So, I decided to add a SSH login to an important network connected box at home, and In less then 2 hours I got a couple remote machines running brute force attacks against my root account’s password. This is the norm nowadays. With this said, let me show you how to fix your SSH and keep someone from cracking your 3rd grade reading level password on a box with SSH.

First things first. The easiest way a hacker has to guess your password is by using what we all have by default on most Linux installs, your root account on the default port 22.  We are going to change this port. After changing the port you may have to update your systems firewall and SELinux rules, but there is a good chance you wouldn’t need to.

These changes will remove access to the widely known default port and the most critical root account on your system. This coupled with really good passwords or even better SSH keys and you our on your way to being much more protected.

To take your configuration further you should use keys to eliminate passwords altogether. You could even use the keys with a password for a added layer of security though I like to use private/public keys in most cases without an extra password to allow easy access by scripts for automating tasks on those servers.

Let’s knock this out and get to editing our /etc/ssh/sshd_config On your server with SSH. Below are the entries that need added/changed. Read the comments to see what the config line does. Comments are lines starting with #.

By changing the following line you will want to make sure that the user you a enabling for SSH access has Sudo access. For this you will need to add the user to the sudoers files. This guide assumes you did this allready. Sudo means that user can do whatever they need to the system without needing the root user just by running a command to escalate their privileges .

# Lines like these are comments.
# In order to prevent root logins change "yes" to "no" like in the line below.
PermitRootLogin no

# Now run ssh on a non-standard port so its not as easily identified by hackers by changing the line 
#that looks like # the one below.
Port 2345  

If you have other users on the system and they don’t need access then add this line below and list the users you would like to allow. Users names will need to be spaced. This reduces the chance of having another users name and password guessed as well.

AllowUsers juicyj projectpat chickenhead

Then run this to restart the SSH service

sudo service sshd restart

Now you have removed the root user and changed the default port, but its still not where you should stop if you have important systems. Continue to remove password access all together.

Remove password SSH Access ( Most secure )

It a good idea to completely remove the need for a password because with a little work someone could find your new SSH port, scan your sites for getting a good guess of a username to try and then they could try a ton of passwords over time to brute force in.

Its safer to fully remove the need for a password. Do the following to completely remove password logins.

find your local machines key with the following command. This is the ‘Key’ you will use:

cat ~/.ssh/id_rsa.pub

You will want to update the the following file and add your local machines key to a line on your server :

 nano ~/.ssh/authorized_keys

Next test your connection to the server. If it automatically connects go and edit this file on your server. You can use the following command , but update your username and port.

ssh -p 2345 [email protected]

Next update the sshd config on the server.

nano /etc/ssh/sshd_config 

and change the following line to ‘no’ to disable password authentication.

PasswordAuthentication yes

There you go. It really is just that simple of a configuration. Hopefully this will help you to secure your Linux machine and protect yourself from hackers !