3

I ask this for security purposes only (my website). I use PuTTY to connect to my server through SSH, and today I found out it is pretty easy to attempt connection to my server; you simply type my address in the hostname field and you can go ahead and try to connect.

I got curious and tried this on many sites; some did allow me to attempt login, but with most I got connection refused or something of that sort. I even got their IP through ping and the result was the same. I would like to know how exactly are they(the admins) log into their servers? are some servers SSH-less? maybe there is a hidden IP that they use?

Improve this question

4 Answers 4

Reset to default
2

Most ssh servers these days should be configured to allow only public key based authentication, not password based authentication. Allowing password based authentication is seen by automatic scanner as an invitation to guess passwords.

Depending on your ssh server software version, you might be using outdated crypto. You should disable bad crypto and switch to ed25519 keys. The latest pre-release version of putty supports them.

You can use this scanner to check your server: discovery.cryptosense.com

Improve this answer
2

A handful of suggestions:

  • Make sure you are running the most current version of your SSH server.
  • Change the default port to a high port see /etc/ssh/sshd_config in most cases
  • Configure it so root cannot login directly
  • If possible only allow public key based authentication, disable other auths
  • If it's an option leverage your firewall (IPTables) to restrict access to your SSH Daemon from just a few IP addresses (if this is an option).
  • Verify your allowed ciphers with nmap -p --script ssh2-enum-algos
  • If you must have access to this system globally consider the use of a VPN. You could then require the VPN connection be established first and then an SSH session after the VPN is established. The advantage to this is it adds a second layer of protection reducing the odds that a vulnerability will exist in both layers at the same time.
  • Use separate accounts from humans and software. Separate application accounts for software accessing your systems is a good thing.
  • Remote logging is helpful if your system does get compromised
  • Use Fail2Ban
  • Setup log monitoring to alert you when unusual behavior occurs.
  • Additionally follow normal security practices to keep the underlying Operating System secure.
  • Make sure you are notified when new realases to your SSH daemon are released.
  • Be disciplined about verifying security of your systems on a regular basis.
  • If possible automate aspects of security tests such they alert you if your systems are ever vulnerable to known problems.

Keep in mind that just enabling public key authentication will not protect your system from some types of ssh daemon vulnerabilities.

Note: If you are changing the port on a remote system don't just change the port and hope for the best. Enable the high port such that both the default port 22 and the new port are both working at the same time. Test it and make sure your firewall rules are enabled appropriately. Once everything works on both ports, then disable the default port and test again to make sure it's off. Likewise if you are using Fail2Ban make sure you adjust the SSH listening port in Fail2Ban too.

Improve this answer
2
  • How does changing the port add to security? I would assume that anyone being able to guess a non-trivial password or otherwise successfully "hack" a ssh server is capable of performing a port scan. Apart from that: Good summary.
    – Thomas
    Commented Nov 5, 2016 at 18:22
  • In the past tools exploiting ssh vulnerabilities on a large scale (like across the entire IPv4 address space) only target the default port (TCP/22). By not having your SSH daemon listening on that port you are subject to fewer attack attempts. Likewise Many projects like Shodan.io or scans.io won't list your IP as having SSH open to the world if it's not running on a default port which they report on. It's not that someone can't do a port scan so much as if they are ONLY looking for insecure SSH servers they are more likely to find and attack you on a default port.
    – Trey Blalock
    Commented Nov 5, 2016 at 18:25
1

Professional or commercial servers normally run behind a reverse proxy that only allows traffic to the HTTP or HTTPS port (or SMTP/IMAP/POP for mail servers). So even if they have a ssh server for administrative purposes, you cannot reach it directly from internet.

If they are localy hosted (private datacenter inside the organization) administration is only possible from a LAN, that normally only contains servers and staff people. You have also often a VPN access to allow distant administration. But even in that case administrators have to:

  • connect to the VPN
  • ssh to the internal address

At least that protects them from port scans and script kiddies. Only the reverve proxies and VPN access are directly reachable. This adds a lot of security, because a reverse proxy is simple software that is expected to contains much less security implementation problems than a web server, and the machine that supports them have all unnecessary ports closed and unnecessary server software desactivated or removed. And the VPN access is also highly secured.

Improve this answer
0

The port that SSH is listening on can be changed in the configuration which can be done to reduce automatic scanning and brute force attempts. The SSH port can also be whitelisted to only allow trusted IP addresses to connect. https://wiki.centos.org/HowTos/Network/SecuringSSH

More advanced security methods such as port knocking can also be used. Port knocking is when the port is hidden and only revealed when the server receives a certain pattern of network traffic. https://www.digitalocean.com/community/tutorials/how-to-use-port-knocking-to-hide-your-ssh-daemon-from-attackers-on-ubuntu

Some servers, such as those running Windows would be unlikely to be running an SSH server at all and would normally use RDP instead for administration.

Improve this answer
4
  • 1
    Changing the SSH port is just security through obscurity, I would not bother to do this at all.
    – mebmc
    Commented Nov 5, 2016 at 16:54
  • Using SSH Keys and turning off Password Authentication is much more important than trying to hide the port.
    – mebmc
    Commented Nov 5, 2016 at 16:55
  • Should I bother with the port knocking?
    – user1938653
    Commented Nov 5, 2016 at 18:10
  • 2
    No, this is a lot of effort for little benefit. Using SSH Keys with no Password Authentication is the most important thing you can do and should be the first thing you do to secure SSH.
    – mebmc
    Commented Nov 5, 2016 at 18:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .