Securing SSH

Introduction

SSH(Secure Shell) provides a secure way of logging into a remote server. On many relases, the ssh service is ready to use without configuration. But it use a general settings for most circumstances.

This article introduces some useful tips to securing a ssh service against attacks.

Setup Openssh Server

  1. Update Server Configuration(/etc/ssh/sshd_config)

    # Disable protocol 1
    Protocol 2
    # Disable password auth
    PasswordAuthentication no
    # Use a non-standard port
    Port 2345
    
  2. Setup firewall

    $ firewall-cmd --add-port 2345/tcp
    $ firewall-cmd --add-port 2345/tcp --permanent
    
  3. Setup Selinux label

    $ semanage port -a -t ssh_port_t -p tcp 2345
    

Setup Client

# Client ~/.ssh/config
Host myserver
HostName 72.232.194.162
        User bob
        Port 2345

References

https://wiki.centos.org/HowTos/Network/SecuringSSH