[SOLVED] Remote SSH - What to consider?

M_ller · 2011-03-07 16:02:43

Hey fellow archers.

I am currently interested in having access to my desktop PC while being on the fly.
I am however very uncertain what precautions I should take and how it should all work. I'd like to use SSH for this, but what should I do to make it secure since it would be running remotely?

Marcus

Last edited by M_ller (2011-03-07 21:34:46)

lifeafter2am · 2011-03-07 16:05:27

M_ller wrote:

Hey fellow archers.
I am currently interested in having access to my desktop PC while being on the fly.
I am however very uncertain what precautions I should take and how it should all work. I'd like to use SSH for this, but what should I do to make it secure since it would be running remotely?
Marcus

Use a non-standard port for your SSH server. Use key-based authentication. Do not allow root logins.

https://wiki.archlinux.org/index.php/Using_SSH_Keys

Last edited by lifeafter2am (2011-03-07 16:05:47)

M_ller · 2011-03-07 16:35:54

lifeafter2am wrote:

M_ller wrote:
Hey fellow archers.
I am currently interested in having access to my desktop PC while being on the fly.
I am however very uncertain what precautions I should take and how it should all work. I'd like to use SSH for this, but what should I do to make it secure since it would be running remotely?
Marcus
Use a non-standard port for your SSH server. Use key-based authentication. Do not allow root logins.
https://wiki.archlinux.org/index.php/Using_SSH_Keys

Thanks!
Setting up the key-based auth. was really easy and works perfectly!
Should I create a new user for my ssh logins etc, or how can I disable root logins?

- Marcus

EDIT: It is all working nicely, however if I don't have the SSH key file, it just asks for the password of the specified user, is it possible to disable that, so they can only connect when having the file?

Last edited by M_ller (2011-03-07 16:45:13)

skunktrader · 2011-03-07 16:43:45

M_ller wrote:

Should I create a new user for my ssh logins etc, or how can I disable root logins?
- Marcus

Edit /etc/ssh/sshd_config and make sure that PermitRootLogin is set to no

Foucault · 2011-03-07 16:44:34

M_ller wrote:

Should I create a new user for my ssh logins etc, or how can I disable root logins?
- Marcus

No need to create a new user. Just disable root access. Edit /etc/ssh/sshd_config and locate the line that says "PermitRootLogin" and ensure its set to no.

Kosmonavt · 2011-03-07 16:56:22

Also you can set this in /etc/ssh/sshd_config to prevent from password brute forcing by turning password access off:

PasswordAuthentication no

Basically, that's all. There are more methods of securing SSH, but these aren't very common and such efficient:

1) fail2ban. After some sequental authentication failures it blocks this IP. Use with caution!
2) opening ssh port only after some manipulations. Using iptables and some more utils, you can make ssh available only after sending packets on "secret" ports.

M_ller · 2011-03-07 17:08:33

Thanks for all your help.
However, when PermitRootLogin is set to no, I can still do "su" within in SSH'd terminal and then type in the root password, and then be logged in as root.
Am I supposed to be able to do that?

When I try to use my external IP to connect to my SSH server, it gives me this error:
xxxxx: no route to host

I guess that is just a router forwarding problem?

EDIT: And what does "UseLogin no" mean in the sshd_config file?

Last edited by M_ller (2011-03-07 17:10:14)

pyther · 2011-03-07 17:10:25

fail2ban is really nice and it will only ban for 15 minutes because usually the targets are random and not targeted. Therefore if you accidentally ban yourself can wait through the timeout.

parmegv · 2011-03-07 17:27:38

Hello,

I am trying to set up my SSH server but I cannot manage to do it well. In fact, I have this post in order to solve it. Could you please tell me what do you see in my sshd_config file anormal? Or just simply post your file letting me to compare them myself?

Thank you very much

jasonwryan · 2011-03-07 17:33:29

parmegv: you have managed to both cross-post and thread hijack: https://wiki.archlinux.org/index.php/Fo … _Hijacking

Please do not do this again.

parmegv · 2011-03-07 17:55:55

jasonwryan wrote:

parmegv: you have managed to both cross-post and thread hijack: https://wiki.archlinux.org/index.php/Fo … _Hijacking
Please do not do this again.

Understood. Should I edit that message, or just send a private message to the one I am interested in?

Arch Linux

#1 2011-03-07 16:02:43

[SOLVED] Remote SSH - What to consider?

#2 2011-03-07 16:05:27

Re: [SOLVED] Remote SSH - What to consider?

#3 2011-03-07 16:35:54

Re: [SOLVED] Remote SSH - What to consider?

#4 2011-03-07 16:43:45

Re: [SOLVED] Remote SSH - What to consider?

#5 2011-03-07 16:44:34

Re: [SOLVED] Remote SSH - What to consider?

#6 2011-03-07 16:56:22

Re: [SOLVED] Remote SSH - What to consider?

#7 2011-03-07 17:08:33

Re: [SOLVED] Remote SSH - What to consider?

#8 2011-03-07 17:10:25

Re: [SOLVED] Remote SSH - What to consider?

#9 2011-03-07 17:27:38

Re: [SOLVED] Remote SSH - What to consider?

#10 2011-03-07 17:33:29

Re: [SOLVED] Remote SSH - What to consider?

#11 2011-03-07 17:55:55

Re: [SOLVED] Remote SSH - What to consider?

Board footer