{"id":573,"date":"2010-03-19T09:03:00","date_gmt":"2010-03-19T13:03:00","guid":{"rendered":"http:\/\/linuxhostingsupport.net\/blog\/?p=573"},"modified":"2013-03-20T08:42:49","modified_gmt":"2013-03-20T12:42:49","slug":"how-to-secure-the-sshd-service","status":"publish","type":"post","link":"https:\/\/linuxhostingsupport.net\/blog\/how-to-secure-the-sshd-service","title":{"rendered":"How to secure the SSHD service?"},"content":{"rendered":"

SSH service can be secured in various ways like changing the SSH port, changing the ssh protocol,\u00a0 ssh ListenAddress, disable root login with the PermitRootLogin parameter, allowing ssh access to specific users, restricting SSH access to specific IPs<\/strong> etc. These steps will make sure SSH service on your server is secure.<\/p>\n

Edit the SSHD configuration and make the changes listed below:<\/p>\n

vi \/etc\/ssh\/sshd_config<\/strong><\/span><\/p><\/blockquote>\n

1)<\/strong> Set the default SSH port 22 to a higher value, by changing the ‘Port’ directive<\/p>\n

Port 2233<\/strong><\/span><\/p><\/blockquote>\n

2) <\/strong>To make SSH work on a secure protocol, set the ‘Protocol’ directive as<\/p>\n

Protocol 2<\/span><\/strong><\/p><\/blockquote>\n

3) <\/strong>Bind SSHD service to a specific IP of the server, which you can achieve by replacing ‘#ListenAddress’ directive to<\/p>\n

ListenAddress xx.xx.xx.xx<\/strong><\/span><\/p><\/blockquote>\n

where, xx.xx.xx.xx is the additional IP of the server and the only one which will allow you to SSH into the server.<\/p>\n

4) <\/strong>To disable root access, set ‘PermitRootLogin’ directive to ‘no’<\/p>\n

PermitRootLogin no<\/strong><\/span><\/p><\/blockquote>\n

Make sure you add an alternate SSH user on the server who have privileges to gain root access before disabling this option.<\/p>\n

5)<\/strong> To allow SSH access to specific users, add the “AllowUsers” directive at the end of the configuration<\/p>\n

AllowUsers user1 user2<\/strong><\/span><\/p><\/blockquote>\n

This will allow SSH access to users user1 and user2. You need to allow SSH access to the user who is allowed to gain root access incase root access is disabled.<\/p>\n

Save the file and restart the sshd service<\/p>\n

service sshd restart<\/strong><\/span><\/p><\/blockquote>\n

6)<\/strong> Using the TCP wrappers i.e. hosts.allow and hosts.deny<\/strong>, you can restrict SSH access to specific IPs i.e. edit \/etc\/hosts.allow and add the following<\/p>\n

sshd : yourlocalip: allow
\nsshd : all : deny<\/strong><\/span><\/p><\/blockquote>\n

“yourlocalip”<\/strong> is the one assigned by your ISP. It will restrict SSH access to your local IP only.<\/p>\n","protected":false},"excerpt":{"rendered":"

SSH service can be secured in various ways like changing the SSH port, changing the ssh protocol,\u00a0 ssh ListenAddress, disable root login with the PermitRootLogin parameter, allowing ssh access to specific users, restricting SSH access to specific IPs etc. These steps will make sure SSH service on your server is secure.
\nEdit the SSHD configuration and make the changes listed below:
\nvi \/etc\/ssh\/sshd_config
\n1) Set the default SSH port 22 to a higher value, by changing the ‘Port’ directive
\nPort 2233
\n2) To make SSH work on a secure protocol, set the ‘Protocol’ […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[760,762,1356,755,1357,761,34,757],"_links":{"self":[{"href":"https:\/\/linuxhostingsupport.net\/blog\/wp-json\/wp\/v2\/posts\/573"}],"collection":[{"href":"https:\/\/linuxhostingsupport.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/linuxhostingsupport.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/linuxhostingsupport.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/linuxhostingsupport.net\/blog\/wp-json\/wp\/v2\/comments?post=573"}],"version-history":[{"count":9,"href":"https:\/\/linuxhostingsupport.net\/blog\/wp-json\/wp\/v2\/posts\/573\/revisions"}],"predecessor-version":[{"id":2215,"href":"https:\/\/linuxhostingsupport.net\/blog\/wp-json\/wp\/v2\/posts\/573\/revisions\/2215"}],"wp:attachment":[{"href":"https:\/\/linuxhostingsupport.net\/blog\/wp-json\/wp\/v2\/media?parent=573"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/linuxhostingsupport.net\/blog\/wp-json\/wp\/v2\/categories?post=573"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/linuxhostingsupport.net\/blog\/wp-json\/wp\/v2\/tags?post=573"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}