Securing SSH



I REALLY like secure shell (SSH) for remote access to linux machines. You can do more than just a “telnet” like remote shell with it. (Port forwarding.) However, the default configuraton for the openssh-server is sometimes a bit less tight than I would like. For that reason on a new install, I usually like to make a few changes. I don’t know if I’ve mentioned this before, but I haven’t devoted a post JUST to this, so… here we go.


Under mandriva, the config file for the openssh server is at /etc/ssh/sshd_config First off, I like to make sure that just version 2 of the SSH protocol is used. This may break compatiblity with older clients that don’t support version 2. In a nutshell, v. 2 is a more secure implemenation
, and in my case, I don’t use anything that doesn’t support version 2… so… the following gets changed in the sshd_config – protocol 2,1 is commented out and protocol 2 added.

#Protocol 2,1
Protocol 2

Next, I like to make sure that root login is disabled…

PermitRootLogin no

After all, every system has a root user, why make it a bit easier for someone to brute force their way in?

I also like to setup a group called sshusers and limit access to just those that need to remotely get in.

AllowGroups sshusers

This way if I have a lame test account with an equally lame password, it can’t be remotely exploited this way (unless I’m dumb enough to add them to sshusers…)

The AllowUsers directive is another way to do this…
AllowUsers user1, user2, user3

These are just a couple steps you can take to tighten up your ssh server setup. For more on SSH usage and configuration you might consult the manual (man) pages, or may I suggest SSH, The Secure Shell: The Definitive Guide

Related Posts

Blog Traffic Exchange Related Posts
  • How to Remove KeepCop | Keep Cop Removal Guide KeepCop is yet another of those rogue antivirus applications that seem to be such a plague on computer users today. These rogue security applications usually installed without permission, or by means of trickery claiming to be a video codec or flash player update. Further they will start out on your......
  • Apple Quicktime and OS X updates to patch multiple security vulnerabilities Apple has released Quicktime v. 7.1 for both Windows and OS X to address about 12 vulnerabilities. It looks as though all of the vulnerabilities were related to either a specially crafted images or movies (a variety of formats...) Upgrade or use another viewer... Affected file formats are.... Jpegs, Flashpix,......
  • VNC or Tightvnc for remote pc access I was surprised to do a search and find that I haven't mentioned tightvnc before (or even merely VNC as a useful tool.) Ok - here's the scenario, you need a way to get remote pc access, or remotely view a desktop, maybe it's a Windows machine and you're using......
Blog Traffic Exchange Related Websites
  • Hostgator Coupon Code For August 2011 Last month, we discussed in detail on the features of Hostgator web hosting service. Also, i released the Hostgator coupon code which helps you to grab maximum offers on every hosting purchase. I am used to promote Dreamhost service by giving way promo codes every month. This time into Hostgator......
  • Comparison Between Free Of Charge And Paid Web Comparison between free of charge and paid Web security software has turn into a main subject of discussion amongst probably the most of all computer users recently. Numerous people who have employed both free of charge as well as paid Web security software place their strong opinions. Although many people......
  • How To Secure Your Wordpress Blog Security is always a major concern of bloggers and online business owners using a wordpress platform. Wordpress developers also emphasize a lot on security in every upgrade. However, even then vulnerabilities still occur. It can be your fault or your Web host fault. Before a hacker breaks into your wordpress......
en.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site