5

What are the basic security actions I should take when securing an OpenSSH server on Windows Subsystem for Linux (WSL), especially when I am the only one that should login to this server, but can't use an IP whitelist (from various reasons)?

Also, my main concern is brute force attacks because my WSL environment is super minimal and generally has no utilities installed besides what's native and whether I use a password or some key pair, I still want to have this mechanism that after X amount of false logins, holds the user for Y amount of time and says:

Too much wrong connection tries, you can try again in 24 hours.

While I don't know the name for such mechanism, I could have one via installing CSF-LFD, but you can't install it in WSL for now as the WSL beta version doesn't include the relevant shell services required by CSF-LFD, as you could read in this discussion. so I need to find an alternative that will let me to have this mechanism which it is very important for me to have, again, whether I use a password or a key pair.

1
  • IP white listing us useless anyway (may offer a bit of DOS protection, but no more). If you want to make it secure then use a key that is long enough, and disable password authentication on the server. – ctrl-alt-delor Apr 11 '17 at 21:41
1

Preventing brute force attacks on a SSH server is quite simple. You just have to enable Public key authentication, then disable login / password authentication. (proceed in this order)

Before following a setup guide, i recommend you to study Public key authentication mechanism, then asymmetric cryptography .

Setting up a technology you know nothing about might lead to chaos and misconfiguration, especially in the authentication field.

There is tons of setup guide on the internet, try the following keywords on google:

wsl openssh server public key auth

0

If you want to prevent Brute Force Attacks on your OpenSSH server than you should implement Fail2Ban on it, which will ban a particular IP address for a specific amount of time, when multiple failed login attempts made.

For example, I have implemented Fail2Ban on my server and set the failed_login attempts to 5 and time_amount to ban IP address is 1200 seconds. So, if any IP address attempts five failed login attempts, than the IP address will be banned for 1200 seconds.

Reference: How to Protect SSH with Fail2Ban

2
  • 1
    This topic is about Windows. – user155462 Aug 23 '17 at 8:32
  • You could write script for same in windows system or you could use this Wail2ban which is an alternative of fail2ban. – iamjayp Aug 23 '17 at 8:50
0

Afaik any data coming into a Windows Subsystem for Linux (WSL) "Linux system", goes through the "Windows Defender Firewalll" application which suffices its own protection and generally includes BFA protection.

Another layer of protection (which might not be needed and add an extra layer of complexity and possible problems as well as defense) is either Fail2ban, CSF-LFD, or the out-of-box SSHGuard utility which I like very much and install on my Linux systems

In either case, using SSH keys is good and is a best practice. More data in:

  1. https://wiki.archlinux.org/index.php/SSH_keys
  2. https://en.wikipedia.org/wiki/Ssh-keygen

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy