If you ever ran a SSH server on the Internet, you will probably have noticed the massive amount of ssh break-in attempts.
There are a few easy ways to get rid of the attacks and at the same time prevent your root account from being compromised.
- move the SSH listen port from TCP port 22 to a non-standard port
- disallow connections with the older and easily cracked “Protocol 1”
- disallow remote root logins
These countermeasures are easily taken by editing the ssh daemon’s configuration file “/etc/ssh/sshd_config“. below, I will show you the lines to lookup and the changed line which needs to take its place:
- Move the ssh listen port from 22 to 12345. This will get rid of most break-in attempts right away because these only target the well-known port 22:
#Port 22
Port 12345
- Disallow the use of the old “Protocol 1”
#Protocol 2,1
Protocol 2
- Disallow the root user to logon directly
#PermitRootLogin yes
PermitRootLogin no
After these changes have been made, you will have to restart the SSH server:
# /etc/rc.d/rc.sshd restart
When you disable root logon through SSH, the only possibility to become root on this computer remotely is to logon as a normal user first, and then use “su” or “sudo” to become root.
This has negative implications if you are used to make remote backups from your server and connect to it as root… because that is the only way to be able to access and read every file in the filesystem.
When you need remote root access but still want to disable password logins for root, there is a further change you have to make to one of the lines I showed you earlier. What I will show you next is how to prevent password logins for root while still allowing entrance using a SSH key. You can protect this SSH key with a passphrase so that it is impossible for someone who steals this key to force his way in as root – he will have the SSH key in his possession, but will not know the passphrase to unlock it!
In order for this to work, the SSH server must allow Public Key Authentication for Protocol2. In Slackware this is the default anyway:
#PubkeyAuthentication yes
#AuthorizedKeysFile .ssh/authorized_keys
Now, let’s allow root to use a SSH key for loggin in. Change the following line in “/etc/ssh/sshd_config“:
PermitRootLogin no
to
PermitRootLogin without-password
and then restart the SSH daemon again (see above).
Finally, you will have to generate a SSH key that can be used for remote logins and copy the public keyfile to your SSH server.
ssh-keygen -t rsa
You will have to answer a few questions: under which name should the new keyfile be stored, and what passphrase should be used to protect the keyfile.
Once you have generated this keyfile, copy the public key (which is the keyfile but with the “.pub” extension) to your SSH server and on that server, as user root, append it to root’s “.ssh/authorized_keys” file like this (I am using an example public key filename “your_new_sshkey.pub”):
cat your_new_sshkey.pub >> /root/.ssh/authorized_keys
In case the “authorized_keys” file did not yet exist, you will have to secure other people’s access to the file or else remote logon will still not work:
chmod 600 /root/.ssh/authorized_keys
chmod 700 /root/.ssh
Once this has been done you should now be able to logon to your SSH server as root remotely:
ssh -p 12345 -i ${HOME}/.ssh/your_new_sshkey root@remoteserver
If you want ssh to use this SSH key automatically so that all you need to type is “ssh root@remoteserver“, you should add a few lines to your “~/.ssh/config” file. Perhaps that file does not yet exist in which case you can just create it. Mind the indents, they are required:
Host remoteserver
User root
Port 12345
IdentityFile /home/your_user/.ssh/your_new_sshkey
Good luck with this!
Eric
PS: if you copy your new public key to the server before you have made any of the changes I suggested, then some of the above steps can be combined into one. The following command on your workstation will copy the public key to the SSH server, and add it to root’s “authorized_keys” file, securing that file’s access attributes if needed, all in one go:
ssh-copy-id -i ${HOME}/.ssh/your_new_sshkey root@remoteserver
Recent comments