How do I secure my SSH access?

Question

I'm one of those guys who climbs up the ladder to the high dive and jumps off, then realizes he doesn't know how to swim.

So I have a VPS, and I have no idea how to administer it. I understand one of the first things to do is secure it, and the first concrete step in that direction I've found so far is in moshen's comment:

Also, you should secure your SSH access as soon as possible. I recommend changing the default port, using key-based authentication and disabling password authentication and root logins (basically create a standard user account for you to log in with)

So far, all I know how to do is use my VPS provider's web interface to open a console with root access. So how do I follow moshen's advice?

Answer 1

To secure your ssh you should do the next:

1) Make sure that you have an user with sudo access and public key, to do so follow the next steps:
a) Create the user by issuing:

useradd sudo_user

b) Login as this user and create a public/private key set, after which set the authorized_keys:

su - sudo_user
ssh-keygen -t rsa
touch ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
cat ~/.ssh/id_rsa.pub > ~/.ssh/authorized_keys
exit

c) Get your private key from /home/sudo_user/.ssh/id_rsa that you will further use to login to the server:

cat /home/sudo_user/.ssh/id_rsa

d) Set sudo access for your user:

echo "sudo_user  ALL=(ALL)       NOPASSWD: ALL" >> /etc/sudoers

2) Edit your /etc/ssh/sshd_config config and make the next changes:
a) Disable root access by making sure the next lines says:

PermitRootLogin no

b) Disable password authentication by setting:

PasswordAuthentication no

and

PubkeyAuthentication yes

c) Change the port for ssh, make sure that the new port is open in the firewall first:

Port 12345

You can change it though to anything you like. d) Reload ssh by issuing:

service sshd reload

or

service ssh reload