Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Ubuntu 10.04 proxy server exposed to the internet and I have SSH Server on it to manage it from internal LAN and from remote. It feels simply unsafe, even if I'm using strong passwords... I thought about disabling ssh on the internet side but then I'd lose functionality. Is there any workaround? I look for a very very short list of "must do" to improve security.

share|improve this question

6 Answers 6

up vote 5 down vote accepted

I'd like to add only one thing to all those answers:

Fail2ban

Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

Here is a (broken) rrd graph from the active bans on my server :

bans graphed by munin

Graphed by munin with the fail2ban plugin.

share|improve this answer
    
That's simply wow –  Pitto May 27 '11 at 12:09
    
There is also denyhosts: denyhosts.sourceforge.net "DenyHosts is a script intended to be run by Linux system administrators to help thwart SSH server attacks (also known as dictionary based attacks and brute force attacks)." –  HTTP500 Jun 13 '11 at 21:45
    
How've you got RRDtool graphing it? I've had a google but I think my google-foo must be low at the moment as I couldn't find anything. –  Phil Jun 13 '11 at 23:08
    
this one was made using munin. exchange.munin-monitoring.org/plugins/fail2ban/details. –  petrus Jun 14 '11 at 7:30
    
thanks, will have an investigate. –  Phil Jun 14 '11 at 19:51

As addition to the answers above you can do the following to secure your ssh access even more:

Change the default SSH Port

Usually bots are trying to access the default port 22/tcp and try to login with different usernames (root, admin, etc). This attacks are usually no issue if you're using strong passwords, or better keys, and do not permit root logins.

The annoying this is that the unsuccessfull login attempts are spamming your security logs and if anything happens it will be hard to find the correct entry.

Enable Port knocking

Port Knocking is a nice idea. The default ssh port is closed until you knock on one or multiple ports in the correct order. The ssh port is then opened automatically and you can login.

As usuall someone already implemented it ;-) Here the documentation: https://help.ubuntu.com/community/PortKnocking

share|improve this answer
    
Port knocking is wow too :D –  Pitto Jun 1 '11 at 17:02

Besides strong passwords, one additional thing you can do is restrict accounts that can log in.

in sshd_config:

AllowUsers myaccount

Also, set PermitRootLogin no.

share|improve this answer

Enable key-based authentication, and turn off challenge-response / password authentication. This will make it as secure as it needs to be.

Additionally I'd ensure that your iptables rules only allow SSH access from your own IP address/range (if this is possible).

share|improve this answer

Would disabling password authentication and requiring public-key based be OK with you?

You could also disable ssh completely, if you have some remote HW management solution, like remote console (IBM RSA or HP ILO). If you have physically separate management and production LANs, then it wouldn't be possible to break into the server by logging into it.

share|improve this answer

theres 2 further things you can do to enhance ssh security:

switch to public key only ssh logins as detailed here: How do you setup ssh to authenticate using keys instead of a username / password?

then you can restrict SSH logins to specific IP's as detailed here: how to restrict ssh login to a specific ip or host

if those methods are setup correctly then to get in, someone needs to connect from your IP address with your private key file

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.