5

How can I secure SSH access to a linux box running Ubuntu k for multiple users?

This server will be for a web app but I'm not sure how to evaluate the tools to perform this task. I have tried a few tools in the past but not sure how they stack up against each-other. How can I evaluate my SSH security and the tools and utilities that I would use to perform that securing?

6 Answers 6

17

What goals do you have in mind for your security? Who are you protecting this against?

Broad spectrum, use iptables to firewall port 22 against any unwanted IPs by specifically allowing the IPs you want, then blocking everything else.

You can also specify whether users can use passwords to log in, or whether they have to have certificates, which might be a good idea if you suspect people will try to break into others' accounts.

But for specifics, we've got to know what you're doing.

EDIT

OK, taking into account what you said below in the comments, you want to prevent unauthorized access to the machine. The second part, ensuring that your users don't do anything bad, is beyond the scope of this particular question, but is a worthy topic too. Broad, but worth asking.

The primary file that you need to edit is /etc/ssh/sshd_config and after each configuration change, you need to run /etc/init.d/sshd restart (or /etc/init.d/ssh if it's a debian/ubuntu system). When you're first learning how to configure ssh, it's a good idea to be logged in on the local console, since a misconfiguration will cut off your access.

Step 1: Make sure that root can't log in via ssh.

PermitRootLogin no

If you absolutely must have root logins, you can set it to "without-password", which requires the connecting user to present a certificate and be authenticated like that.

Step 2: Allow (or deny) any specific users that should (or shouldn't) have access

There are various configuration directives to do this, like DenyUsers, AllowUsers, DenyGroups, and AllowGroups. These take lists of users or groups separated by spaces.

One of the neat things is that you can specify user@host, so if you only want Bob to be able to connect form his home machine, you can say

AllowUsers [email protected] 

Step 3: Explicitly permit public key authentication

PubkeyAuthentication yes

This is the default, but we want to ensure it takes effect, because we're going to disable the ability for users to type passwords in...

Step 4: Disable password authentication

Passwords can be stolen, overheard, or copied from the sticky note under your keyboard. Certificates are harder to do. Make sure that people can't use passwords thusly:

PasswordAuthentication no

Step 5: Make sure clients use modern protocols

Protocol 2

OpenSSH supports 2 protocols, called creatively, "1" and "2". "1" is old, allows things like DES encryption and other insecure things.

You're going to have to get your users putty certificates in order to connect now. The easiest way is to use PuttyGEN, which is available at the Putty site (http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html).

Hope it helps!

7
  • I will be using putty and I have been using openSSH bust was wondering if there was a better way
    – Kevin
    Dec 11, 2009 at 16:21
  • If you're coming from a Windows machine, putty is perfectly fine, and openssh is the right server. Do you know what you're trying to protect against, or are you just looking for some good policies to put in place? Dec 11, 2009 at 16:28
  • just want to keep hackers out of my system... I have changed my SSH port and what not to help but I want to make sure I have my bases covered. Also, I don't want "other" users on my server to break anything.
    – Kevin
    Dec 11, 2009 at 16:45
  • Also, I'm trying to learn more about security for linux so if there is anything I can do to make this thing more secure the better. Basically I want to protect against common problems that may arise. I know this is not a precise as you would like, as there are thousands of ways to "hack" a system. So for my scenario, as of right now, I want to keep my users accounts form being used by anyone other than who I gave permissions too and your generic hacker.
    – Kevin
    Dec 11, 2009 at 16:57
  • You should also install denyhosts IMHO it watches for login attempts and blocks traffic in /etc/hosts.deny
    – Petriborg
    Dec 11, 2009 at 18:32
2

you can try enforcing use of ssh keys or introduce a hardtoken (like yubikey) moving ssh away from port 22 helps against script kiddies but will surely not defend you from someone, who targeted you as a victim.

2

On top of everything the top poster said, there is a script called "Denyhosts" which will deny access to anything that authenticates badly three times, or, for a more IP Tables way to do the same thing:

http://dwm.me.uk/articles/2008/mitigating-ssh-attacks

2

In addition to everything @MattSimmons suggests in his excellent answer I would say that instead of managing iptables yourself, you may want to consider using:

fwknop - Single Packet Authorization and Port Knocking:

fwknop stands for the "FireWall KNock OPerator", and implements an authorization scheme called Single Packet Authorization (SPA). This method of authorization is based around a default-drop packet filter (fwknop supports both iptables on Linux systems and ipfw on FreeBSD and Mac OS X systems) and libpcap. SPA is essentially next generation port knocking.

That way you don't have to bother with things like fail2ban or other ssh blacklisting tools; instead you can avoid allowing anyone to even connect to your ssh port without first doing SPA.

2

For learning more about securing linux see the NSA guide at:

Guide to the Secure Configuration of Red Hat Enterprise Linux 5

It has some good sections on SSH, enforcing password lengths etc.

1
  • I would recommend turning off passwords altogether like MattSimmons suggests in Step 4 of his answer.
    – aculich
    Jan 22, 2012 at 4:51
1

You can take different actions like install deny hosts. That will block the ssh from one IP address after failed three tries. Blocked IP address will be listing in /ets/hosts.deny file and you can manually white-list using /etc/hosts.allow

Also let known useraccounts only to ssh into the host. You can do this by using pam.d module. You may add rule to /etc/pam.d/sshd file as following, and /root/allow-users file contain the user list of those who authorize to ssh.

auth required pam_listfile.so item=user sense=allow file=/root/allow-users onerr=fail

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .