Can you offer some tips for setting up an SSH service so I can get secure, remote access to my server?
It would help to know on what platform you'd like to set up SSH on, but I can provide some general tips.
- Use only SSH V2 -- V1 is vulnerable to compromise. On Linux, this is usually done by default and managed in your /etc/ssh/sshd_config file by the Protocols option.
- Don't allow root or Administrators to log in directly. Only normal users should be allowed to log in and then if required they can escalate their privileges by using su or sudo. On Linux this is controlled, again in the sshd_config file, by the PermitRootLogin option.
- Ensure you use suitable authentication, for example passwords or keys.
- Try to avoid using port 22 for your SSH connections. Automated brute force attack tools are commonly used by attackers to scan port 22 and try to brute usernames and passwords. Changing the port to something else, for example 2222, is a quick and simple way of reducing this risk. Alternatively, if you must use port 22, you can use tools like BlockSSHD (Note: I am the author of this tool) or Fail2Ban to block excessive or inappropriate login attempts.
- Ensure you have configured suitable logging of your SSH daemon and that you review your logs for illicit login attempts. Ttools like Swatch and SEC can assist with this.
- Only bind SSH to the addresses required. If you have multiple interfaces in your host, for example an interface on your internal network and another on an external network such as the Internet, then only bind the daemon to the interface through which you need to connect. This is controlled on Linux using the ListenAddress option.
I hope that helps.
Dig Deeper on Linux servers
Related Q&A from James Turnbull
A user wants to implement OSSEC on a Windows server because he has no server side Linux operating system. Continue Reading
Solaris 10 Trusted Extensions and SELinux are best suited to different system requirements and administrator skill sets. Our security expert explains... Continue Reading
Configuring spam filters Spamassassin and dspam together in the email server Postfix is easy with the resources listed by our security expert. Continue Reading