​

SSH Security Hardening Guide

​

Strengthening SSH Security

Secure Shell (SSH) is a fundamental tool for server management, providing encrypted communication for remote access. However, it’s also a common target for cyberattacks. Implementing basic SSH security measures is essential to protect your server from unauthorized access and brute-force attacks.

This guide begins with foundational security practices and progresses to advanced techniques for a comprehensive approach to hardening your SSH setup. Whether you’re a beginner or an experienced administrator, this guide will help you secure your server effectively.

​

Basic SSH Security Measures

For those just starting, here are a few simple yet crucial steps to secure your SSH connection:

Change the Default SSH Port:

• By default, SSH listens on port 22, a known target for attackers. Changing it to a non-standard port reduces the likelihood of brute-force attacks. Disable Root Login:

• Direct root access is a significant risk. Use a regular user account with sudoprivileges instead. Enable SSH Key Authentication:

• Replace password-based logins with SSH keys for enhanced security. This method ensures only users with the private key can access the server. Limit Failed Login Attempts:

• Install tools like Fail2Ban to block IP addresses after a set number of unsuccessful login attempts. Keep Your System Updated:

• Regularly update your server and SSH software to patch vulnerabilities and improve overall security.

By starting with these basic practices, you’ll lay a strong foundation for SSH security. The following sections will build on these principles with advanced strategies to further harden your server against sophisticated threats.

​

1. Change the Default SSH Port

The default SSH port (port 22) is one of the primary targets for brute-force attacks. Changing the port can be the first step to improving security.

Steps:

Edit the SSH configuration file:

sudo nano /etc/ssh/sshd_config

Find the line Port 22 and change it to a different port (e.g., 2222):

Port 2222

Restart SSH to apply the changes:

sudo systemctl restart sshd

Before disconnecting, check if the new port is open:

sudo ufw allow 2222/tcp
sudo ufw enable

​

2. Use SSH Key Authentication Instead of Passwords

SSH key authentication is much more secure than using passwords, as it prevents brute-force attacks.

Steps:

Generate an SSH key pair (if you don’t already have one):

ssh-keygen -t rsa -b 4096

Copy the public key to the server:

ssh-copy-id user@your_server_ip

Disable password authentication in the SSH config file:

sudo nano /etc/ssh/sshd_config

Set the following:

PasswordAuthentication no

Restart SSH:

sudo systemctl restart sshd

​

3. Install and Configure Fail2Ban to Prevent Brute Force Attacks

Fail2Ban is a tool that detects brute-force attacks and blocks suspicious IP addresses.

Steps:

Install Fail2Ban:

sudo apt-get install fail2ban

Configure Fail2Ban for SSH:

• Edit the jail.local file:

sudo nano /etc/fail2ban/jail.local

• Add or edit the [sshd] section as follows:

[sshd]
enabled = true
port = 2222
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 600

• Set the correct port for SSH (e.g., 2222).

Restart Fail2Ban:

sudo systemctl restart fail2ban

Check Fail2Ban status:

sudo fail2ban-client status sshd

​

4. Disable Root Login via SSH

Allowing root login via SSH is a security risk. It’s better to disable root login and use a regular user account with sudo privileges.

Steps:

Edit the SSH config file:

sudo nano /etc/ssh/sshd_config

Find the PermitRootLogin line and set it to no:

PermitRootLogin no

Restart SSH:

sudo systemctl restart sshd

​

5. Enable Two-Factor Authentication (2FA) for SSH

Adding two-factor authentication (2FA) to SSH adds an extra layer of security. Even if an attacker guesses your password, they will need an additional code to log in.

Steps:

Install pam_google_authenticator:

sudo apt-get install libpam-google-authenticator

Run google-authenticator for each user:

google-authenticator

Edit the PAM configuration file for SSH:

sudo nano /etc/pam.d/sshd

Add the following line at the end:

auth required pam_google_authenticator.so

Then, edit the SSH config file to enable 2FA:

sudo nano /etc/ssh/sshd_config

Set the following:

ChallengeResponseAuthentication yes

Restart SSH:

sudo systemctl restart sshd

​

6. Restrict SSH Access to Specific IP Addresses

Limiting SSH access to specific IP addresses greatly improves security.

Steps:

Use iptables to allow SSH access only from a specific IP address:

sudo iptables -A INPUT -p tcp -s YOUR_TRUSTED_IP --dport 2222 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 2222 -j DROP

To make iptables rules persistent:

sudo apt-get install iptables-persistent

​

7. Monitor SSH Logs and Status

Regularly checking SSH logs and monitoring the status can help you detect any suspicious activity.

Steps:

Check SSH logs:

sudo tail -f /var/log/auth.log

Use logwatch for enhanced monitoring:

sudo apt-get install logwatch
sudo logwatch --detail High --service sshd --range today

​

8. Use Security Tools to Scan for Threats

Tools like Lynis and RKHunter can help detect security vulnerabilities and threats.

Steps:

Install Lynis:

sudo apt-get install lynis
sudo lynis audit system

Install RKHunter:

sudo apt-get install rkhunter
sudo rkhunter --check

​

9. Limit SSH Authentication Retries

Limiting the number of failed SSH login attempts can prevent brute-force attacks.

Steps:

Edit the sshd_config file:

sudo nano /etc/ssh/sshd_config

Set the following:

MaxAuthTries 3

Restart SSH:

sudo systemctl restart sshd

​

10. Use SSH Key Agent

To avoid repeatedly entering passwords or SSH keys when connecting, you can use SSH Key Agent, which automatically loads your SSH keys.

Steps:

Add your SSH keys to the agent:

eval $(ssh-agent)
ssh-add ~/.ssh/id_rsa

By following these steps, you can significantly improve the security of your SSH connections and protect your server from unauthorized access.