I've been running a few servers for a relatively long time, but I always only rented them, so I don't have much experience securing the actual server (as opposed to the application I'm running on it).

Now I feel like opening up my small home SSH server to the internet.

I will be the only one using it, my passwords are complicated enough, I've changed the default SSH port to something around 4000, the only accessible port is this SSH port through port-forwarding on my router/firewall, and it gets updated automatically every night (it runs Arch Linux, a rolling release distribution).

What are, if any, other things I should do to keep it secure?



Make sure root logins are disabled PermitRootLogin no. I would also consider disabling passwords altogether PasswordAuthentication no and use public keys PubkeyAuthentication yes.

  • +1 beat me to it... – gravyface May 9 '11 at 22:58
  • 1
    If you are going to be using passwords you might try looking into a two factor authentication system. If not, I recommend against typing in your password on a random internet cafe / library system. – Mark Wagner May 9 '11 at 23:47
  • 4
    If you allow password auth, consider installing fail2ban to prevent brute force attacks and use strong passwords for any account allowed to login over ssh – uSlackr May 10 '11 at 0:57
  • @embobo - why is that? Passwords sent across the wire are encrypted in ssh. Yes, key auth is far superior in many ways, but as long as passwords are sufficiently strong and you've verified no one is shoulder surfing, then it's not a huge deal. – EEAA May 10 '11 at 2:55
  • 3
    @Erika I think embobo is alluding to the general distrust of any foreign system. Even though SSH is encrypted, a foreign machine can still say, log your keystrokes. Thus password = compromised. – rthomson May 10 '11 at 3:11

Make sure only SSH-2 is allowed (since SSH-1 has raised some security concerns in the past):

Protocol 2

Specify which are the only users allowed to login via SSH:

AllowUsers bob, john

For increased security, disallow password authentication and use public-key authentication:

PasswordAuthentication no
PubkeyAuthentication yes

Note: this tutorial contains instructions for creating keys and configuring public-key authentication.


As well as the points about disabling root login or using public key authentication only, I'd also double check that there are no user accounts on the system that have trivial or empty passwords. You've said your personal passwords are fine, but that doesn't rule out an account with a poor password having been created for some other reason.

As an example: I had to fix up one network where the previous admin had installed nagios on all his systems from source, and created a nagios user with either no password, or the password "nagios", and then proceeded to get three different machines compromised.


You might want to look at some kind of IP blacklisting tool like http://denyhosts.sourceforge.net/. It blocks any IPs that try to log in unsuccessfully too many times and is highly configurable.

  • Probably a waste of time if you have root logins disabled. In my experience (2 ish years of an SSH server on the internet), only a couple have ever even got my (obvious) username right. The bots are just checking obvious passwords on common usernames (99% of failed logins on my server are for root, which is disabled of course). – Brendan Long May 10 '11 at 5:40
  • 4
    Defintely not a waste of time - but have a look at fail2ban – symcbean May 10 '11 at 12:52
  • +1 for fail2ban. – JamesBarnett May 27 '11 at 14:20
  • 1
    root isn't the only obvious account that bots check for, see nagios as mentioned above. There are also database accounts like mysql and postgres. Plus any other application accounts. – JamesBarnett May 27 '11 at 14:22
  • Yes I actually had my 'net facing SSH machine taken over by a bot guessing a non-root password, so definitely definitely not a waste of time. Besides, since getting a blacklister like this, looking at the logs, very small percentage of attempts are actually for root. – Lynden Shields Jan 8 '12 at 7:12

I suggest that you install Fail2ban! http://www.fail2ban.org

It bans an IP after x failed tries for y minutes, helping to keep scriptkiddies in check ;)


Reoccurring log reviews across the pertinent portions/components of your systems (depending on its actual/specific configuration)...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.