How to secure and protect SSH Server

To secure and protect SSH Server

Secure Shell (SSH) connects local or remote Linux servers to transfer files and backups using scp or sftp. The servers connect over secured network on secured channel.

DenyHosts

Deny hosts blocks the IP address and prevents access to the server. It is written in python language. Deny hosts is executede by the Linux system administrator to monitor the user logs failed attempts called as brute force attacks and dictionary based attacks.

Features

• Sending email notification
• Tracks all failed login attempts by user and offending host
• Maintains valid and invalid failed user login attempts.

[root@linuxhelp~]# yum install &ndash enablerepo=epel denyhosts
Loaded plugins: fastestmirror, refresh-packagekit, security
Setting up Install Process
Loading mirror speeds from cached hostfile
* base: centos.webwerks.com
* epel: ftp.cuhk.edu.hk
* extras: centos.webwerks.com
* updates: centos.webwerks.com
Resolving Dependencies
-->  Running transaction check
--->  Package denyhosts.noarch 0:2.6-20.el6 will be installed
&hellip 
&hellip 
&hellip 
Installed:
denyhosts.noarch 0:2.6-20.el6
Complete!

Open the hosts.allow configuration file.

[root@linuxhelp~]# vim /etc/hosts.allow

Add the client IP in this file.

sshd:   192.168.5.224

[root@linuxhelp~]# vim /etc/denyhosts.conf

Edit the file as per your requirement or proceed with the default configuration.
Once the configuration is complete, restart the service.

[root@linuxhelp ~]# service denyhosts restart
[root@linuxhelp ~]# tail -f /var/log/secure
Mar 21 12:00:36 linuxhelp sshd[26591]: pam_unix(sshd:session): session opened for user user1 by (uid=0)
Mar 21 12:00:43 linuxhelp sshd[26594]: Received disconnect from 192.168.5.224: 11: disconnected by user
Mar 21 12:00:43 linuxhelp sshd[26591]: pam_unix(sshd:session): session closed for user user1
Mar 21 12:25:44 linuxhelp sshd[26221]: Received disconnect from 192.168.5.69: 11: disconnected by user
Mar 21 13:12:35 linuxhelp sshd[27269]: Accepted password for user1 from 192.168.5.224 port 36623 ssh2
Mar 21 13:12:35 linuxhelp sshd[27269]: pam_unix(sshd:session): session opened for user user1 by (uid=0)
Mar 21 13:12:49 linuxhelp sshd[27295]: refused connect from 192.168.5.69 (192.168.5.69)

Now login from 192.168.5.224 IP, you can access through SSH. If you access from other IP, the following error appears.

[root@linuxhelp ~]# ssh user1@192.168.5.220
ssh_exchange_identification: Connection closed by remote host

To allow the respective IP without blocking from any filters, enter the IP in /var/lib/denyhosts/allowed-hosts.

[root@linuxhelp ~]# vim /var/lib/denyhosts/allowed-hosts

Fail2Ban

Fail2Ban is an intrusion prevention open source. Fail2Ban scans var/log/auth.log, /var/log/secure, /var/log/pwdfail and checks for intruders. It bans the IP address for particular period of time. It is written in Python language.

Features

• Monitoring log files
• Runs scripts
• Highly configurable.

Run the following command to install fail2ban.

[root@linuxhelp ~]# yum install fail2ban
Loaded plugins: fastestmirror, refresh-packagekit, security
Setting up Install Process
Loading mirror speeds from cached hostfile
* base: centos.excellmedia.net
* epel: ftp.cuhk.edu.hk
* extras: centos.excellmedia.net
* updates: centos.excellmedia.net
Resolving Dependencies
-->  Running transaction check
--->  Package fail2ban.noarch 0:0.9.3-1.el6.1 will be installed
&hellip 
&hellip 
&hellip 
Installed:
fail2ban.noarch 0:0.9.3-1.el6.1
Complete!

Rename the original file as jail.local

[root@linuxhelp ~]# cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Edit the jail.local file to allow IP and IP-tables.

[root@linuxhelp ~]# vim /etc/fail2ban/jail.local

Add the following lines into the config file.

ignoreip = 192.168.5.224

[ssh-iptables]
enable=true
filter=sshd
action=iptables[name=SSH, port=ssh, protocol=tcp]
logpath=/var/log/secure
maxretry=3

Restart the service and then view the log file.

[root@linuxhelp ~]# service fail2ban restart
[root@linuxhelp ~]# cat /var/log/secure | grep ' Failed password'  | sort | uniq -c
1 Mar 21 11:12:53 linuxhelp sshd[25999]: Failed password for root from 192.168.5.69 port 34989 ssh2
1 Mar 21 11:12:59 linuxhelp sshd[25999]: Failed password for root from 192.168.5.69 port 34989 ssh2
1 Mar 21 11:14:47 linuxhelp sshd[26051]: Failed password for root from 192.168.5.224 port 56295 ssh2

If you try to login from other IP except the IP in config file, the following error appears.

[root@linuxhelp ~]# ssh user1@192.168.5.220
ssh:connect to host 192.168.5.220: Connection refused

Display SSH Banner

Display SSH Banner helps to display welcome messages to authorised users and the ssh warning messages to unauthorised users.

To display contents before login, edit issue.net file

[root@linuxhelp ~]# vim /etc/issue.net

Just enable the line in sshd_config file, starting with Banner and restart the sshd service.

[root@linuxhelp ~]# vim /etc/ssh/sshd_config
[root@linuxhelp ~]# service sshd restart

To display banner after logged into machine, add the contents in motd file.

[root@linuxhelp ~]# vim /etc/motd

Disable Root Login

SSH remote logins are pre-configured, the users can log in and gain root access directly. The best option is to disable root login and log into different account. sudo or su commands can be used to gain root access when it is required.

[root@linuxhelp ~]# vim /etc/ssh/sshd_config

In this file uncomment the permit root login line and give no to value and restart the service

[root@linuxhelp ~]# service sshd restart

SSH Passwordless Login

It creates a trust between two Linux servers without asking for a password which makes file transfer easier.

Features

• File transfer
• Remote scripting execution
• Remote script management
• Remote automated backups.

root@linuxhelp:~# ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
&hellip 
&hellip 
&hellip 
Key will be generated!!!

Copy the generated key to the server machine

root@linuxhelp:~# ssh-copy-id root@192.168.5.220

Once the key is copied to server. it will not ask for the password.

root@linuxhelp:~# ssh root@192.168.5.220

Now the server machine is logged in without using the password.