0

To start; I'm not completely sure, if this is the correct Exchange site for this question, but I couldn't find a better one - so I'll ask it here anyways.

Recently i started to think about the security of ssh. I have an Ubuntu VM (or any other linux distr.) running on a server, to which i can connect via ssh. To start securing the remote machine, I started using public/private keys for the authentication.

As a further step, I thought of disabling the root login - which has a 24 char long generated password.

My Questions now are:

  • Do I even need to disable root login with such a password?
  • Is this enough to make my remote machine secure? If no;
  • What other steps should I take to secure my remote machine?

1 Answer 1

3

Is this enough to make my remote machine secure?

This is the wrong question. There is no total security, security is always relative.

Is it "secure enough"? Maybe, but why not add more security even if it's "secure enough".

What other steps should I take to secure my remote machine?

  • Disable password login completely, then you don't need to care even if 24 random chars might be fine as a password, it's still much less secure than key-based authentication.

  • Use a non-standard port. While this doesn't help for targeted attacks, it will eliminate >99% of random / automized attacks. Even if your passwords are good and the attacks won't do any "real harm", it will spam your log files and you might miss real issues.

  • Use port knocking.

  • Use fail2ban. This will make attacks a lot more difficult, however as attacks are usually coming from botnets with many IPs, it has still only limited affect.

  • Limit users permissions to the minimum necessary.

  • Use a firewall to limit connections by IP (range) if possible.

  • Consider: security of your server is not only ssh. Any service exposed to the internet can be attacked, so some measures could be:

    • Let each service run with a different, unprivileged user
    • Use containers/virtual machines to separate processes.
    • Use a firewall to allow access only to ports that are needed for your services
    • Keep all software up to date at any time.
    • Follow security bulletins for the software you're using.

Check this similar question and answers on Security SE for more information.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .