{"id":122,"date":"2022-12-05T20:13:23","date_gmt":"2022-12-05T18:13:23","guid":{"rendered":"https:\/\/www.mutareb.com\/?p=122"},"modified":"2023-06-16T18:09:53","modified_gmt":"2023-06-16T16:09:53","slug":"how-to-secure-the-ssh-server-on-ubuntu","status":"publish","type":"post","link":"https:\/\/www.mutareb.com\/index.php\/2022\/12\/05\/how-to-secure-the-ssh-server-on-ubuntu\/","title":{"rendered":"How to secure the SSH Server on Ubuntu"},"content":{"rendered":"\n<p>This is a short overview of how to secure the SSH server on a fresh Linux system. We will cover the basics of setting up a robust SSH configuration to access and manage the remote machine later on.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Secure the SSH Daemon Configuration File<\/h2>\n\n\n\n<p>All the configuration of the SSH server we need to adjust is on the system-wide daemon configuration file &#8220;\/etc\/ssh\/sshd_config&#8221;<\/p>\n\n\n\n<p>We will back it up first and then edit it:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo cp \/etc\/ssh\/sshd_config \/etc\/ssh\/sshd_config.bak\nsudo vi \/etc\/ssh\/sshd_config<\/code><\/pre>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Disable Root Login<\/h3>\n\n\n\n<p>Prohibit the Root user from login through SSH<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">PermitRootLogin no<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Specify Allowed User<\/h3>\n\n\n\n<p>It&#8217;s a good security practice to limit the use of the Root user. Instead we will use a limited user who we add to the sudoers from login through SSH<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>AllowUsers user1 user2<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Set a Login Grace Timeout<\/h3>\n\n\n\n<p>The server should not wait for more than 60 seconds after a connection request before disconnecting. Change the LoginGraceTime accordingly:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>LoginGraceTime 1m<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Set Maximum Startup Connections<\/h3>\n\n\n\n<p>Set up a proper maximum number of concurrent connections to the SSH daemon.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>MaxStartups 2<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Set Idle Timeout Interval<\/h3>\n\n\n\n<p>Set a proper idle timeout to avoid an unattended session.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">ClientAliveInterval 300\nClientAliveCountMax 0<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Disable Forwarding<\/h3>\n\n\n\n<pre class=\"wp-block-preformatted\">X11Forwarding no<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>This is a short overview of how to secure the SSH server on a fresh Linux system. We will cover the basics of setting up a robust SSH configuration to access and manage the remote machine later on. Secure the SSH Daemon Configuration File All the configuration of the SSH server we need to adjust&hellip; <a class=\"more-link\" href=\"https:\/\/www.mutareb.com\/index.php\/2022\/12\/05\/how-to-secure-the-ssh-server-on-ubuntu\/\">Continue reading <span class=\"screen-reader-text\">How to secure the SSH Server on Ubuntu<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9,17],"tags":[27,12,26],"series":[7],"class_list":["post-122","post","type-post","status-publish","format-standard","hentry","category-it-security","category-linux-server","tag-linux","tag-security","tag-ssh","series-linux-server","entry"],"_links":{"self":[{"href":"https:\/\/www.mutareb.com\/index.php\/wp-json\/wp\/v2\/posts\/122","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mutareb.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mutareb.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mutareb.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mutareb.com\/index.php\/wp-json\/wp\/v2\/comments?post=122"}],"version-history":[{"count":2,"href":"https:\/\/www.mutareb.com\/index.php\/wp-json\/wp\/v2\/posts\/122\/revisions"}],"predecessor-version":[{"id":124,"href":"https:\/\/www.mutareb.com\/index.php\/wp-json\/wp\/v2\/posts\/122\/revisions\/124"}],"wp:attachment":[{"href":"https:\/\/www.mutareb.com\/index.php\/wp-json\/wp\/v2\/media?parent=122"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mutareb.com\/index.php\/wp-json\/wp\/v2\/categories?post=122"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mutareb.com\/index.php\/wp-json\/wp\/v2\/tags?post=122"},{"taxonomy":"series","embeddable":true,"href":"https:\/\/www.mutareb.com\/index.php\/wp-json\/wp\/v2\/series?post=122"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}