Introduction to SSH Security

SSH (Secure Shell) is the primary method for remote server access, making it a critical security component. This guide covers advanced SSH server hardening techniques.

Basic Hardening Steps

1. Change default port:

Port 2222

2. Disable root login:

PermitRootLogin no

3. Enable key-based authentication:

PasswordAuthentication no
PubkeyAuthentication yes

Advanced Security Measures

Two-Factor Authentication

1. Install Google Authenticator:

sudo apt install libpam-google-authenticator

2. Configure PAM:

auth required pam_google_authenticator.so

Intrusion Prevention

1. Install fail2ban:

sudo apt install fail2ban

2. Configure SSH jail:

[sshd]
enabled = true
maxretry = 3
bantime = 1h

Performance Optimization

ClientAliveInterval 300
ClientAliveCountMax 2
TCPKeepAlive yes
Compression delayed

Troubleshooting Common Issues

• Connection refused: Check ss -tulpn | grep sshd
• Permission denied: Verify ~/.ssh/authorized_keys permissions
• Slow connections: Disable DNS lookups with UseDNS no

Security Audit Checklist

1. Regularly rotate SSH keys
2. Monitor auth logs: /var/log/auth.log
3. Implement IP whitelisting
4. Use SSH certificates for large deployments

Conclusion

A properly hardened SSH configuration is essential for protecting your servers from unauthorized access. By implementing these measures, you’ll significantly reduce your attack surface while maintaining accessibility.

Learn basic IPTables configuration for Linux firewalls.

1. List current rules:

sudo iptables -L -v -n

2. Allow SSH:

sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

3. Block IP:

sudo iptables -A INPUT -s 192.168.1.100 -j DROP

4. Save rules:

sudo iptables-save > /etc/iptables/rules.v4

Read more: IPTables Documentation

Learn how to set up and manage UFW (Uncomplicated Firewall) on Ubuntu with advanced configurations.

1. Install UFW:

sudo apt install ufw

2. Set default policies:

sudo ufw default deny incoming
sudo ufw default allow outgoing

3. Enable UFW:

sudo ufw enable

4. Allow specific services:

sudo ufw allow ssh
sudo ufw allow http
sudo ufw allow https

5. Advanced configurations:

# Allow specific IP range
sudo ufw allow from 192.168.1.0/24

# Rate limiting
sudo ufw limit ssh

# Delete rule
sudo ufw delete allow http

Monitoring and logging:

Learn how to set up secure SSH access on your Linux server with advanced configuration options.

1. Install OpenSSH server:

sudo apt install openssh-server

2. Configure SSH with enhanced security:

sudo nano /etc/ssh/sshd_config

Set these recommended options:

PermitRootLogin no
PasswordAuthentication no
AllowUsers yourusername

3. Generate SSH keys:

ssh-keygen -t ed25519 -C "[email protected]"

4. Restart SSH service:

sudo systemctl restart ssh

5. Test connection with key-based authentication:

ssh -i ~/.ssh/id_ed25519 user@your-server-ip

Additional security measures: