SSH reinforcement Manual

Author (translation) slip2008 t00ls.net

#1: Disable OpenSSH Server)

#2: Only Use SSH Protocol 2 (using sshv2)

Protocol 2

#3: Limit Users SSH Access (restrict user login)

AllowUsers root vivek jerry (root vivek jerry allowed)

DenyUsers saroj anjali foo (reject saroj anjali foo)

#4: Configure Idle Log Out Timeout Interval (Configure Idle time)

ClientAliveInterval 300
ClientAliveCountMax 0

#5: Disable. rhosts Files (Disable the. rhosts file)

IgnoreRhosts yes

#6: Disable Host-Based Authentication (Disable Basic Host Authentication)

To disable host-based authentication, update sshd_config with the following option:

HostbasedAuthentication no

#7: Disable root Login via SSH (Restrict root User Logon)

PermitRootLogin no

#8: Enable a Warning Banner (Set User Warning information)

Set a warning banner by updating sshd_config with the following line:

Banner/etc/issue

#8: Firewall SSH Port #22 (filter the ssh Port on the Firewall)

#9: Change SSH Port and Limit IP Binding (Change ssh Port and restrict IP login)

Port 300
ListenAddress 192.168.1.5
ListenAddress 202.54.1.5

A better approach to use proactive approaches scripts such as fail2ban or denyhosts (see below ).

#10: Use Strong SSH Passwords and Passphrase (Use a Strong host password, you do not need to know)

#11: Use Public Key Based Authentication (Based on Public/private keys for Authentication)

Use public/private key pair with password protection for the private key. See how to use RSA and DSA key based authentication. Never ever use passphrase free key (passphrase key less) login.

#12: Use Keychain Based Authentication (I have never used this)

#13: Chroot SSHD (Lock Down Users To Their Home Directories) (similar To the chroot configuration)

#14: Use TCP Wrappers (you should be familiar with using TCP Wrappers)

Sshd: 192.168.1.2 172.16.23.12

#15: Disable Empty Passwords (Disable the Empty PASSWORD Command Option)

PermitEmptyPasswords no

#16: Thwart SSH Crackers (Brute Force Attack) (multiple N software that prevents Brute-Force cracking)
#17: Rate-limit Incoming Port #22 Connections (limit 22 Port Connections)
#18: Use Port Knocking (this is a good software)
#19: Use Log Analyzer (using Log analysis tools)
LogLevel INFO

#20: Patch OpenSSH and Operating Systems (the most important one is to promptly update patches and Operating Systems)
Bytes ---------------------------------------------------------------------------------------------------------
PS: If you change the ssh port, selinux may be affected. Simply enable it and then disable it. To prevent accidents, you can try to open multiple ports when the 22 port is retained. In the Basic Public/private key authentication method, when you use the public key generated by putty (windows Platform), run the serverssh-keygen-if test command. pub (putty's public key)> opssh. pub (the Public Key recognized by linux) is converted. Otherwise, server _ refused_our_key will appear.