In today’s digital landscape, securing your servers is more important than ever. One of the most common methods for remote administration of Linux servers is SSH (Secure Shell). While SSH provides a robust and encrypted way for remote logins, it is not immune to attacks. In this article, we will explore best practices for hardening SSH to enhance the security of your Linux servers.

1. Change the Default SSH Port

By default, SSH operates on port 22. Changing this port can reduce the likelihood of automated attacks and can be one of the first lines of defense. Here’s how to do it:

  1. Open the SSH configuration file:
    bash
    sudo nano /etc/ssh/sshd_config

  2. Look for the line that specifies #Port 22 and change it to:
    plaintext
    Port 2222 # Choose a port number between 1024 and 65535

  3. Save the changes and restart the SSH service:
    bash
    sudo systemctl restart sshd

2. Disable Root Login

Allowing direct root login via SSH can be a significant security risk. Instead, create a user with sudo privileges.

  1. Again, open the SSH configuration file:
    bash
    sudo nano /etc/ssh/sshd_config

  2. Find the line:
    plaintext
    PermitRootLogin yes

    Change it to:
    plaintext
    PermitRootLogin no

  3. Save and exit, then restart the SSH service.

3. Use Key-Based Authentication

Password-based authentication can be susceptible to brute-force attacks. Using SSH key pairs adds an additional layer of security.

  1. Generate a key pair on your local machine:
    bash
    ssh-keygen -t rsa -b 4096

  2. Copy the public key to your server:
    bash
    ssh-copy-id username@your_server_ip

  3. Once confirmed, disable password authentication in the SSH configuration:
    plaintext
    PasswordAuthentication no

  4. Restart SSH.

4. Enable Two-Factor Authentication (2FA)

Adding a second layer of authentication can bolster your server’s security. Tools like Google Authenticator can be integrated easily.

  1. Install the required package:
    bash
    sudo apt install libpam-google-authenticator

  2. Run Google Authenticator on your server:
    bash
    google-authenticator

  3. Follow the prompts to set it up.

  4. Modify the PAM configuration:
    bash
    sudo nano /etc/pam.d/sshd

    Add:
    plaintext
    auth required pam_google_authenticator.so

  5. Save and restart SSH.

5. Implement Fail2ban

Fail2ban is an intrusion prevention software framework that protects from brute-force attacks.

  1. Install Fail2ban:
    bash
    sudo apt install fail2ban

  2. Configure it by creating a local configuration file:
    bash
    sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

  3. Edit the configuration file and enable the SSH jail:
    bash
    sudo nano /etc/fail2ban/jail.local

    Find the [sshd] section and make sure it looks like this:
    plaintext
    [sshd]
    enabled = true

  4. Restart Fail2ban:
    bash
    sudo systemctl restart fail2ban

6. Regularly Update Your System

Ensuring your system is always running the latest software is crucial for security. Regularly apply updates by running:

bash
sudo apt update && sudo apt upgrade -y

7. Monitor SSH Logins

Regular monitoring of your SSH login attempts can offer valuable insight into any unauthorized access. Use tools like fail2ban, or scrutinize the logs stored in /var/log/auth.log.

Conclusion

By implementing these best practices, you can significantly bolster the security of your Linux servers against unauthorized access. Each layer added, from changing the default port to employing two-factor authentication, hardens your server and creates a resilient defense against potential threats. Remember, security is not a one-time endeavor; it requires continuous monitoring and improvement.

Staying informed about the latest security trends and threats is essential for any IT professional. With a well-secured SSH configuration, you can rest assured that your Linux servers are better protected against malign actors.

For more tech insights and advanced security practices, stay tuned to the WafaTech Blog!