169 lines
8.9 KiB
HTML
169 lines
8.9 KiB
HTML
<!doctype html>
|
||
<html lang="en">
|
||
|
||
<head>
|
||
<meta charset="UTF-8" />
|
||
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
||
<link href="/css/style.css" rel="stylesheet" />
|
||
<script defer data-domain="cronyakatsuki.xyz" src="https://plausible.cronyakatsuki.xyz/js/script.js"></script>
|
||
|
||
<title>
|
||
|
||
Securing SSH - Crony Akatsuki
|
||
|
||
</title>
|
||
<meta property="og:url" content="https://cronyakatsuki.xyz/blog/securing-ssh/">
|
||
<meta property="og:site_name" content="Crony Akatsuki's Website">
|
||
<meta property="og:title" content="Securing SSH">
|
||
<meta property="og:description" content="As someone who has a couple of servers out in the open web, one of the main things I had to learn was how to secure it so people can’t touch them. One of the main ways to do that is by hardening ssh.
|
||
Here I will name a couple of settings and best practices to make sure your ssh is as secure as possible.">
|
||
<meta property="og:locale" content="en_us">
|
||
<meta property="og:type" content="article">
|
||
<meta property="article:section" content="blog">
|
||
<meta property="article:published_time" content="2024-04-04T20:44:10+02:00">
|
||
<meta property="article:modified_time" content="2024-04-04T20:44:10+02:00">
|
||
|
||
</head>
|
||
|
||
<body>
|
||
<header>
|
||
<h1>Crony Akatsuki</h1>
|
||
<nav>
|
||
<span><a href="/">Home</a></span>
|
||
<span>|</span>
|
||
<span><a href="/about">About</a></span>
|
||
<span>|</span>
|
||
<span><a href="/blog">Blog</a></span>
|
||
<span>|</span>
|
||
<span><a href="/services">Services</a></span>
|
||
</nav>
|
||
</header>
|
||
|
||
|
||
<main>
|
||
<div id="content">
|
||
|
||
<h1>Securing SSH</h1>
|
||
|
||
|
||
|
||
<div id="blog-meta">
|
||
<p id="date">04-04-2024</p>
|
||
|
||
|
||
<hr>
|
||
</div>
|
||
|
||
<p>As someone who has a couple of servers out in the open web, one of the main things I had to learn was how to secure it so people can’t touch them. One of the main ways to do that is by hardening ssh.</p>
|
||
<p>Here I will name a couple of settings and best practices to make sure your ssh is as secure as possible.</p>
|
||
<hr>
|
||
<h2 id="use-key-pairs">Use key pairs</h2>
|
||
<p>One of the main practice to secure ssh is by using public/private ssh key pair and making ssh only allow connection with them, disabling password login.</p>
|
||
<p>First you need to generate a key pair by running the commmand <code>ssh-keygen</code>.</p>
|
||
<p>After generating the key run the command <code>ssh-copy-id ~/.ssh/key_name user@host</code> to copy the key to the server.</p>
|
||
<p>Connecting to the server now it will ask you for the ssh key password if you set one, if you didn’t then it will just directly connect it.</p>
|
||
<p>While you are connected to the server now, I would change next settings to the values I recommend to make sure you can only connect to the server with ssh key pairs already on the server. Make sure to uncomment the values in your config, and change like I did in my examples.</p>
|
||
<blockquote>
|
||
<p>/etc/ssh/sshd_config</p>
|
||
</blockquote>
|
||
<pre tabindex="0"><code class="language-conf" data-lang="conf">PubkeyAuthentication yes
|
||
|
||
PasswordAuthentication no
|
||
PermitEmptyPasswords no
|
||
</code></pre><p>Restart your sshd service, with <code>systemctl restart sshd.service</code>.</p>
|
||
<h2 id="disable-root-user-logins">Disable root user logins</h2>
|
||
<p>Next most common way to secure ssh is by not using a root account to connect, so even if somebody manages to connect they don’t get root user access.</p>
|
||
<p>After creating a new user ( make sure to add it to sudo/wheel group also ), make sure to copy the file located in <code>/root/.ssh/authorized_keys</code> to your new users directory in path <code>/home/user/.ssh/authorized_keys</code></p>
|
||
<p>I would reccommend at this point to try and connecting to the different user on the server to make sure the ssh keys were copied correctly. ( example <code>ssh new-user@host</code> )</p>
|
||
<p>After that, disable root user login and only allow connecting to ssh with the new user.</p>
|
||
<blockquote>
|
||
<p>/etc/ssh/sshd_config</p>
|
||
</blockquote>
|
||
<pre tabindex="0"><code class="language-conf" data-lang="conf">PermitRootLogin no
|
||
AllowUsers new-user
|
||
</code></pre><p>Restart your sshd service.</p>
|
||
<h2 id="only-allow-connection-from-specific-ip">Only allow connection from specific ip</h2>
|
||
<p>Next best way to secure ssh is to only allow connection from specific ip, preferably vpn.</p>
|
||
<p>Main way I do it is using wireguard. I set it up using the landchad <a href="https://landchad.net/wireguard">guide</a>.</p>
|
||
<p>Then in your sshd config you can make it so that ssh will only accept connection to the user with only the specific up using this syntax.</p>
|
||
<pre tabindex="0"><code class="language-conf" data-lang="conf">AllowUsers new-user@172.16.0.2
|
||
</code></pre><p>You can use the ip for the connection you use to setup the peer in the wireguard setup guide, which in landchad’s guide is <code>172.16.0.2</code>. Or from another server by using the ip of the server you connect with wireguard to.</p>
|
||
<p>Make sure to restart sshd and test out in another terminal window whether you can only connect with the wireguard connection to the server ( Don’t close or exit the current ssh connection before making sure it all work’s ).</p>
|
||
<h2 id="general-settings">General settings</h2>
|
||
<p>There are some more settings that can be changed and I will name them now.</p>
|
||
<pre tabindex="0"><code class="language-conf" data-lang="conf"># Port change to allow connection from only that port, to connect use "ssh new-user@host -p port"
|
||
Port 4893
|
||
|
||
# Allow connection only from ipv4
|
||
AddressFamily inet
|
||
|
||
# Limit to only 3 connection tries
|
||
MaxAuthTries 3
|
||
|
||
# Disable pam
|
||
UsePAM no
|
||
|
||
# Disable tcp and x11 forwarding
|
||
AllowTcpForwarding no
|
||
X11Forwarding no
|
||
</code></pre><p>If you by chance need tcp or x11 forwarding, enable it only for your user using this syntax:</p>
|
||
<pre tabindex="0"><code class="language-conf" data-lang="conf">Match User new-user
|
||
AllowTcpForwarding yes
|
||
X11Forwarding yes
|
||
</code></pre><hr>
|
||
<p>With this I have covered the most basic, but at the same best practices to secure your server ssh to not get uninvited people connecting to your servers.</p> </div>
|
||
</main>
|
||
<footer>
|
||
<div id="links">
|
||
<span><a href="https://code.cronyakatsuki.xyz">Code</a></span>
|
||
<span>|</span>
|
||
<span><a href="https://steamcommunity.com/id/CronyAkatsuki/">Steam</a></span>
|
||
<span>|</span>
|
||
<span><a href="https://osu.ppy.sh/users/18953565">Osu!</a></span>
|
||
<span>|</span>
|
||
<span><a href="https://anilist.co/user/CronyAkatsuki/">Anilist</a></span>
|
||
<span>|</span>
|
||
<span><a href="https://trakt.tv/users/cronyakatsuki">Trakt.tv</a></span>
|
||
<span>|</span>
|
||
<span><a href="https://www.last.fm/user/Crony-Akatsuki">Last.fm</a></span>
|
||
<span>|</span>
|
||
<span><a href="https://youtube.com/channel/UClFdlNlUipHG5Kit8GbFz5Q">Gaming Channel</a></span>
|
||
<span>|</span>
|
||
<span><a href="https://uptime.cronyakatsuki.xyz/status/public">Services Status</a></span>
|
||
<span>|</span>
|
||
<span><a href="https://lemmy.cronyakatsuki.xyz/u/crony">Lemmy</a></span>
|
||
<span>|</span>
|
||
<span><a href="https://sharkey.cronyakatsuki.xyz/u/crony">Sharkey</a></span>
|
||
<span>|</span>
|
||
<span><a href="https://plausible.cronyakatsuki.xyz/cronyakatsuki.xyz">Selfhosted Plausible Analytics</a></span>
|
||
</div>
|
||
<div id="banners">
|
||
<a rel="noreferrer" href="/" target="_blank"><img src="/88x31.png"
|
||
alt="Me" title="Me" /></a>
|
||
<a rel="noreferrer" href="https://kernel.org" target="_blank"><img src="https://cyber.dabamos.de/88x31/linux_powered.gif"
|
||
alt="linux kernel" title="Best kernel in the world" /></a>
|
||
<a rel="noreferrer" href="https://debian.org" target="_blank"><img src="https://cyber.dabamos.de/88x31/debian.gif"
|
||
alt="debian" title="This website run's on debian" /></a>
|
||
<a rel="noreferrer" href="https://bitwarden.com" target="_blank"><img src="https://cyber.dabamos.de/88x31/bitwarden.gif"
|
||
alt="Bitwarden" title="Bitwarden/Vaultwarden for the win" /></a>
|
||
<a rel="noreferrer" target="_blank"><img src="https://cyber.dabamos.de/88x31/free.gif"
|
||
alt="foss" title="Foss is the way" /></a>
|
||
<a rel="noreferrer" href="https://neovim.io" target="_blank"><img src="/assets/badges/neovim.gif"
|
||
alt="Neovim" title="Written in neovim" /></a>
|
||
<a rel="noreferrer" href="https://landchad.net" target="_blank"><img src="https://landchad.net/pix/landchad.gif"
|
||
alt="LandChad" title="Get A Website!" /></a>
|
||
<a rel="noreferrer" href="https://poggerer.xyz" target="_blank"><img src="https://poggerer.xyz/88x31.png"
|
||
alt="Tulg" title="Tulg" /></a>
|
||
<a rel="noreferrer" href="https://arthurmelton.com" target="_blank"><img src="https://arthurmelton.com/88x31.png"
|
||
alt="AMTitan" title="AMTitan" /></a>
|
||
<a rel="noreferrer" href="https://aadi.net.in" target="_blank"><img src="https://aadi.net.in/88x31.png"
|
||
alt="Aadi" title="Aadi" /></a>
|
||
<a rel="noreferrer" href="https://bear.oops.wtf/" target="_blank"><img src="https://bear.oops.wtf/download/88x31.png"
|
||
alt="Bear" title="Bear" /></a>
|
||
</div>
|
||
</footer>
|
||
|
||
</body>
|
||
|
||
</html>
|