Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

What steps should I take to reasonably secure my linux desktop before opening sshd to the Internet so I can connect from anywhere?

share|improve this question
add comment

4 Answers

up vote 6 down vote accepted

I'd highly recommend you use RSA keys rather than passwords for remote SSH logons.

Second, you'll want to install Fail2Ban or something similar to discourage brute force breakin attempts (although again, disabling password authentication in favor of RSA public/private key authentication for SSH access would make this a mostly moot point)

Third, it's possible to prevent root from being allowed to connect via ssh; I recommend you do so and use sudo once connected.

As for the rest... Well, all the usual precautions when making a service available over the internet apply, although SSH is by its nature safer than most.

share|improve this answer
    
Elaborate on "usual precautions" –  Steven Sep 28 '11 at 21:19
3  
Keep your software up to date, don't ever transmit anything sensitive over an untrusted connection if you can possibly help it, make sure that your firewall allows only the types of connections you intend to trust through, etc. –  Shadur Sep 28 '11 at 21:39
add comment

Make sure you keep your SSH server up-to-date. OpenSSH has a good security record, but you don't want to.

Consider carefully whether you need to allow password authentication. Normally you should be logging in only from trusted computers (don't type a password on a computer that may be running a key logger), and these trusted computers are generally under your control and have your ssh private key. So in most circumstances password authentication is not useful and you should disable it. The main reason to forbid password authentication is that users are poor at managing passwords: they reuse them (so the passwords get leaked) and they are bad at choosing hard-to-guess passwords (so the passwords get brute-forced). If you're the only user on the machine, and your password is strong, and you don't use that password anywhere else, and you don't have and will never have any kind of test account with an easy-to-guess password, and you will never open an account for a friend, then it's ok to allow password authentication.

You may want to restrict the set of users who are allowed to log in over ssh. In particular, disabling root logins may make attacks slower if you're up against an attacker of low-to-medium sophistication. This isn't that big a deal though; escalating from a user account to root is rarely the hardest part.

If you can, keep logs on a separate machine or on read-only media. Note that there are many bots that perform brute-force attempts to log in with guessed passwords or weak keys. These bots are inoffensive against a properly secured setup (strong passwords, no low-entropy key), but can generate a log entries. A way to largely get rid of these brute-force attempts is to run ssh on a non-default port. Note that this is only a way to keep the volume of logs down (and perhaps slightly reduce the traffic from probing), it does not provide any additional security per se.

See also this similar question on Security Stack Exchange.

share|improve this answer
add comment

Limit the SSH-Connection-Rate and follow the link mentioned in the article to further harden your ssh-config. Also Limit sshd to use only protocol 2, forbid direct root-login via ssh.

Allow only your account to log in. Disable password authentication. Do not use port 22. Use a passphrase for your private key.

share|improve this answer
add comment

Have a good read of the Hardening Linux Server question over on security stackexchange. It covers off closing weak services and removing unneeded and outdated services.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.