ltsOver9000

This is an old revision of the document!

---

# Live log: ``` watch -n 1 tail -n 50 /var/log/auth.log ```

# Locking down SSH Server

## Whitelist and Blacklist IP addresses Stop SSH service first!

``` sudo systemctl disable ssh.service # and sudo systemctl stop ssh.service ```

to start: ``` sudo systemctl enable ssh.service # and sudo systemctl start ssh.service ```

Check for password attempts: ``` # grep “Failed password” /var/log/auth.log ``` and ``` cat /var/log/auth.log ```

###Restrict IP address (whitelist): ``` sudo nano /etc/hosts.allow ``` and add the following lines to allow the whitelisted IP blocks to your public SSH. ``` sshd: 192.168.x.x/32, … ```

###(Blacklist): ``` sudo nano /etc/hosts.deny ``` and add the following lines to deny all SSH connections to your public SSH port

``` sshd: ALL ```

1. https://www.tecmint.com/find-failed-ssh-login-attempts-in-linux/#:~:text=Each%20attempt%20to%20login%20to,cat%20command%20or%20grep%20command.
2. https://cloudcone.com/docs/article/how-to-restrict-ssh-access-only-to-specific-ips/

## Whitelist user names for login ``` sudo nano /etc/ssh/sshd_config ``` and add: ``` AllowUsers userName ```

1. https://www.oreilly.com/library/view/linux-security-cookbook/0596003919/ch03s14.html#:~:text=Discussion,listed%20cannot%20receive%20SSH%20connections.&text=means%20%E2%80%9Callow%20the%20remote%20system,to%20my%20local%20account%20user%20.%E2%80%9D