ssh security

dozerismydogsname · 2010-06-19 02:44:14

I've recently been introduced to ssh and have set it to only be accessed locally. I want to move away from this and let my computer be accessed by me anywhere i am. Could someone list a few features that i would want to have on my ssh server so it is extremely secure. Currently i have the following:

MaxSessions set to 3
Protocol 2
The default port changed
I have set up fail2ban to monitor the access to my ssh server

I know that it really isn't much, but what more would i need to add to make my server secure?

Daenyth · 2010-06-19 02:46:13

Disable password login and use ssh keys.

Stebalien · 2010-06-19 03:51:07

Disable X11 forwarding and root logins. You could also look into port-knocking.

dozerismydogsname · 2010-06-19 12:32:22

Daenyth wrote:

Disable password login and use ssh keys.

If i understand this correctly, this is more secure because my server will only accept keys that have been added by me right?

Stebalien wrote:

Disable X11 forwarding and root logins. You could also look into port-knocking.

I never had any use for X11, so i never bothered to install it and i've removed root login aswell. Could you please explain port-knocking?

Perry3D · 2010-06-19 12:56:15

dozerismydogsname wrote:

Daenyth wrote:
Disable password login and use ssh keys.
If i understand this correctly, this is more secure because my server will only accept keys that have been added by me right?

Yes. You generate a private key and a public key. After that, you put your public key to ~/.ssh/authorized_keys (on the server). Now you can login with your private key. It is more secure than a passwort (cause it is longer).

Stebalien · 2010-06-19 14:03:37

dozerismydogsname wrote:

Could you please explain port-knocking?

You can find a good explanation here: http://www.portknocking.org/. Port knocking is somewhat unnecessary but, if you are paranoid, adds some extra security.

dozerismydogsname · 2010-06-19 20:30:57

Stebalien wrote:

dozerismydogsname wrote:
Could you please explain port-knocking?
You can find a good explanation here: http://www.portknocking.org/. Port knocking is somewhat unnecessary but, if you are paranoid, adds some extra security.

Read up on it and it sounds really good. The only question i have now is how would i precede to doing this for my ssh server?

Stebalien · 2010-06-19 20:37:32

Instructions are here: http://www.zeroflux.org/projects/knock
You can install knockd from aur.

dozerismydogsname · 2010-06-19 22:44:16

Stebalien wrote:

Instructions are here: http://www.zeroflux.org/projects/knock
You can install knockd from aur.

So how exactly would i do this knock on a computer trying to access my computer via ssh?

Stebalien · 2010-06-20 05:09:57

dozerismydogsname wrote:

So how exactly would i do this knock on a computer trying to access my computer via ssh?

You don't. The client knocks on the server.
The point of port knocking is to dynamically open ports only when a client "knocks" on a specific sequence of ports. This way, if an attacker does not know the "knock", he/she will be unable to establish a connection with the ssh server in the first place and will not even know if it exists.

An alternative to the classic port knocking is single packet authentication. The basic idea is the same as port knocking but is slightly more secure. The project page is here: http://www.cipherdyne.org/fwknop/docs/gpghowto.html.

Read the documentation on these projects respective websites for further details; they explain things much better than I can.

dozerismydogsname · 2010-06-20 13:19:34

Stebalien wrote:

dozerismydogsname wrote:
So how exactly would i do this knock on a computer trying to access my computer via ssh?
You don't. The client knocks on the server.
The point of port knocking is to dynamically open ports only when a client "knocks" on a specific sequence of ports. This way, if an attacker does not know the "knock", he/she will be unable to establish a connection with the ssh server in the first place and will not even know if it exists.
An alternative to the classic port knocking is single packet authentication. The basic idea is the same as port knocking but is slightly more secure. The project page is here: http://www.cipherdyne.org/fwknop/docs/gpghowto.html.
Read the documentation on these projects respective websites for further details; they explain things much better than I can.

I don't think that i phrased my question right, so sorry about that. But i was asking the follownig: is there a particular command that a client would have to use to complete the "knock"?

Stebalien · 2010-06-20 15:26:11

Sequence:
The client runs a command to "knock" on the server. If the knock is correct, the server opens a predesignated port (for example, your ssh port) to the clients current ip address. The client can now establish a connection with the server. Established connections will never be severed.

Commands:

knockd's homepage wrote:

knock is the accompanying port-knock client, though telnet or netcat could be used for simple TCP knocks instead. For more advanced knocks, see sendip, packit, or hping.

fwknop's GnuPG tutorial wrote:

Now, to gain access to sshd, we execute fwknop:
[spaclient]$ fwknop -A tcp/22 --gpg-recip ABCD1234 --gpg-sign 1234ABCD \
-R -D <host>

Everything and the kitchen sink:
The manuals on their respective websites.

dozerismydogsname · 2010-06-20 15:33:23

Stebalien wrote:

Sequence:
The client runs a command to "knock" on the server. If the knock is correct, the server opens a predesignated port (for example, your ssh port) to the clients current ip address. The client can now establish a connection with the server. Established connections will never be severed.
Commands:
knockd's homepage wrote:
knock is the accompanying port-knock client, though telnet or netcat could be used for simple TCP knocks instead. For more advanced knocks, see sendip, packit, or hping.
fwknop's GnuPG tutorial wrote:
Now, to gain access to sshd, we execute fwknop:
[spaclient]$ fwknop -A tcp/22 --gpg-recip ABCD1234 --gpg-sign 1234ABCD \
-R -D <host>
Everything and the kitchen sink:
The manuals on their respective websites.

Thanks for the help, i really appreciate it.

Arch Linux

#1 2010-06-19 02:44:14

ssh security

#2 2010-06-19 02:46:13

Re: ssh security

#3 2010-06-19 03:51:07

Re: ssh security

#4 2010-06-19 12:32:22

Re: ssh security

#5 2010-06-19 12:56:15

Re: ssh security

#6 2010-06-19 14:03:37

Re: ssh security

#7 2010-06-19 20:30:57

Re: ssh security

#8 2010-06-19 20:37:32

Re: ssh security

#9 2010-06-19 22:44:16

Re: ssh security

#10 2010-06-20 05:09:57

Re: ssh security

#11 2010-06-20 13:19:34

Re: ssh security

#12 2010-06-20 15:26:11

Re: ssh security

#13 2010-06-20 15:33:23

Re: ssh security

Board footer