4

What steps should I take to reasonably secure my linux desktop before opening sshd to the Internet so I can connect from anywhere?

4 Answers 4

6

I'd highly recommend you use RSA keys rather than passwords for remote SSH logons.

Second, you'll want to install Fail2Ban or something similar to discourage brute force breakin attempts (although again, disabling password authentication in favor of RSA public/private key authentication for SSH access would make this a mostly moot point)

Third, it's possible to prevent root from being allowed to connect via ssh; I recommend you do so and use sudo once connected.

As for the rest... Well, all the usual precautions when making a service available over the internet apply, although SSH is by its nature safer than most.

2
  • Elaborate on "usual precautions"
    – Steven
    Sep 28, 2011 at 21:19
  • 3
    Keep your software up to date, don't ever transmit anything sensitive over an untrusted connection if you can possibly help it, make sure that your firewall allows only the types of connections you intend to trust through, etc. Sep 28, 2011 at 21:39
4

Make sure you keep your SSH server up-to-date. OpenSSH has a good security record, but you don't want to.

Consider carefully whether you need to allow password authentication. Normally you should be logging in only from trusted computers (don't type a password on a computer that may be running a key logger), and these trusted computers are generally under your control and have your ssh private key. So in most circumstances password authentication is not useful and you should disable it. The main reason to forbid password authentication is that users are poor at managing passwords: they reuse them (so the passwords get leaked) and they are bad at choosing hard-to-guess passwords (so the passwords get brute-forced). If you're the only user on the machine, and your password is strong, and you don't use that password anywhere else, and you don't have and will never have any kind of test account with an easy-to-guess password, and you will never open an account for a friend, then it's ok to allow password authentication.

You may want to restrict the set of users who are allowed to log in over ssh. In particular, disabling root logins may make attacks slower if you're up against an attacker of low-to-medium sophistication. This isn't that big a deal though; escalating from a user account to root is rarely the hardest part.

If you can, keep logs on a separate machine or on read-only media. Note that there are many bots that perform brute-force attempts to log in with guessed passwords or weak keys. These bots are inoffensive against a properly secured setup (strong passwords, no low-entropy key), but can generate a log entries. A way to largely get rid of these brute-force attempts is to run ssh on a non-default port. Note that this is only a way to keep the volume of logs down (and perhaps slightly reduce the traffic from probing), it does not provide any additional security per se.

See also this similar question on Security Stack Exchange.

2

Have a good read of the Hardening Linux Server question over on security stackexchange. It covers off closing weak services and removing unneeded and outdated services.

1

Limit the SSH-Connection-Rate and follow the link mentioned in the article to further harden your ssh-config. Also Limit sshd to use only protocol 2, forbid direct root-login via ssh.

Allow only your account to log in. Disable password authentication. Do not use port 22. Use a passphrase for your private key.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .