Securing an SSH connection on your Linux server is crucial to safeguarding your system from unauthorized access and potential threats. SSH, or Secure Shell, is widely used for remote administration, but it can be a target for malicious attacks if not properly secured. This guide outlines the best practices for enhancing SSH security on your Linux server.

TL;DR

• Change the Default SSH Port: Switch from port 22 to a non-standard port to reduce automated attacks.
• Use Strong Passwords: Enforce password policies to protect against brute-force attacks.
• Disable Root Login: Prevent direct root access to increase security.
• Use SSH Key-Based Authentication: Switch to key-based authentication for better security.
• Disable Password Authentication: After setting up key-based authentication, turn off password logins.
• Limit User Logins: Restrict SSH access to specific users or groups.
• Use a Firewall: Only allow SSH connections from specific IP addresses.
• Install and Configure Fail2Ban: Protect against brute-force attacks by banning suspicious IPs.
• Enable Two-Factor Authentication (2FA): Add an extra layer of security with 2FA.
• Monitor SSH Logs: Regularly check logs to detect and respond to suspicious activities.

1. Change the Default SSH Port

One of the simplest yet effective ways to reduce the risk of automated attacks is by changing the default SSH port from 22 to a non-standard port.

Steps to Change the SSH Port:

1. Open the SSH configuration file:

sudo nano /etc/ssh/sshd_config

2. Find the line:

#Port 22

3. Uncomment the line and change the port number, for example, to 2222:

Port 2222

4. Restart the SSH service to apply the changes:

sudo systemctl restart sshd

2. Use Strong Password Authentication

To protect against brute-force attacks, ensure that all users have strong, complex passwords.

Steps to Enforce Strong Password Policies:

1. Open the password quality configuration file:

sudo nano /etc/security/pwquality.conf

2. Set password policies by adding or updating the following lines:

    minlen = 12
    dcredit = -1
    ucredit = -1
    ocredit = -1
    lcredit = -1
        

These settings enforce a minimum password length of 12 characters and require at least one digit, one uppercase letter, one lowercase letter, and one special character.

3. Disable Root Login

Disabling root login prevents attackers from directly accessing the root account, adding an extra layer of security.

Steps to Disable Root Login:

1. Edit the SSH configuration file:

sudo nano /etc/ssh/sshd_config

2. Find the line:

PermitRootLogin yes

3. Change it to:

PermitRootLogin no

4. Restart the SSH service:

sudo systemctl restart sshd

4. Use SSH Key-Based Authentication

Key-based authentication is more secure than password-based authentication, as it requires an SSH key pair instead of a password.

Steps to Set Up SSH Key-Based Authentication:

1. Generate a key pair on your client machine:

ssh-keygen -t rsa -b 4096

2. Copy the public key to your server:

ssh-copy-id user@server_ip

3. Ensure the correct permissions on the server:

    chmod 600 ~/.ssh/authorized_keys
    chmod 700 ~/.ssh
        

5. Disable Password Authentication

Once key-based authentication is set up, disable password authentication to further secure your SSH connection.

Steps to Disable Password Authentication:

1. Edit the SSH configuration file:

sudo nano /etc/ssh/sshd_config

2. Find the line:

#PasswordAuthentication yes

3. Uncomment it and change yes to no:

PasswordAuthentication no

4. Restart the SSH service:

sudo systemctl restart sshd

6. Limit User Logins

Restrict SSH access to specific users or groups to minimize the risk of unauthorized access.

Steps to Limit SSH User Logins:

1. Edit the SSH configuration file:

sudo nano /etc/ssh/sshd_config

2. To allow specific users:

AllowUsers user1 user2

3. Or, to allow specific groups:

AllowGroups sshusers

4. Restart the SSH service:

sudo systemctl restart sshd

7. Use a Firewall

A firewall can be configured to allow only specific IP addresses to connect to your SSH port, further securing your connection.

Steps to Configure a Firewall for SSH:

1. For ufw (Uncomplicated Firewall):

sudo ufw allow 2222/tcp

sudo ufw enable

2. For iptables:

sudo iptables -A INPUT -p tcp --dport 2222 -j ACCEPT

8. Install and Configure Fail2Ban

Fail2Ban is a tool that helps protect against brute-force attacks by banning IP addresses that exhibit suspicious behavior.

Steps to Install and Configure Fail2Ban:

1. Install Fail2Ban:

sudo apt-get install fail2ban

2. Copy the default configuration file:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

3. Edit the Fail2Ban configuration:

sudo nano /etc/fail2ban/jail.local

4. Ensure the [sshd] section is enabled:

[sshd]
enabled = true
port = 2222
        

5. Restart Fail2Ban:

sudo systemctl restart fail2ban

9. Enable Two-Factor Authentication (2FA)

Adding 2FA provides an additional layer of security, requiring a one-time code in addition to the SSH key.

Steps to Enable 2FA for SSH:

1. Install Google Authenticator:

sudo apt-get install libpam-google-authenticator

2. Run the Google Authenticator setup:

google-authenticator

3. Configure PAM (Pluggable Authentication Module) to require 2FA:

sudo nano /etc/pam.d/sshd

4. Add this line:

auth required pam_google_authenticator.so

5. Enable challenge-response authentication:

sudo nano /etc/ssh/sshd_config

6. Change the line:

ChallengeResponseAuthentication yes

7. Restart the SSH service:

sudo systemctl restart sshd

10. Monitor SSH Logs

Regularly monitoring your SSH logs helps you detect and respond to any suspicious activities.

Steps to Monitor SSH Logs:

1. View SSH logs in real-time:

sudo tail -f /var/log/auth.log

Conclusion

Securing SSH on your Linux server is critical to protecting your system from unauthorized access. By implementing these best practices, including changing the default SSH port, using strong passwords, and enabling key-based authentication, you can significantly enhance your server’s security.