enough time for everyone to login.<\/p>\n
\nLoginGraceTime 30<\/p><\/blockquote>\n
\nWhen reading forums all over the Internet, you will find recommendations on changing the default port of SSH. \u2018Very often the person recommending this will use this as an example.<\/p>\n
\n<\/em><\/p>\n
\nOne of the best measures you can apply. Use your firewall to block access to SSH from unauthorized IP addresses. This provides a very secure, first layer of security. If you are not lucky enough to have a hardware firewall, you can use IPTables to limit SSH access.<\/p>\n
\nConfigure SSH to permit only certain users to log in. By default all users can access SSH. Start using the \u201cAllowUsers\u201d directive and restrict access to only certain users. This also adds another layer of security. As an alternative there is also the \u201cAllowGroup\u201d directive.
\nYou can then add\/remove users from this group and by that add\/remove SSH access.<\/p>\n
\nIf you use keys as authentication, disable password-based logins completly.<\/p>\n