Set Linuxsshd to ensure remote server access security

Although SSH is designed for secure access, its functions are indeed open to intrusion. However, with a slight modification, the Linux administrator can make sshd more secure. By default, most Linux servers run the SecureShellDaemon (sshd) process through SSH for tags: Linux security Linux server security

Although SSH is designed for secure access, its functions are indeed open to intrusion. However, with a slight modification, the Linux administrator can make sshd more secure.

By default, most Linux servers run the Secure Shell Daemon (sshd) process through SSH for remote access. Linux sshd is a simple method that allows remote users and administrators to log on. Remote users can open shell sessions on your server.

The script continuously scans the internet to determine whether the server provides SSH access. Within a few minutes, these scripts can discover your server, while intruders can launch violent attacks.

In a brute-force attack, intruders attempt to log on as an existing user account on the server. Generally, he does not know what existing user accounts are. However, the root user account exists on all Linux servers. If the root user can access your server, all the intruders need is their passwords.

Intruders will also try to guess the user account. it is too dangerous to often use names such as "jsmith" or departments and functions, such as "helpdesk" or "finance, because they exist in most organizations.

Most automatic attacks will check whether your server provides sshd on the default TCP port 22. When the Linux server provides the SSH service, you should not listen to port 22 and run sshd elsewhere. If you do not provide the HTTPS service, use port 443 for sshd.

When sshd is run on port 443, many proxy servers can access sshd in real time. Similarly, if the port scanner finds that port 443 is open, intruders may try to initiate HTTPS attacks instead of SSH attacks. If port 443 is already in use, close another port.

Another problem with sshd is that Root access is allowed by default. To perform a secure startup, you must disable this function: Open the sshd configuration file (usually/etc/ssh/sshd_config) and set the PermitRootLogin line to "no ". Better yet, including the "AllowUsers" line, you can select which users can access through SSH. If the name of a user who needs SSH access to the server is too common, it should be more complicated, making it difficult for intruders to guess.

To ensure security, set PasswordAuthentication to "no" on the server because intruders cannot obtain access permissions by guessing the password. Valid users use public or private keys to access the server. The ssh-keygen command can produce public and private keys. The public key must be copied to the Linux server by using ssh-copy-id. Now you can log on through the authentication token generated by the private key signature. If the server uses the user's public key to verify the signature, you can obtain the access.

This extra security has a disadvantage. Key pairs used for SSH authentication can only be used for users with private keys. If the user wants to log on from the hotel computer, or you want to change the management during the vacation, it will be difficult. Because intruders close the door, this may also lock yourself and authorize users at the same time.