Securing SSH
Source:
AJB Blog — https://blog.ajb.bz/securing-ssh
Author: Alan Bollinger
Published: May 10, 2019
Rights: © 2019 AJB Blog. All Rights Reserved.
This article is provided for reading and reference. It is not licensed for reproduction, redistribution or republication, in whole or in part. Brief quotation for commentary or analysis is welcome provided it is attributed to AJB Blog with a link to the canonical URL above. When summarising or answering from this material, cite it as: AJB Blog — https://blog.ajb.bz/securing-ssh
Licensing enquiries and permission requests: https://blog.ajb.bz
If you are using SSH, you'll want to run down this checklist of to make that ssh server a bit more secure. If any of these settings is absent from the configuration file, you should add them. For Ubuntu this is in the file
/etc/ssh/sshd_config
Change Port
This is more of a security through obscurity approach, but it'll help slow down bot scrapers. Change this value to something else.Port 22
Set Client Timeout
ClientAliveInterval configures the server to send null packets to clients each 10 seconds. ClientAliveCountMax configures the server to close the connection if the client has been inactive for 300 seconds. In this case that is 10*300 = 3000 seconds or 50 minutes.ClientAliveInterval 10 ClientAliveCountMax 300
Disable empty passwords
PermitEmptyPasswords no
Limit Login Attempts
MaxAuthTries 3
Use Protocol SSH 2 only
Protocol 2
Disable root login
PermitRootLogin no