ltsOver9000

User Tools

Site Tools

Trace:
system:ssh:security

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Next revision		Previous revision
system:ssh:security [2020/07/26 18:22] – created ltsover9000system:ssh:security [2020/07/27 05:30] (current) – ltsover9000
Line 1: Line 1:
 +# Live log:
 +```
 +watch -n 1 tail -n 50  /var/log/auth.log 
 +```
 +
 +# View successful login attempts
 +```
 +last
 +```
 +
 +# Custom rolled commands 
 +```
 +# /security
 +logs  # general logs /w watch
 +llogs # live logs
 +```
 +
 +# Locking down SSH Server
 +
 +## Whitelist and Blacklist IP addresses 
 +Stop SSH service first! 
 +
 +```
 +sudo systemctl disable ssh.service
 +# and
 +sudo systemctl stop ssh.service
 +```
 +
 +to start: 
 +```
 +sudo systemctl enable ssh.service
 +# and
 +sudo systemctl start ssh.service
 +```
 +
 +
 Check for password attempts: Check for password attempts:
 ``` ```
Line 8: Line 44:
 ``` ```
  
-Restrict IP address (whitelist):+###Restrict IP address (whitelist):
 ``` ```
 sudo nano /etc/hosts.allow sudo nano /etc/hosts.allow
Line 17: Line 53:
 ``` ```
  
-Also, Open up /etc/hosts.allow file using your favorite text editor:+###(Blacklist):
 ``` ```
 sudo nano /etc/hosts.deny sudo nano /etc/hosts.deny
Line 27: Line 63:
 ``` ```
  
 +  - https://www.tecmint.com/find-failed-ssh-login-attempts-in-linux/#:~:text=Each%20attempt%20to%20login%20to,cat%20command%20or%20grep%20command.
 +  - https://cloudcone.com/docs/article/how-to-restrict-ssh-access-only-to-specific-ips/
  
-https://www.tecmint.com/find-failed-ssh-login-attempts-in-linux/#:~:text=Each%20attempt%20to%20login%20to,cat%20command%20or%20grep%20command. 
  
-https://cloudcone.com/docs/article/how-to-restrict-ssh-access-only-to-specific-ips/+## Whitelist user names for login 
 +``` 
 +sudo nano /etc/ssh/sshd_config 
 +``` 
 +and add: 
 +``` 
 +AllowUsers __userName__ 
 +``` 
 +  - https://www.oreilly.com/library/view/linux-security-cookbook/0596003919/ch03s14.html#:~:text=Discussion,listed%20cannot%20receive%20SSH%20connections.&text=means%20%E2%80%9Callow%20the%20remote%20system,to%20my%20local%20account%20user%20.%E2%80%9D
  
 +## Fail2Ban
 +
 +https://blog.mypapit.net/2011/07/how-to-secure-ssh-server-from-brute-force-and-ddos-with-fail2ban-ubuntu.html
 +
 +### Step 1
 +```
 +sudo apt-get install fail2ban
 +```
 +### Step 2: Setting up Fail2ban
 +Next, you need to configure fail2ban by creating a copy of ‘jail.conf’ to ‘jail.local’
 +```
 +cd /etc/fail2ban
 +sudo cp jail.conf jail.local
 +```
 +
 +### Step 3
 +Edit fail2ban configuration file using your favorite text-edito (I personally use ‘nano’)
 +```
 +sudo nano /etc/fail2ban/jail.local
 +```
 +You can set IP address for fail2ban to ignore, IP addresses can be separated by space.
 +
 +Bantime is the duration of time that you want fail2ban to block suspicious attempt, the value is in seconds
 +Maxretry is the number of failed attempts before fail2ban block the IP-address, in this case 3600 means 1-hour ban
 +
 +```
 +# "ignoreip" can be an IP address, a CIDR mask or a DNS host
 +ignoreip = 127.0.0.1 192.168.1.1
 +bantime  = 3600
 +maxretry = 3 
 +```
 +
 +### Step 4
 +Find ssh configuration under [ssh] heading, and enable it.
 +
 +```
 +[ssh]
 +enabled = true
 +port    = ssh
 +filter  = sshd
 +logpath  = /var/log/auth.log
 +maxretry = 3 
 +```
 +Similarly, you can also enable [ssh-dos] protection by changing the enabled value to “enabled = true”
 +
 +```
 +[ssh-ddos]
 +enabled = true
 +port    = ssh
 +filter  = sshd-ddos
 +logpath  = /var/log/auth.log
 +maxretry = 2
 +```
 +### Step 5
 +After all is done, you may save the file, and (re)start the fail2ban service
 +```
 +sudo /etc/init.d/fail2ban restart
 +```
  
system/ssh/security.1595787774.txt.gz · Last modified: by ltsover9000

Page Tools

Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
CC Attribution-Share Alike 4.0 International Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki