8

I am running the following version of GNU/Linux Debian:

cat /etc/issue

says:

Debian GNU/Linux 9

Using the following kernel:

uname -r

says:

4.9.0-2-amd64

And running the following version of OpenSSH:

apt-cache policy openssh-server | grep Installed

says:

Installed: 1:7.4p1-7

My intention is to harden a little one server's SSH security, since I need to have access from any IP, even from any VPN.

These steps I have done so far:

  1. Disabling direct root access:

    cat /etc/ssh/sshd_config | grep PermitRootLogin
    

    is set to:

    PermitRootLogin no
    
  2. Enforcing SSH protocol version 2:

    cat /etc/ssh/sshd_config | grep Protocol
    

    is set to:

    Protocol 2
    
  3. Changed port to a random one, which I will not write here, so say 12345:

    cat /etc/ssh/sshd_config | grep Port
    

    is set to:

    Port 12345
    
  4. I have punched hole in firewall for it:

    sudo iptables -A INPUT -p tcp -m tcp --dport 12345 -m comment --comment "ssh" -j ACCEPT
    
  5. I have generated a new key of 8 kilobits length (I am aware of the CPU overhead and other disadvantages of such a large key):

    ssh-keygen -t rsa -b 8192
    
  6. I have then verified the size matches:

    ll /home/fictional_user/.ssh/id_rsa*
    

    is as it should be, as well as the access rights:

    -rw------- 1 fictional_user fictional_group 6.3K Mar 16 11:53 /home/fictional_user/.ssh/id_rsa
    -rw-r--r-- 1 fictional_user fictional_group 1.4K Mar 16 11:53 /home/fictional_user/.ssh/id_rsa.pub
    
  7. I have added this key and verified there is no other:

    eval $(ssh-agent -s)
    ssh-add
    ssh-add -l
    

    results in:

    8192 SHA256:gibberish /home/fictional_user/.ssh/id_rsa (RSA)
    8192 SHA256:gibberish fictional_user@fictional_computer (RSA)
    
  8. I have imported the key to two machines, which will be maintaining the server:

    ssh-copy-id fictional_user@public_ip -p 12345
    
  9. Afterwards, I have disabled password authentication completely:

    cat /etc/ssh/sshd_config | grep PasswordAuthentication
    

    is set to:

    PasswordAuthentication no
    

Question: Did I forget on anything or this is maximum I can do?

6

There are a number of things you can do:

  • Set up a private key that uses a key-stretching algorithm to protect brute-forcing the passphrase.
  • Configure AllowUsers in sshd so only named accounts can gain access
  • Use fail2ban or fwknop to further prevent outside attacks (remember that CVE-2008-0166 caused Debian users to generate only one of 32,767 possible keys)
  • Actively monitor your machine for attacks
1

Just a few thoughts:

  • sshd supports tcpwrappers, this adds protection when your firewall is down.
  • does your file system support attributes on those public keys? Rather make them as read-only as possible.
  • consider ssh-keysigning to limit the time keys are usable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.