I REALLY like secure shell (SSH) for remote access to linux machines. You can do more than just a “telnet” like remote shell with it. (Port forwarding.) However, the default configuraton for the openssh-server is sometimes a bit less tight than I would like. For that reason on a new install, I usually like to make a few changes. I don’t know if I’ve mentioned this before, but I haven’t devoted a post JUST to this, so… here we go.
Under mandriva, the config file for the openssh server is at /etc/ssh/sshd_config First off, I like to make sure that just version 2 of the SSH protocol is used. This may break compatiblity with older clients that don’t support version 2. In a nutshell, v. 2 is a more secure implemenation
, and in my case, I don’t use anything that doesn’t support version 2… so… the following gets changed in the sshd_config – protocol 2,1 is commented out and protocol 2 added.
Next, I like to make sure that root login is disabled…
After all, every system has a root user, why make it a bit easier for someone to brute force their way in?
I also like to setup a group called sshusers and limit access to just those that need to remotely get in.
This way if I have a lame test account with an equally lame password, it can’t be remotely exploited this way (unless I’m dumb enough to add them to sshusers…)
The AllowUsers directive is another way to do this…
AllowUsers user1, user2, user3
These are just a couple steps you can take to tighten up your ssh server setup. For more on SSH usage and configuration you might consult the manual (man) pages, or may I suggest SSH, The Secure Shell: The Definitive Guide
Related PostsRelated Posts
- Remote tech support with anything - would I do it? I've tried to ask myself if I'd trust someone enough to let them run a remote session on my own desktop to solve a problem. I think the answer is "it depends". If you think about it, I do tech support for home users quite a bit and they let......
- Windows 98 and ME in final days of support (6 by my count) July 11th will mark the end of Microsoft's support for Windows 98 and ME. Which means that there will be no further security updates for those systems after that date. In SOME ways, those systems may find comfort in the security through obscurity approach as much malware MAY not run......
- The security of remote tech support (ultravnc sc or x11vnc with wrapper script) Well, I've got a nice way of doing "easy" one click (or one cut and paste) light desktop support for windows or linux, one uses ultravnc sc, the other uses x11vnc with a special wrapper script. So, what security flaws are there in this process? Well, for starters, I see......
- How To Secure Your Wordpress Blog Security is always a major concern of bloggers and online business owners using a wordpress platform. Wordpress developers also emphasize a lot on security in every upgrade. However, even then vulnerabilities still occur. It can be your fault or your Web host fault. Before a hacker breaks into your wordpress......
- Dreamhost Promo Code For 2011 We all know about Dreamhost one of the best web hosting provider in the world, when compared to other low quality hosting providers. Dreamhost is better in terms of features, support, reliability. It is also one of the fastest growing hosting platform which has about 800K+ web sites hosted online.......
- Microsoft Security Bulletin MS10-046 - Critical Microsoft Security Bulletin MS10-046 - Critical Vulnerability in Windows Shell Could Allow Remote Code Execution (2286198) Published: August 02, 2010 | Updated: August 03, 2010 Version: 1.1 General Information Executive Summary This security update resolves a publicly disclosed vulnerability in Windows Shell. The vulnerability could allow remote code execution if the icon......
- 10 things to do before hooking a Linux PC up to the net
- Vandals banging on the door of ssh….
- SSH tips and tricks.
- VNC or Tightvnc for remote pc access
- Network Security guide for the home or small business network – Part 6 – Secure your services