Differences

This shows you the differences between two versions of the page.

--- system:ssh:security [2020/07/26 18:27] – ltsover9000
+++ system:ssh:security [2020/07/27 05:30] (current) – ltsover9000
@@ Line 1: / Line 1: @@
+# Live log:
+```
+watch -n 1 tail -n 50  /var/log/auth.log
+```
+# View successful login attempts
+```
+last
+```
+# Custom rolled commands
+```
+# /security
+logs  # general logs /w watch
+llogs # live logs
+```
+# Locking down SSH Server
+## Whitelist and Blacklist IP addresses
 Stop SSH service first!
@@ Line 24: / Line 44: @@
 ```
-Restrict IP address (whitelist):
+###Restrict IP address (whitelist):
 ```
 sudo nano /etc/hosts.allow
@@ Line 33: / Line 53: @@
 ```
-Also, Open up /etc/hosts.allow file using your favorite text editor:
+###(Blacklist):
 ```
 sudo nano /etc/hosts.deny
@@ Line 43: / Line 63: @@
 ```
+  - https://www.tecmint.com/find-failed-ssh-login-attempts-in-linux/#:~:text=Each%20attempt%20to%20login%20to,cat%20command%20or%20grep%20command.
+  - https://cloudcone.com/docs/article/how-to-restrict-ssh-access-only-to-specific-ips/
-https://www.tecmint.com/find-failed-ssh-login-attempts-in-linux/#:~:text=Each%20attempt%20to%20login%20to,cat%20command%20or%20grep%20command.
-https://cloudcone.com/docs/article/how-to-restrict-ssh-access-only-to-specific-ips/
+## Whitelist user names for login
+```
+sudo nano /etc/ssh/sshd_config
+```
+and add:
+```
+AllowUsers __userName__
+```
+  - https://www.oreilly.com/library/view/linux-security-cookbook/0596003919/ch03s14.html#:~:text=Discussion,listed%20cannot%20receive%20SSH%20connections.&text=means%20%E2%80%9Callow%20the%20remote%20system,to%20my%20local%20account%20user%20.%E2%80%9D
+## Fail2Ban
+https://blog.mypapit.net/2011/07/how-to-secure-ssh-server-from-brute-force-and-ddos-with-fail2ban-ubuntu.html
+### Step 1
+```
+sudo apt-get install fail2ban
+```
+### Step 2: Setting up Fail2ban
+Next, you need to configure fail2ban by creating a copy of ‘jail.conf’ to ‘jail.local’
+```
+cd /etc/fail2ban
+sudo cp jail.conf jail.local
+```
+### Step 3
+Edit fail2ban configuration file using your favorite text-edito (I personally use ‘nano’)
+```
+sudo nano /etc/fail2ban/jail.local
+```
+You can set IP address for fail2ban to ignore, IP addresses can be separated by space.
+Bantime is the duration of time that you want fail2ban to block suspicious attempt, the value is in seconds
+Maxretry is the number of failed attempts before fail2ban block the IP-address, in this case 3600 means 1-hour ban
+```
+# "ignoreip" can be an IP address, a CIDR mask or a DNS host
+ignoreip = 127.0.0.1 192.168.1.1
+bantime  = 3600
+maxretry = 3
+```
+### Step 4
+Find ssh configuration under [ssh] heading, and enable it.
+```
+[ssh]
+enabled = true
+port    = ssh
+filter  = sshd
+logpath  = /var/log/auth.log
+maxretry = 3
+```
+Similarly, you can also enable [ssh-dos] protection by changing the enabled value to “enabled = true”
+```
+[ssh-ddos]
+enabled = true
+port    = ssh
+filter  = sshd-ddos
+logpath  = /var/log/auth.log
+maxretry = 2
+```
+### Step 5
+After all is done, you may save the file, and (re)start the fail2ban service
+```
+sudo /etc/init.d/fail2ban restart
+```

ltsOver9000

User Tools

Site Tools

Differences

Page Tools