Best approach for restricting remote ssh session

Question

Using the following files, I have attempted to restrict the SSH remote login. Having lack of knowledge in linux environment, I don't know the drawbacks and vulnerabilities between the following ways. So I want to know the internal works between these files and process.

Experts please share your experience with me.

SSHD_CONFIG I found this file ssh_config in the /etc/ssh/ folder. If I have added the following line. I could restrict the root user remote access as well as I could allow the user I want to access with the max session I wanted.

vim /etc/ssh/ssh_config    
PermitRootLogin no
AllowUsers jack joe
MaxSessions 5

HostDeny File

Just appended the user IP in the following file.

vim /etc/hosts.deny

192.168.5.*

PAM Folder : In the PAM folder, I have added the user who are all not allowed to authenticate to access remote ssh.

vi /etc/pam.d/ssh

auth required pam_listfile.so item=user sense=deny file=/etc/sshd/sshd.deny onerr=succeed

vi /etc/sshd/sshd.deny

Answer 1

PermitRootLogin no
AllowUsers jack joe
MaxSessions 5

The first 2 lines of that configuration seem just fine to me. The third one is not such necessary as if someone breaks into your system, it's enough to have 1 shell to do all the evil.

In this context, you're allowing just two users to connect, that means that those users will have to use a secure enough password to not break in (at least not easily).

There are some more things you can do:

• If you're using a restricted range of IPs from whom you connect to your machine, restrict port 22 just to these ranges. Drop/reject the rest.

• If not, you might use GeoIP with iptables to reject all countries from whom you don't expect connections (or said differently, only allow the ones that you expect).

• There are some other tools that might help you: Fail2Ban is one of them. This will make that upon X configurable attempts with bad password into your system, the IP will be banned by iptables for an amount of time (also configurable).

• There are hundreds of similar tools but this would be a good enough approach to have a basically consistent configuration.

Answer 2

You should also consider to change the port the SSH daemon is listening on.

Although this is more of an obfuscation rather than a real security measure, it definitely reduces the amount of log entries you need to take a look at, as you are not under constant bombardment from bots.

There is another concept known as Port knocking. The idea is the same. It doesn't necessarily add real security, but it keeps your log files clean.

Both of these measures let you concentrate on the more important log entries and check whether or not they seem legitimate.

Answer 3

File /etc/ssh/ssh_config is a global configuration for SSH clients. /etc/ssh/sshd_config is for configuring the SSH server. Make sure you modify the right one.

When you specify "AllowUsers", SSH automatically denies access from all unlisted users. There is no need for a PAM file. If you have read the man page, you'd know about this. "man sshd_config".

Fail2ban is great and I use it myself. Running SSH service on a non-standard port will make the log files cleaner, but at an increased operational cost because of non-standard SSH configuration (you have to manually specify the port or use the client config file - either local or global).