9

I am running the following version of GNU/Linux Debian:

cat /etc/issue

says:

Debian GNU/Linux 9

Using the following kernel:

uname -r

says:

4.9.0-2-amd64

And running the following version of OpenSSH:

apt-cache policy openssh-server | grep Installed

says:

Installed: 1:7.4p1-7

My intention is to harden a little one server's SSH security, since I need to have access from any IP, even from any VPN.

These steps I have done so far:

  1. Disabling direct root access:

    cat /etc/ssh/sshd_config | grep PermitRootLogin

    is set to:

    PermitRootLogin no

  2. Enforcing SSH protocol version 2:

    cat /etc/ssh/sshd_config | grep Protocol

    is set to:

    Protocol 2

  3. Changed port to a random one, which I will not write here, so say 12345:

    cat /etc/ssh/sshd_config | grep Port

    is set to:

    Port 12345

  4. I have punched hole in firewall for it:

    sudo iptables -A INPUT -p tcp -m tcp --dport 12345 -m comment --comment "ssh" -j ACCEPT

  5. I have generated a new key of 8 kilobits length (I am aware of the CPU overhead and other disadvantages of such a large key):

    ssh-keygen -t rsa -b 8192

  6. I have then verified the size matches:

    ll /home/fictional_user/.ssh/id_rsa*

    is as it should be, as well as the access rights:

    -rw------- 1 fictional_user fictional_group 6.3K Mar 16 11:53 /home/fictional_user/.ssh/id_rsa
-rw-r--r-- 1 fictional_user fictional_group 1.4K Mar 16 11:53 /home/fictional_user/.ssh/id_rsa.pub

  7. I have added this key and verified there is no other:

    eval $(ssh-agent -s)
ssh-add
ssh-add -l

    results in:

    8192 SHA256:gibberish /home/fictional_user/.ssh/id_rsa (RSA)
8192 SHA256:gibberish fictional_user@fictional_computer (RSA)

  8. I have imported the key to two machines, which will be maintaining the server:

    ssh-copy-id fictional_user@public_ip -p 12345

  9. Afterwards, I have disabled password authentication completely:

    cat /etc/ssh/sshd_config | grep PasswordAuthentication

    is set to:

    PasswordAuthentication no

Question: Did I forget on anything or this is maximum I can do?

LinuxSecurityFreak
  • 1,562
  • 2
  • 18
  • 32

2 Answers2

6

There are a number of things you can do:

  • Set up a private key that uses a key-stretching algorithm to protect brute-forcing the passphrase.
  • Configure AllowUsers in sshd so only named accounts can gain access
  • Use fail2ban or fwknop to further prevent outside attacks (remember that CVE-2008-0166 caused Debian users to generate only one of 32,767 possible keys)
  • Actively monitor your machine for attacks
Xiong Chiamiov
  • 9,384
  • 2
  • 34
  • 76
  • 1
    @Vlastimil along with those, how about ssh with 2-factor authentication? It uses the google Authenticator app. Check it out: https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-two-factor-authentication – nd510 Mar 16 '17 at 15:54
1

Just a few thoughts:

  • sshd supports tcpwrappers, this adds protection when your firewall is down.
  • does your file system support attributes on those public keys? Rather make them as read-only as possible.
  • consider ssh-keysigning to limit the time keys are usable.
bbaassssiiee
  • 363
  • 1
  • 11