Securing SSH Access: A Step-by-Step Guide
In this FAQ, we will explore several solutions to secure your SSH access.
Using Secure Passwords:
One of the best practices to enhance security across your accesses is to use complex passwords.
Here are some password guidelines:
- Never use the same password for different accesses.
- Use at least 10 characters.
- Include at least one uppercase letter.
- Include at least one special character.
Changing the SSH Port:
To make SSH access more challenging, consider changing the default port of the SSH service.
First, edit the file /etc/ssh/sshd_config (replace XXXX with the desired port):
/etc/ssh/sshd_config
#Port 22
Port XXXX
Then, restart your SSH service:
#service ssh restart
If you’re using Putty to connect, simply adjust the port in the connection settings. For Linux users, utilize the following command to connect:
ssh root@YOUR_IP -p XXXX
Changing the SSH port also changes the SFTP port.
Disabling root SSH Access:
During an attack, the root user is often the primary target due to its extensive server access. Hence, it’s essential to restrict root access from external sources. Users should connect to the server with another account before accessing the root account.
Create a new user for SSH access (replace USER with your username):
adduser USER
Modify the file /etc/ssh/sshd_config:
/etc/ssh/sshd_config
#PermitRootLogin yes
PermitRootLogin no
AllowUsers USER
Then, restart your SSH service:
#service ssh restart
To connect via Putty, adjust the username in the connection settings. For Linux users, use the following command:
ssh USER@YOUR_IP -p XXXX
Once connected with the alternate user, you can switch to the root user using the following command:
su -
Installing Fail2ban:
Fail2ban detects suspicious SSH connection attempts and blocks them.
To install Fail2ban, execute the following command:
apt-get install fail2ban