How to harden an SSH server?

Question

What measures can/should I take to make sure that security around my SSH server is absolutely impermeable?

This will be community wiki from the start, so lets see what people does to secure their servers.

Answer 1

Use public/private key pairs for authentication instead of passwords.

1. Generate a passphrase-protected SSH key for every computer that needs to access the server:

   ssh-keygen

2. Permit public-key SSH access from the allowed computers:

   Copy the contents of ~/.ssh/id_rsa.pub from each computer into individual lines of ~/.ssh/authorized_keys on the server, or run ssh-copy-id [server IP address] on every computer to which you are granting access (you'll have to enter the server password at the prompt.)

3. Disable password SSH access:

   Open /etc/ssh/sshd_config, find the line that says #PasswordAuthentication yes, and change it to PasswordAuthentication no. Restart the SSH server daemon to apply the change (sudo service ssh restart.)

Now, the only possible way to SSH into the server is to use a key that matches a line in ~/.ssh/authorized_keys. Using this method, I don't care about brute force attacks because even if they guess my password, it will be rejected. Brute-forcing a public/private key pair is impossible with today's technology.

Answer 2

I would suggest using fail2ban to prevent brute force login attempts.

Disabling logging in as root via SSH. This means an attacker had to figure out both the username and the password making an attack more difficult.

Add PermitRootLogin no to your /etc/ssh/sshd_config

Limiting the users that can SSH to the server. Either by group or just specific users.

Add AllowGroups group1 group2 or AllowUsers user1 user2 to limit who can SSH to the server.

Answer 3

Make the sshd block client IP's that have failed to supply correct login information "DenyHØsts" can do this job quite effectively. I have this installed on all my Linux boxes that are in some way reachable from the great outside.

This will make sure that brute force-attacks on the sshd wont be effective, but remember! this way you can end up locking your self out if you forget you password. This can be a problem on a remote server that you don't have access to.

Answer 4

Other answers provide security, but there is one thing you can do which will make your logs quieter, and make it less likely that you'll be locked out of your account: Move the server port from 22 to another port. Either at your gateway, or on the server.

It doesn't increase the security, but does mean all the random internet scanners won't clutter up you log files.

Answer 5

Here's one easy thing to do: install ufw (the "uncomplicated firewall") and use it to rate limit incoming connections.

From a command prompt, type:

$ sudo ufw limit OpenSSH 

If ufw is not installed, do this and try again:

$ sudo aptitude install ufw 

Many attackers will try to use your SSH server to brute-force passwords. This will only allow 6 connections every 30 seconds from the same IP address.

Answer 6

There is a Debian Administration article on this topic. It covers basic SSH server configuration and also firewall rules. This could be of interest also to hardened an SSH server.

See there article: Keeping SSH access secure.

Answer 7

If I want to have some additional security or need to access SSH servers deep inside some corporate network I setup a hidden service by using the anonymisation software Tor.

1. Install Tor and setup the SSH server itself.
2. Make sure sshd only listens at localhost.
3. Open /etc/tor/torrc. Set HiddenServiceDir /var/lib/tor/ssh and HiddenServicePort 22 127.0.0.1:22.
4. Look at var/lib/tor/ssh/hostname. There is a name like d6frsudqtx123vxf.onion. This is the address of the hidden service.

5. Open $HOME/.ssh/config and add some lines:

   Host myhost
   HostName d6frsudqtx123vxf.onion
   ProxyCommand socat STDIO SOCKS4A:127.0.0.1:%h:%p,socksport=9050

Furthermore I need Tor on my local host. If it is installed I can enter ssh myhost and SSH opens a connection via Tor. The SSH server on the other side opens its port only on localhost. So nobody can connect it via "normal internet".