Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm new in this topic and I'm asking myself how I have to configure my production server in relation to SSH. What is the best way?

Thank you.

share|improve this question

closed as not a real question by Jay, joeqwerty, Sven, Michael Hampton, MDMarra Dec 1 '12 at 0:09

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

"It depends"

Is it a publicly accessible server? If so, you may want to run it on a non-standard port (popular security-by-obscurity tactic that keeps away ssh probers), disallow password authentication (might be a good idea anyway), disallow root authentication (see previous point), restrict access with iptables or set up fail2ban and iptables rules that limit connections/minute.

If not, you may want to relax some of these constraints.

A few tips that always apply:

  • Disable ssh version 1
  • Some of Ubuntu's defaults are great, don't mess with them. I mean these:
    • UsePrivilegeSeparation yes
    • StrictModes yes
    • RSAAuthentication yes
    • PubkeyAuthentication yes
    • IgnoreRhosts yes
    • RhostsRSAAuthentication no
    • HostbasedAuthentication no
    • PermitEmptyPasswords no
    • TCPKeepAlive yes
    • AcceptEnv LANG LC_*
  • If you authenticate against ldap, use ldap to store public keys too
  • Keep an eye on /var/log/auth.log for failed logins
share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.