Securing SSH with Best Practices in Linux

Securing SSH in Linux: Best Practices for Enhanced Security

SSH (Secure Shell) is a critical tool for managing Linux systems remotely. However, improper configuration can expose your server to security risks. In this guide, we’ll answer key questions about hardening SSH access, from disabling root logins to enforcing idle timeouts. Let’s dive in!

1. Why and How to Disable Root Login via SSH

Allowing direct root access via SSH is risky. Attackers often target the root account, and a successful breach grants them full system control.

Steps to Disable Root Login:

1. Open the SSH configuration file:

   sudo nano /etc/ssh/sshd_config
   

2. Find the line #PermitRootLogin yes and change it to:

   PermitRootLogin no
   

3. Save the file and restart SSH:

   sudo systemctl restart sshd
   

Best Practices:

• Create a non-root user with sudo privileges for administrative tasks.
• Use sudo -i or su - to switch to root only when necessary.

2. Enabling Key-Based Authentication for SSH

Passwords can be brute-forced. Key-based authentication uses cryptographic keys, which are more secure.

Steps to Set Up SSH Keys:

1. Generate a Key Pair (on your local machine):

   ssh-keygen -t ed25519 -C "your_email@example.com"
   

   (Use -t rsa -b 4096 if your system doesn’t support Ed25519.)

2. Copy the Public Key to the Server:

   ssh-copy-id user@your_server_ip
   

3. Disable Password Authentication (on the server):
   Edit /etc/ssh/sshd_config and set:

   PasswordAuthentication no
   PubkeyAuthentication yes
   

4. Restart SSH:

   sudo systemctl restart sshd
   

Important Notes:

• Set strict permissions for ~/.ssh (700) and authorized_keys (600).
• Store private keys securely and never share them.

3. Disabling Empty Passwords for SSH Users

Accounts with empty passwords are a glaring security hole. Here’s how to close it:

1. Edit /etc/ssh/sshd_config and ensure:

   PermitEmptyPasswords no
   

2. Also, disable challenge-response authentication:

   ChallengeResponseAuthentication no
   

3. Restart SSH.

Bonus Tip: Regularly audit user accounts with awk -F: '($2 == "") {print $1}' /etc/shadow to find empty passwords.

4. Limiting Authentication Attempts to Prevent Brute Force Attacks

Reducing login attempts slows down brute-force attacks.

Configure SSH to Limit Retries:

1. In /etc/ssh/sshd_config, add:

   MaxAuthTries 3
   LoginGraceTime 60
   

   • MaxAuthTries 3: Allows 3 attempts per connection.
   • LoginGraceTime 60: Closes the connection after 60 seconds of inactivity.

2. Restart SSH.

Advanced Protection with Fail2Ban:
Install Fail2Ban to dynamically block IPs with repeated failed attempts:

sudo apt install fail2ban  # Debian/Ubuntu
sudo yum install fail2ban  # RHEL/CentOS

5. Setting Up an Idle Timeout for SSH Sessions

Inactive SSH sessions can be hijacked. Enforce an idle timeout to mitigate this.

Server-Side Configuration:

1. Edit /etc/ssh/sshd_config and add:

   ClientAliveInterval 300   # 5 minutes
   ClientAliveCountMax 0      # Terminate session after inactivity
   TCPKeepAlive yes
   

2. Restart SSH.

Client-Side Fallback (Optional):
Set a timeout in the user’s shell profile (e.g., ~/.bashrc):

export TMOUT=300  # Session terminates after 5 minutes of inactivity

Conclusion

Securing SSH is a cornerstone of Linux system hardening. By:

• Disabling root login,
• Enforcing key-based authentication,
• Blocking empty passwords,
• Limiting authentication attempts, and
• Setting idle timeouts,

you significantly reduce your attack surface. Always test configurations in a safe environment and keep a backup SSH session active during changes. For added security, consider changing the default SSH port (22) and using firewall rules (e.g., ufw or iptables) to restrict access. Stay vigilant, and keep your systems safe!

Found this helpful? Share it with your network!