crony/cronyakatsuki.xyz
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Site update

Browse Source
This commit is contained in:
CronyAkatsuki 2024-04-04 21:35:06 +02:00
parent 0b4d2c5ac2
commit 8b550c4f94
4 changed files with 18 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
content/blog/securing-ssh.md
View File

@ -1,5 +1,5 @@
+++ +++
title = 'Securing Ssh' title = 'Securing SSH'
date = 2024-04-04T20:44:10+02:00 date = 2024-04-04T20:44:10+02:00
draft = false draft = false
+++ +++
@ -17,11 +17,11 @@ One of the main practice to secure ssh is by using public/private ssh key pair a
First you need to generate a key pair by running the commmand `ssh-keygen`. First you need to generate a key pair by running the commmand `ssh-keygen`.
After generating the key and the command `ssh-copy-id ~/.ssh/key_name user@host` to copy the key to the server. After generating the key run the command `ssh-copy-id ~/.ssh/key_name user@host` to copy the key to the server.
Connection to the server now it will ask you for the ssh key password if you set one, if you didn't then it will just directly connect it. Connecting to the server now it will ask you for the ssh key password if you set one, if you didn't then it will just directly connect it.
While you are connected to the server now, I would recommend you to change next settings to the values I recommend to make sure you can only connect to the server with ssh key pairs already on the server. Make sure to uncommmend the values in your config, and change like I did in my examples. While you are connected to the server now, I would change next settings to the values I recommend to make sure you can only connect to the server with ssh key pairs already on the server. Make sure to uncomment the values in your config, and change like I did in my examples.
> /etc/ssh/sshd_config > /etc/ssh/sshd_config
```conf ```conf
@ -57,7 +57,7 @@ Next best way to secure ssh is to only allow connection from specific ip, prefer
Main way I do it is using wireguard. I set it up using the landchad [guide](https://landchad.net/wireguard). Main way I do it is using wireguard. I set it up using the landchad [guide](https://landchad.net/wireguard).
Then in your sshd config you can make it so that ssh will only accept connection to the user with only the current using syntax. Then in your sshd config you can make it so that ssh will only accept connection to the user with only the specific up using this syntax.
```conf ```conf
AllowUsers new-user@172.16.0.2 AllowUsers new-user@172.16.0.2

2
public/blog/index.html
View File

@ -45,7 +45,7 @@
<section class="list"> <section class="list">
<a href="/blog/securing-ssh/"> <a href="/blog/securing-ssh/">
04-04-2024 || Securing Ssh</a><br /> 04-04-2024 || Securing SSH</a><br />
<a href="/blog/setup-traefik/"> <a href="/blog/setup-traefik/">
19-01-2024 || Setup Traefik</a><br /> 19-01-2024 || Setup Traefik</a><br />

10
public/blog/index.xml
View File

@ -12,7 +12,7 @@
<item> <item>
<title>Securing Ssh</title> <title>Securing SSH</title>
<link>https://cronyakatsuki.xyz/blog/securing-ssh/</link> <link>https://cronyakatsuki.xyz/blog/securing-ssh/</link>
<pubDate>04-04-2024</pubDate> <pubDate>04-04-2024</pubDate>
@ -23,9 +23,9 @@
&lt;h2 id=&#34;use-key-pairs&#34;&gt;Use key pairs&lt;/h2&gt; &lt;h2 id=&#34;use-key-pairs&#34;&gt;Use key pairs&lt;/h2&gt;
&lt;p&gt;One of the main practice to secure ssh is by using public/private ssh key pair and making ssh only allow connection with them, disabling password login.&lt;/p&gt; &lt;p&gt;One of the main practice to secure ssh is by using public/private ssh key pair and making ssh only allow connection with them, disabling password login.&lt;/p&gt;
&lt;p&gt;First you need to generate a key pair by running the commmand &lt;code&gt;ssh-keygen&lt;/code&gt;.&lt;/p&gt; &lt;p&gt;First you need to generate a key pair by running the commmand &lt;code&gt;ssh-keygen&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;After generating the key and the command &lt;code&gt;ssh-copy-id ~/.ssh/key_name user@host&lt;/code&gt; to copy the key to the server.&lt;/p&gt; &lt;p&gt;After generating the key run the command &lt;code&gt;ssh-copy-id ~/.ssh/key_name user@host&lt;/code&gt; to copy the key to the server.&lt;/p&gt;
&lt;p&gt;Connection to the server now it will ask you for the ssh key password if you set one, if you didn&amp;rsquo;t then it will just directly connect it.&lt;/p&gt; &lt;p&gt;Connecting to the server now it will ask you for the ssh key password if you set one, if you didn&amp;rsquo;t then it will just directly connect it.&lt;/p&gt;
&lt;p&gt;While you are connected to the server now, I would recommend you to change next settings to the values I recommend to make sure you can only connect to the server with ssh key pairs already on the server. Make sure to uncommmend the values in your config, and change like I did in my examples.&lt;/p&gt; &lt;p&gt;While you are connected to the server now, I would change next settings to the values I recommend to make sure you can only connect to the server with ssh key pairs already on the server. Make sure to uncomment the values in your config, and change like I did in my examples.&lt;/p&gt;
&lt;blockquote&gt; &lt;blockquote&gt;
&lt;p&gt;/etc/ssh/sshd_config&lt;/p&gt; &lt;p&gt;/etc/ssh/sshd_config&lt;/p&gt;
&lt;/blockquote&gt; &lt;/blockquote&gt;
@ -48,7 +48,7 @@ AllowUsers new-user
&lt;h2 id=&#34;only-allow-connection-from-specific-ip&#34;&gt;Only allow connection from specific ip&lt;/h2&gt; &lt;h2 id=&#34;only-allow-connection-from-specific-ip&#34;&gt;Only allow connection from specific ip&lt;/h2&gt;
&lt;p&gt;Next best way to secure ssh is to only allow connection from specific ip, preferably vpn.&lt;/p&gt; &lt;p&gt;Next best way to secure ssh is to only allow connection from specific ip, preferably vpn.&lt;/p&gt;
&lt;p&gt;Main way I do it is using wireguard. I set it up using the landchad &lt;a href=&#34;https://landchad.net/wireguard&#34;&gt;guide&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;Main way I do it is using wireguard. I set it up using the landchad &lt;a href=&#34;https://landchad.net/wireguard&#34;&gt;guide&lt;/a&gt;.&lt;/p&gt;
&lt;p&gt;Then in your sshd config you can make it so that ssh will only accept connection to the user with only the current using syntax.&lt;/p&gt; &lt;p&gt;Then in your sshd config you can make it so that ssh will only accept connection to the user with only the specific up using this syntax.&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code class=&#34;language-conf&#34; data-lang=&#34;conf&#34;&gt;AllowUsers new-user@172.16.0.2 &lt;pre tabindex=&#34;0&#34;&gt;&lt;code class=&#34;language-conf&#34; data-lang=&#34;conf&#34;&gt;AllowUsers new-user@172.16.0.2
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;You can use the ip for the connection you use to setup the peer in the wireguard setup guide, which in landchad&amp;rsquo;s guide is &lt;code&gt;172.16.0.2&lt;/code&gt;. Or from another server by using the ip of the server you connect with wireguard to.&lt;/p&gt; &lt;/code&gt;&lt;/pre&gt;&lt;p&gt;You can use the ip for the connection you use to setup the peer in the wireguard setup guide, which in landchad&amp;rsquo;s guide is &lt;code&gt;172.16.0.2&lt;/code&gt;. Or from another server by using the ip of the server you connect with wireguard to.&lt;/p&gt;
&lt;p&gt;Make sure to restart sshd and test out in another terminal window whether you can only connect with the wireguard connection to the server ( Don&amp;rsquo;t close or exit the current ssh connection before making sure it all work&amp;rsquo;s ).&lt;/p&gt; &lt;p&gt;Make sure to restart sshd and test out in another terminal window whether you can only connect with the wireguard connection to the server ( Don&amp;rsquo;t close or exit the current ssh connection before making sure it all work&amp;rsquo;s ).&lt;/p&gt;

14
public/blog/securing-ssh/index.html
View File

@ -9,10 +9,10 @@
<title> <title>
Securing Ssh - Crony Akatsuki Securing SSH - Crony Akatsuki
</title> </title>
<meta property="og:title" content="Securing Ssh" /> <meta property="og:title" content="Securing SSH" />
<meta property="og:description" content="As someone who has a couple of servers out in the open web, one of the main things I had to learn was how to secure it so people can&rsquo;t touch them. One of the main ways to do that is by hardening ssh. <meta property="og:description" content="As someone who has a couple of servers out in the open web, one of the main things I had to learn was how to secure it so people can&rsquo;t touch them. One of the main ways to do that is by hardening ssh.
Here I will name a couple of settings and best practices to make sure your ssh is as secure as possible." /> Here I will name a couple of settings and best practices to make sure your ssh is as secure as possible." />
<meta property="og:type" content="article" /> <meta property="og:type" content="article" />
@ -40,7 +40,7 @@ Here I will name a couple of settings and best practices to make sure your ssh i
<main> <main>
<div id="content"> <div id="content">
<h1>Securing Ssh</h1> <h1>Securing SSH</h1>
@ -57,9 +57,9 @@ Here I will name a couple of settings and best practices to make sure your ssh i
<h2 id="use-key-pairs">Use key pairs</h2> <h2 id="use-key-pairs">Use key pairs</h2>
<p>One of the main practice to secure ssh is by using public/private ssh key pair and making ssh only allow connection with them, disabling password login.</p> <p>One of the main practice to secure ssh is by using public/private ssh key pair and making ssh only allow connection with them, disabling password login.</p>
<p>First you need to generate a key pair by running the commmand <code>ssh-keygen</code>.</p> <p>First you need to generate a key pair by running the commmand <code>ssh-keygen</code>.</p>
<p>After generating the key and the command <code>ssh-copy-id ~/.ssh/key_name user@host</code> to copy the key to the server.</p> <p>After generating the key run the command <code>ssh-copy-id ~/.ssh/key_name user@host</code> to copy the key to the server.</p>
<p>Connection to the server now it will ask you for the ssh key password if you set one, if you didn&rsquo;t then it will just directly connect it.</p> <p>Connecting to the server now it will ask you for the ssh key password if you set one, if you didn&rsquo;t then it will just directly connect it.</p>
<p>While you are connected to the server now, I would recommend you to change next settings to the values I recommend to make sure you can only connect to the server with ssh key pairs already on the server. Make sure to uncommmend the values in your config, and change like I did in my examples.</p> <p>While you are connected to the server now, I would change next settings to the values I recommend to make sure you can only connect to the server with ssh key pairs already on the server. Make sure to uncomment the values in your config, and change like I did in my examples.</p>
<blockquote> <blockquote>
<p>/etc/ssh/sshd_config</p> <p>/etc/ssh/sshd_config</p>
</blockquote> </blockquote>
@ -82,7 +82,7 @@ AllowUsers new-user
<h2 id="only-allow-connection-from-specific-ip">Only allow connection from specific ip</h2> <h2 id="only-allow-connection-from-specific-ip">Only allow connection from specific ip</h2>
<p>Next best way to secure ssh is to only allow connection from specific ip, preferably vpn.</p> <p>Next best way to secure ssh is to only allow connection from specific ip, preferably vpn.</p>
<p>Main way I do it is using wireguard. I set it up using the landchad <a href="https://landchad.net/wireguard">guide</a>.</p> <p>Main way I do it is using wireguard. I set it up using the landchad <a href="https://landchad.net/wireguard">guide</a>.</p>
<p>Then in your sshd config you can make it so that ssh will only accept connection to the user with only the current using syntax.</p> <p>Then in your sshd config you can make it so that ssh will only accept connection to the user with only the specific up using this syntax.</p>
<pre tabindex="0"><code class="language-conf" data-lang="conf">AllowUsers new-user@172.16.0.2 <pre tabindex="0"><code class="language-conf" data-lang="conf">AllowUsers new-user@172.16.0.2
</code></pre><p>You can use the ip for the connection you use to setup the peer in the wireguard setup guide, which in landchad&rsquo;s guide is <code>172.16.0.2</code>. Or from another server by using the ip of the server you connect with wireguard to.</p> </code></pre><p>You can use the ip for the connection you use to setup the peer in the wireguard setup guide, which in landchad&rsquo;s guide is <code>172.16.0.2</code>. Or from another server by using the ip of the server you connect with wireguard to.</p>
<p>Make sure to restart sshd and test out in another terminal window whether you can only connect with the wireguard connection to the server ( Don&rsquo;t close or exit the current ssh connection before making sure it all work&rsquo;s ).</p> <p>Make sure to restart sshd and test out in another terminal window whether you can only connect with the wireguard connection to the server ( Don&rsquo;t close or exit the current ssh connection before making sure it all work&rsquo;s ).</p>