SSH is the default secured remote management protocol for almost all of Linux distributions. SSH provides a confidentiality and integrity by data encryption and passwords are no longer sent in plain text over the network. Nevertheless, a default configuration of SSH can put the server in a security risk.
That is why it is important to follow a few simple steps to harden an SSH server that can dramatically reduce the risk.
In this document, it is assumed that:
You have already install RHEL/CentOS 7 Linux server up and running.
3. Disable Root Logins
For security concern, it is not recommended to use root user to login via SSH over a network. The best approach is to use normal user to login to the server and use command sudo to perform the task that required root privilege. For more detail about Sudo, please check Linux Privilege Delegation With Sudoers. To disable root login via SSH, update file /etc/ssh/sshd_config and restart SSH service as the following.
4. Limit User Logins
By default, all valid users on the system are able access the server. For security reason, we should limit to only certain users who really need to have SSH access to the server. Add the parameter AllowUsers followed by a space separated list of usernames to file /etc/ssh/sshd_config. In the following example, there are only two users, “john” and “sysadmin” who can remote SSH to the server.
5. Disable Protocol 1
Using protocol 1 of SSH is less secure. We should be disabled it and always use protocol 2 only instead. Edit file /etc/ssh/sshd_config and restart SSH service as the following.
6. Change Default Port
Port 22 is the default SSH listens port for incoming connections. The hacker can constantly scanning the server for port 22, and an effective method is to changing the default SSH port, for example to port 22224 as the following, to eliminate this attacks.
Now we need to check SELinux what ports sshd is allowed to listen on by executing the following command.
To allow sshd to listen on the new port 2223 we have to add a rule to SELinux and restart SSH service as the following
7. Limit Access With Firewall
For security enhancement, we should filter the connections with firewall by adding a firewall rule in IPTables to limit access on the changed port 2223 to only an authorized IP addresses. Edit file /etc/sysconfig/iptables and restart IPTable service as the following.
8. Limit Idle Timeout Interval
If a timeout period for SSH connections on a server is not setting up, it is a security risk. In many cases, people stay away from their computers without locking the screens and SSH is still connected to the server. Thus, it could be compromise. Edit file /etc/ssh/sshd_config as the following. The timeout interval is in seconds. So let set it to 300 seconds to have 5 minutes idle timeout.
9. Limit Maximum Fail Authentication
Limiting a maximum fail authentication with SSH is a good method to stop the password brute-forcing attacks. If a user input the password incorrectly for N-1 times of the limited N time, the SSH remote session will be disconnected and will have to reconnect again. In below configuration, when user incorrectly input the password for times, the remote session will be disconnected.
10. Limit Listen Address
The default configuration of SSH will listens on all available interfaces which it should be limited. If there are multiple interfaces on the server configured with different IP addresses, it is always best to limit the user to login to the server using management IP address only.
11. Disable Rhosts Files Support
File .rhosts is used to control which computers trust other computers for SSH remote access to with a certain user account. If a computer trust another computer, then it will allow a specified user to remote SSH access to the trusted computers without having to enter a password.
12. Disable Empty Passwords Access
In some case, a certain user account on the server might not have set a password or has empty password. It is a best to always disable these users connecting with remote SSH server.
13. Disable Host-Based Authentication
Host-based authentication allows hosts to authenticate on behalf of all or some of the users using the public key.
14. Enable Informational Log Level
It is good to configure SSH server to log INFO level information. Since SSH is an entry point to our server, it is recommended to log as much as possible, so we will a comprehensive log information when we run into a problem.
15. Reduce Maximum Start Up Connection
Reducing the maximum number of concurrent connections to the SSH daemon can be helpful against a brute-force attack. The setting of MaxStartups 4 tells the ssh server to allow only 4 users to attempt logging in at the same time.
16. Reduce Login Grace Time
When we try to remote SSH a server, the default configuration will us 2 minutes to login. If we do not do any thing or cannot successfully login within 2 minutes, SSH session will be disconnected. The default 2 minutes time to login successfully is too much. we should consider reduce it to 1 minute instead.