9

I've been running a few servers for a relatively long time, but I always only rented them, so I don't have much experience securing the actual server (as opposed to the application I'm running on it).

Now I feel like opening up my small home SSH server to the internet.

I will be the only one using it, my passwords are complicated enough, I've changed the default SSH port to something around 4000, the only accessible port is this SSH port through port-forwarding on my router/firewall, and it gets updated automatically every night (it runs Arch Linux, a rolling release distribution).

What are, if any, other things I should do to keep it secure?

Thanks!

Improve this question
0

6 Answers 6

Reset to default
22

Make sure root logins are disabled PermitRootLogin no. I would also consider disabling passwords altogether PasswordAuthentication no and use public keys PubkeyAuthentication yes.

Improve this answer
7
  • 1
    If you are going to be using passwords you might try looking into a two factor authentication system. If not, I recommend against typing in your password on a random internet cafe / library system.
    – Mark Wagner
    Commented May 9, 2011 at 23:47
  • 4
    If you allow password auth, consider installing fail2ban to prevent brute force attacks and use strong passwords for any account allowed to login over ssh
    – uSlackr
    Commented May 10, 2011 at 0:57
  • @embobo - why is that? Passwords sent across the wire are encrypted in ssh. Yes, key auth is far superior in many ways, but as long as passwords are sufficiently strong and you've verified no one is shoulder surfing, then it's not a huge deal.
    – EEAA
    Commented May 10, 2011 at 2:55
  • 3
    @Erika I think embobo is alluding to the general distrust of any foreign system. Even though SSH is encrypted, a foreign machine can still say, log your keystrokes. Thus password = compromised.
    – rthomson
    Commented May 10, 2011 at 3:11
  • Any Reason why people dont use Public keys AND a password. TBH having just a file as your password sounds just as bad as having a txt file on your computer called "passwords.txt" A combination of public keys and passwords would be the most secure would it not?
    – Silverfire
    Commented May 10, 2011 at 5:36
9

Make sure only SSH-2 is allowed (since SSH-1 has raised some security concerns in the past):

Protocol 2

Specify which are the only users allowed to login via SSH:

AllowUsers bob, john

For increased security, disallow password authentication and use public-key authentication:

PasswordAuthentication no
PubkeyAuthentication yes

Note: this tutorial contains instructions for creating keys and configuring public-key authentication.

Improve this answer
5

As well as the points about disabling root login or using public key authentication only, I'd also double check that there are no user accounts on the system that have trivial or empty passwords. You've said your personal passwords are fine, but that doesn't rule out an account with a poor password having been created for some other reason.

As an example: I had to fix up one network where the previous admin had installed nagios on all his systems from source, and created a nagios user with either no password, or the password "nagios", and then proceeded to get three different machines compromised.

Improve this answer
4

You might want to look at some kind of IP blacklisting tool like http://denyhosts.sourceforge.net/. It blocks any IPs that try to log in unsuccessfully too many times and is highly configurable.

Improve this answer
4
  • Probably a waste of time if you have root logins disabled. In my experience (2 ish years of an SSH server on the internet), only a couple have ever even got my (obvious) username right. The bots are just checking obvious passwords on common usernames (99% of failed logins on my server are for root, which is disabled of course).
    – Brendan Long
    Commented May 10, 2011 at 5:40
  • 4
    Defintely not a waste of time - but have a look at fail2ban
    – symcbean
    Commented May 10, 2011 at 12:52
  • 1
    root isn't the only obvious account that bots check for, see nagios as mentioned above. There are also database accounts like mysql and postgres. Plus any other application accounts.
    – JamesBarnett
    Commented May 27, 2011 at 14:22
  • Yes I actually had my 'net facing SSH machine taken over by a bot guessing a non-root password, so definitely definitely not a waste of time. Besides, since getting a blacklister like this, looking at the logs, very small percentage of attempts are actually for root.
    – Lynden Shields
    Commented Jan 8, 2012 at 7:12
3

I suggest that you install Fail2ban! http://www.fail2ban.org

It bans an IP after x failed tries for y minutes, helping to keep scriptkiddies in check ;)

Improve this answer
0

Reoccurring log reviews across the pertinent portions/components of your systems (depending on its actual/specific configuration)...

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .