|
Are you Secured with Secure Shell? |
Keep your sshd secure. I was used to setup sshd with default parameters, but that’s a mistake.Default installation of sshd lets you login as root and allows password authentication, and that’s not much safer than having telnet available.
Nothing is 100% secure, but a few changes will keep your system a bit less unsecure.
Make sure you disable root login, password authentication, and that your connection is made using a RSA or DSA key.
Click the Read More to see my sample setup.
Steps and Guidelines
. Create a user to login other than root.
. Create a key for that user, in my case I will create a RSA key
. #su -
. #ssh-keygen –t rsa
. Make sure you add a passphrase.
. So both files private -> /home//.ssh/id_rsa and /home//.ssh/id_rsa.pub will be created.
. Copy the /home//.ssh/id_rsa.pub into /home//.ssh/authorized_keys
. Change permissions
.chmod 700 /home//.ssh
.chmod 600 /home/.ssh/authorized_keys
. Get your id_rsa file and copy it to your windows or linux client
. If you’re using putty make sure you use the puttygen so it can be saved as as ppk.
. Further using putty, change the Encryption cipher to AES and set the authentication file to the newly created ppk key.
At your server edit your sshd_config:
##################################
# the default SSH port is 22, you could alter it if necessary
Port 22
# accept version 2 keys only
Protocol 2
# NEVER allow root to login directly over the net
PermitRootLogin no
StrictModes yes
MaxAuthTries 3
# enable public-key authentication
RSAAuthentication no
PubkeyAuthentication yes
# securing your OpenSSH
# do not use host-based authentication for security reason
RhostsRSAAuthentication no
HostbasedAuthentication no
IgnoreUserKnownHosts yes
PermitEmptyPasswords no
# do not allow telnet-type login for security reason
ChallengeResponseAuthentication no
PasswordAuthentication no
X11Forwarding yes
X11DisplayOffset 10
#################################################
After all this, restart your sshd daemon and try login...
For further troubleshooting try and check your syslog(messages) or secure logs. |