DEV Community

Cover image for Advanced SSH Security Practices in Red Hat Linux
Alexand
Alexand

Posted on

Advanced SSH Security Practices in Red Hat Linux

#cloudwhistler #ssh #linux #redhat

Securing SSH is crucial for protecting servers, cloud instances, and remote systems from unauthorized access. Here are the best security practices to follow when using SSH in Red Hat Linux.

1. Disable Root Login

Allowing direct SSH access for the root user is risky. Disable it to force users to log in as a regular user first and then escalate privileges.

How to Disable Root Login:

Edit the SSH configuration file:

sudo nano /etc/ssh/sshd_config
Enter fullscreen mode Exit fullscreen mode

Find the line:

PermitRootLogin yes
Enter fullscreen mode Exit fullscreen mode

Change it to:

PermitRootLogin no
Enter fullscreen mode Exit fullscreen mode

Save the file, then restart SSH:

sudo systemctl restart sshd
Enter fullscreen mode Exit fullscreen mode

2. Use SSH Keys Instead of Passwords

Passwords can be guessed or stolen, but SSH keys provide stronger authentication.

How to Set Up SSH Key Authentication:

  • Generate SSH keys on your local machine: 
   ssh-keygen -t rsa -b 4096
Enter fullscreen mode Exit fullscreen mode
  • Copy the public key to the remote server: 
   ssh-copy-id username@server-ip
Enter fullscreen mode Exit fullscreen mode
  • Ensure the keys are in the correct location: 
   ls ~/.ssh/authorized_keys
Enter fullscreen mode Exit fullscreen mode
  • Disable password authentication in SSH config: 
   sudo nano /etc/ssh/sshd_config
Enter fullscreen mode Exit fullscreen mode

Change:

   PasswordAuthentication yes
Enter fullscreen mode Exit fullscreen mode

To:

   PasswordAuthentication no
Enter fullscreen mode Exit fullscreen mode

Restart SSH:

   sudo systemctl restart sshd
Enter fullscreen mode Exit fullscreen mode

- Change the Default SSH Port

Attackers often target port 22, the default SSH port. Changing it can reduce automated attacks.

How to Change SSH Port:

Edit the SSH config file:

sudo nano /etc/ssh/sshd_config
Enter fullscreen mode Exit fullscreen mode

Find the line:

Port 22
Enter fullscreen mode Exit fullscreen mode

Change it to another number, such as 2222:

Port 2222
Enter fullscreen mode Exit fullscreen mode

Save the file and restart SSH:

sudo systemctl restart sshd
Enter fullscreen mode Exit fullscreen mode

Now, connect using the new port:

ssh -p 2222 username@server-ip
Enter fullscreen mode Exit fullscreen mode

- Use Fail2Ban to Block Repeated Login Attempts

Fail2Ban helps prevent brute-force attacks by blocking IPs that try too many incorrect logins.

How to Install and Configure Fail2Ban:

  • Install Fail2Ban: 
   sudo yum install fail2ban -y
Enter fullscreen mode Exit fullscreen mode
  • Create a configuration file: 
   sudo nano /etc/fail2ban/jail.local
Enter fullscreen mode Exit fullscreen mode
  • Add the following rules: 
   [sshd]
   enabled = true
   port = ssh
   filter = sshd
   maxretry = 3
   bantime = 600
Enter fullscreen mode Exit fullscreen mode
  • Restart Fail2Ban: 
   sudo systemctl start fail2ban
Enter fullscreen mode Exit fullscreen mode

5. Limit SSH Access to Specific IPs

Restrict SSH access to trusted IP addresses to prevent unwanted login attempts.

How to Limit SSH Access:

Edit the SSH configuration file:

sudo nano /etc/ssh/sshd_config
Enter fullscreen mode Exit fullscreen mode

Add this line:

AllowUsers username@your-trusted-ip
Enter fullscreen mode Exit fullscreen mode

Restart SSH:

sudo systemctl restart sshd
Enter fullscreen mode Exit fullscreen mode

6. Use Two-Factor Authentication (2FA) for SSH

Adding 2FA makes SSH logins even more secure.

How to Set Up 2FA:

  • Install the Google Authenticator PAM module: 
   sudo yum install google-authenticator -y
Enter fullscreen mode Exit fullscreen mode
  • Configure authentication: 
   google-authenticator
Enter fullscreen mode Exit fullscreen mode

Follow the on-screen instructions.

  • Edit the SSH PAM configuration: 
   sudo nano /etc/pam.d/sshd
Enter fullscreen mode Exit fullscreen mode

Add:

   auth required pam_google_authenticator.so
Enter fullscreen mode Exit fullscreen mode
  • Modify the SSH configuration: 
   sudo nano /etc/ssh/sshd_config
Enter fullscreen mode Exit fullscreen mode

Add:

   ChallengeResponseAuthentication yes
Enter fullscreen mode Exit fullscreen mode
  • Restart SSH: 
   sudo systemctl restart sshd
Enter fullscreen mode Exit fullscreen mode

Summary

By applying these advanced security practices, you can significantly reduce security risks when using SSH in Red Hat Linux. Whether you're managing cloud infrastructure, handling servers, or working remotely, securing SSH is a critical step in maintaining a safe computing environment.

Top comments (0)