5

What are the basic security actions I should take when securing an OpenSSH server on Windows Subsystem for Linux (WSL), especially when I am the only one that should login to this server, but can't use an IP whitelist (from various reasons)?

Also, my main concern is brute force attacks because my WSL environment is super minimal and generally has no utilities installed besides what's native and whether I use a password or some key pair, I still want to have this mechanism that after X amount of false logins, holds the user for Y amount of time and says:

Too much wrong connection tries, you can try again in 24 hours.

While I don't know the name for such mechanism, I could have one via installing CSF-LFD, but you can't install it in WSL for now as the WSL beta version doesn't include the relevant shell services required by CSF-LFD, as you could read in this discussion. so I need to find an alternative that will let me to have this mechanism which it is very important for me to have, again, whether I use a password or a key pair.

Improve this question
1
  • IP white listing us useless anyway (may offer a bit of DOS protection, but no more). If you want to make it secure then use a key that is long enough, and disable password authentication on the server.
    – ctrl-alt-delor
    Apr 11, 2017 at 21:41

3 Answers 3

Reset to default
1

Preventing brute force attacks on a SSH server is quite simple. You just have to enable Public key authentication, then disable login / password authentication. (proceed in this order)

Before following a setup guide, i recommend you to study Public key authentication mechanism, then asymmetric cryptography .

Setting up a technology you know nothing about might lead to chaos and misconfiguration, especially in the authentication field.

There is tons of setup guide on the internet, try the following keywords on google:

wsl openssh server public key auth

Improve this answer
1
  • "There is tons of setup guide on the internet, try the following keywords on google" Would recommend you link to one and summarize the steps here. I came here from Google. Back to Google I go.
    – mejdev
    Mar 14, 2022 at 14:53
0

If you want to prevent Brute Force Attacks on your OpenSSH server than you should implement Fail2Ban on it, which will ban a particular IP address for a specific amount of time, when multiple failed login attempts made.

For example, I have implemented Fail2Ban on my server and set the failed_login attempts to 5 and time_amount to ban IP address is 1200 seconds. So, if any IP address attempts five failed login attempts, than the IP address will be banned for 1200 seconds.

Reference: How to Protect SSH with Fail2Ban

Improve this answer
2
  • 1
    This topic is about Windows.
    – user155462
    Aug 23, 2017 at 8:32
  • You could write script for same in windows system or you could use this Wail2ban which is an alternative of fail2ban.
    – iamjayp
    Aug 23, 2017 at 8:50
0

Afaik any data coming into a Windows Subsystem for Linux (WSL) "Linux system", goes through the "Windows Defender Firewalll" application which suffices its own protection and generally includes BFA protection.

Another layer of protection (which might not be needed and add an extra layer of complexity and possible problems as well as defense) is either Fail2ban, CSF-LFD, or the out-of-box SSHGuard utility which I like very much and install on my Linux systems

In either case, using SSH keys is good and is a best practice. More data in:

  1. https://wiki.archlinux.org/index.php/SSH_keys
  2. https://en.wikipedia.org/wiki/Ssh-keygen
Improve this answer

You must log in to answer this question.