SSH Security: Protecting Your Linux Server from Threats

blog articles
1
Read the full article: SSH Security: Protecting Your Linux Server from Threats

SSH (Secure Shell) is our best friend when it comes to remote command line access to our servers. SSH (Secure Shell) is an essential tool for remote command-line access to servers. But to truly secure SSH you need to limit access to specific IP’s and follow a few other best practices. Leaving SSH open to… continue reading.
2 Likes
2

Great article, thanks! I would also add “port knocking” way here.

2 Likes
3

Thanks again, @vintka, for the great suggestion! Welcome to the forums :handshake:

Let me add that info here in the article discussion as it is indeed via your suggestion.

Port knocking is a security technique used to protect servers from unauthorized access. It involves opening ports on demand by “knocking” on a predefined sequence of ports in a specific order.

Here’s how to set up port knocking on Ubuntu:

  1. Install the Knockd daemon:
    sudo apt update && sudo apt install knockd

  2. Configure Knockd: Edit the Knockd configuration file:
    sudo vi /etc/knockd.conf

Define the port sequences and commands to execute. For example:

[options]
UseSyslog

[openSSH]
sequence    = 1000,2000,3000
seq_timeout = 5
command     = /sbin/iptables -A INPUT -s %IP% -p tcp --dport xxxx -j ACCEPT
tcpflags    = syn

[closeSSH]
sequence    = 3000,2000,1000
seq_timeout = 5
command     = /sbin/iptables -D INPUT -s %IP% -p tcp --dport xxxx -j ACCEPT
tcpflags    = syn

In this example:

  • openSSH: Opens the SSH port (replace xxxx with your SSH port) when the sequence 1000,2000,3000 is knocked.
  • closeSSH: Closes the SSH port when the reverse sequence 3000,2000,1000 is knocked.
  1. Start the Knockd daemon:
    sudo systemctl enable knockd sudo systemctl start knockd

That’s it! Be sure to test your configuration thoroughly before deploying it in a production environment.

1 Like
4

One of best ideas instead blacklisting or whitelisting some users or ip address is using a strong password for your user profile so it’s difficult to crack it and connect trough SSH.

1 Like
5

Yes. Only if using keys isn’t an option. But even then, with strong passwords those attempting brute force should be blocked. I like using the honeypot project and also blocks by country using MaxMind.

1 Like
6

Bookmarked! Great article, well explained

7

One think I have tried is to test the ssh config using an external tool and in some cases it has shared that there are crypto algorithms that are not advised still in place …

SSH Configuration Auditor

I found it useful - I didn’t test on a production server, just a crash and burn box and then took the learnings to other more sensitive set ups … YMMV

Reviewing your logs is the most important thing - it is an eye opener and makes you realise why all the other changes are v important

1 Like
8

Yes but, in a LAN ecosystem there never should be a brute force attack, I think it’s not a good practice open port 22 to internet.
If you want to connect in ssh to your lab terminal I think it’s better install a VPN and then access trough LAN.
Am I right? What am I missing?