Skip to content

Latest commit

 

History

History
134 lines (84 loc) · 4.12 KB

2.ssh_configuration.md

File metadata and controls

134 lines (84 loc) · 4.12 KB
Raw

2. SSH and OS configuration

SSH is nothing else than a software, it has options and configuration files.

The default options are simple, but may not be the most secure options, let's see what we can improve.

2.1 OS configuration

As you saw, when we connect to the server, the default user is root.

It has multiple problems:

  • root is a super-user user with access to all the files
  • we never want to use it as it is easy to mess things up
  • if someone malicious has a access to the user, he could do litteraly anything to the server

2.1.1 Create a new user

The first step towards adding more layers of security is to create a custom user.

adduser <new-user>

🃏 Hints

  • a not-so-common username is recommended so it significantly harden the chance for an attacker to find it

2.1.2 Adding a user to the sudo group

Your new user is created, but we sometimes still need to run commands with sudo. For that, we need to add this new user to the sudo group.

usermod -aG sudo <new-user>

2.1.3 Testing that everything works properly

Let's connect to the newly created user:

su - <new-user>

Test that you are part of sudo:

sudo whoami
# or sudo apt update

Alternatively, you could log out (ctrl-D), and use:

ssh <new-user>@<host>

2.1.4 Add an SSH key for this user

Don't forget to add your SSH key to this user (cf SSH Connection).

ssh-copy-id -i <path-of-the-ssh-key> <new-user>@<host>

2.2 SSH configuration

2.2.1 Disable root login

Remember we used to connect via SSH to the server with the root user? Let's imagine someone manages to get the password for this user, this someone could do anything to your server: install new packages, remove or steal files, etc.

We want to confine users to the minimum amount of rights possible for better security in case of something going wrong.

SSH gives us options to secure our servers and prevent this kind of nasty things to happen. To open the configuration file of SSH, you can use the following command

sudo nano /etc/ssh/sshd_config

ℹ️ information

  • sudo is a command to execute a program with super-user rights. It is required to edit, execute, and sometimes just access some files in some directories of your server.
  • nano is a minimalistic text editor
  • in the file, set PermitRootLogin to no, save and exit (ctrl+x).
  • restart the ssh daemon: systemctl restart ssh If you log out (ctrl+d), you should not able to ssh root@<host> anymore.

⚠️ warning

  • it can be extremely easy to lock yourself out of your server with SSH configuration, be careful (e.g, if you disable root login without setting up another user)

2.2.2 Disable password authentication

As saw earlier, password authentication, is rather a bad idea for critical services. We should also disable logins with passwords.

In the same file, you can set PasswordAuthentication to no.

2.2.3 Other useful settings

# Allow SSH key connection (default is yes)
PubkeyAuthentication yes

# disable password for "root", but allow SSH keys (not adviced)
PermitRootLogin prohibit-password

# Disable login for users with empty passwords
PermitEmptyPasswords no

# Force permissions checks on keyfiles and directories
StrictModes yes

📖 Resources

2.3 [bonus] SSH with a UI

Sometimes, it can be convenient for beginners to use a GUI rather than a terminal to access files on a server.

You can use Filezilla to connect to any server supporting SSH to navigate server files and directories.

2.4 [bonus] fail2ban

It can be useful to ban IPs failing to connect to your server after several wrong attempts (bots try a lot to connect to root or admin with common/unsecure passwords).

fail2ban does exactly this.

We now have a secure way to connect to a server, but a couple of things may still be insecure, let's see how we can configure a firewall on a server with Uncomplicated Firewall: UFW.