1

I recently set up SSH access to a small Ubuntu box which I currently log into both from my local network and from offsite.

Currently I just have 2 users that are remoting in, but checking my /var/logs/auth.log I see TONS of random username/port combination attempted logins that look like this:

Failed password for invalid user buildbot from xxx.92.16.81 port 11934 ssh2
Received disconnect from xxx.92.16.81 port 11934:11: Bye Bye [preauth]
Disconnected from invalid user buildbot xxx.92.16.81 port 11934 [preauth]
Invalid user aimax from xxx.92.16.81 port 24768
pam_unix(sshd:auth): check pass; user unknown
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=xxx.92.16.81

While I suppose this is not super threatening as I only have two users on the allowed users section of sshd_config, it is kinda nerve wracking to see that people really want to try to get in and my poor server is handling what looks like hundreds of these per day.

Is there a way (either through the router/firewall or the server itself (ip tables maybe?)) that I can have it just ignore or throw away SSH requests that are not for the allowed users on the specific port 22?

Generally speaking, what steps could I take to make sure my SSH is as secure as possible while still being able to log in when I'm not home?

edit: I had not configured my SSHD_config as I thought I had, updated for AllowedUsers, scary

  • As a rule I never expose such services for the internet, or should you be inclined to do so, use a jump host and expose only one server. We only allow SSH access via VPN – Rui F Ribeiro Jun 13 at 22:17
  • If you have OpenVPN running on your Ubuntu server, this might help. – Vignesh SP Jun 13 at 22:35
  • Many great suggestions here, from Fail2ban to people recommending I only ssh through vpn or have a jumpbox, thank you all! I have a dd wrt router and found some generic iptables to implicit deny connections and then made an exception for SSH, disabled password login and generated a key to use. Now I can login to the router via ssh remotely, then log into the two boxes running Ubuntu once I'm "on" the local network through that connection. Good/terrible idea/setup? – user863492 Jun 21 at 4:27
2

The port numbers are the from ports, not the to part (22).

To secure the ssh-server, you need to disable password based authentication. Use only key based authentication, ensure that the keys are sufficiently long, and kept securely (don't share the private keys, or let them become known).

Techniques involving firewalls, to only allow knows IP addresses etc, can only reduce rate of attack (reduce server load). However you should still insure that you have a basic fire-wall (maybe not restrict IP address, as this can make it harder to use. Though some of my devices are restricted to local access). Use gufw (the graphical front end to ufw. No need to learn command line of a command you will use just a few times a year).

  • Nothing wrong with learning ufw allow 22/tcp – ivanivan Jun 13 at 19:30
  • @ivanivan I just learn something. I use the command line for most thinks, I just assumed that this command was not worth learning. I did use iptables direct a few times, when ufw could not do what I needed. – ctrl-alt-delor Jun 13 at 22:13
  • cool! what is really neat is that a lot of services have definitions for them, so you could actually do ufw allow ssh or ufw allow http – ivanivan Jun 14 at 1:49
3

You should install fail2ban. check this DigitalOcean guide to install it. https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-14-04

Or only allow specific ip address on ssh by using your firewall. if you're using ubuntu typically ufw is installed, just type ufw allow from [YOUR IP ADDRESS] to any port 22 (be sure you set ufw be active) or firewalld if you're using redhat flavored distro.

  • I will check out fail2ban, thank you! – user863492 Jun 13 at 19:07
1

If you know that your two users are coming in from only a small set of IP addresses, you can block all connections on port 22 from anywhere other than these IP addresses through IP tables. If you cannot reduce the incoming IP address range, I would suggest forcing the use of SSH keys for logins and blocking any attempts to log in using passwords.

  • 2
    I will look into forcing keys only and generate some, thank you. I log in from my phone sometimes on LTE so I think the IP changes too much for blocking. – user863492 Jun 13 at 19:06
1

You can do the following things,

  1. Using IPTABLES block all incoming subnet/IP addresses for port 22 except the allowed one's
  2. Set Idle time disconnects
  3. Deny direct root login from putty by editing sshd conf file
  4. monitor failed login on /var/log/secure logs and take remediate actions

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.