SSH Security Questions

[Mortuis]

I'm learning linux by running Ubuntu 5.10 Server on an old laptop. One thing I wanted to do was be able to access it from work, the idea being to use it as a gateway to my LAN. SSH works out of the box, and I was able to successfully connect to the Ubuntu computer from work.

It strikes me that anyone who wants to break into my system would just have to connect via port 22 and start hammering on my password, as it is an out of the box installation. So I'm considering how to make this more difficult, I'm hoping some of you might know a little about this and can either confirm or disprove my beliefs on the matter.

I'm considering changing the port SSH communicates on. I'm not sure if this is worth the bother though, it's such a basic defence method that I imagine anyone who portscanned my router would probably try hitting every port that responded (or rather, have a script do it).

Impose a signon limit, after an incorrect password is entered X times, do not accept any attempts for N minutes. This could lock me out if someone is trying to break in, but it would also keep them out as it effectivly makes a brute force attack, even an intelligent one, take a great deal of time. The only problem is that even though it sounds simple enough that I should be able to do it, I'm a newbie and don't know if doing this is possable out of the box, or if I have to write code, which could be time consuming since I'm unfamilare with the system.

So what do you think? Am I approaching this the right way? Do I sound like I have an accurate picture of how all this stuff works, or am I mistaken somewhere? Is this a decent security stratigy, or is there a better approach?

[gordonmarkus]

Hi,

There's a couple of things that I would investigate (and this is what I have done to access my remote box).

1. VPN - Do you have a firewall at home that has L2TP/IPSEC server functionality tht would enable it to run as a VPN server for you home network? If so then get this running, and you'll be able to securely access your home network from wherever you are. Windows XP has a built in VPN client (I'm assuming you're using this at work). I am sure that there are L2TP/IPSEC server applications available for linux too in case your firewall does not have this function. They might even be free!

2. Limit the scope of permissable incoming IP's to your ubuntu box. Again, if you can do this on a hardware firewall by setting up a DMZ for you ubunto box and port forwarding on port 22 to the IP of that box, but only from select source IP addresses (assuming you have fixed fixed address(es) at your place of work). If not, then perhaps you can configure the firewall on the unbunto box itself to perform this function (I've not used ubuntu so I couldn't tell you how to do this).

The first option is the most secure, but the more tricky to setup.

Let us know how you get on, I hope that this helps.

-Gordon.

[Chess]

At a minimum, I would do the following:

-run SSH on a nonstandard port number; it does help keep the script kiddies from finding your box;
-disable root logins; if you need to be root, log in as a user and then su to root;
-do not use user/password authentication to ssh -- use your public/private keypair instead; here's a good howto: http://www.linuxquestions.org/questions ... e&artid=79

Check out your ssh config file; that's where you can set some of these options.

[dann]

Aside from the previously mentioned suggestions:

Turn off root access in sshd_config:

PermitRootLogin no

Set only specific users to be able to log in:

AllowUsers user_names

Use good passwords and non-standard names. For instance don't have a test or admin user account on there; they like to try those out.

[Tsuroerusu]

Use good passwords and non-standard names. For instance don't have a test or admin user account on there; they like to try those out.

You can go to http://grc.com/pass/ and it will generate a very strong password for ya.

[gordonmarkus]

Nobody likes the VPN or firewalling options then?....

[Chess]

Nobody likes the VPN or firewalling options then?....

I like your firewall options -- I do the same by forwarding a specific port in my NAT router to my slackware box and then run ssh on that same port.

I don't know much about VPN. I just use ssh to get onto my network from other computers whether it's linux, mac osx, or windows (by using putty).

[Mortuis]

Hi,

There's a couple of things that I would investigate (and this is what I have done to access my remote box).

1. VPN - Do you have a firewall at home that has L2TP/IPSEC server functionality tht would enable it to run as a VPN server for you home network? If so then get this running, and you'll be able to securely access your home network from wherever you are. Windows XP has a built in VPN client (I'm assuming you're using this at work). I am sure that there are L2TP/IPSEC server applications available for linux too in case your firewall does not have this function. They might even be free!

I don't think so. We have a router that has firewall built into it, but I'm uncertain what model so I don't know how good the firewall is. We keep up on the firmware upgrades for what that's worth. But looking up those two acronyms, I don't see anything I recognise. I'm interested in more secure, but the second option sounds best for the time being.

[Mortuis]

At a minimum, I would do the following:

-run SSH on a nonstandard port number; it does help keep the script kiddies from finding your box;
-disable root logins; if you need to be root, log in as a user and then su to root;
-do not use user/password authentication to ssh -- use your public/private keypair instead; here's a good howto: http://www.linuxquestions.org/questions ... e&artid=79

Check out your ssh config file; that's where you can set some of these options.

After looking over the auth.log, I think I agree with you. the scripts running against my computer appear to already be trying many different ports, but it seems worth it to change things just to make them work for it. I'll check out that link you sent me, I'm using user/psasword authentication right now, but I do want to move on to something more secure. Keys are something I have had trouble wrapping my head around, but the local LUG is going to be doing a keysigning party next month, so I'll probably harass them for as long as they'll let me. ;-)

[Mortuis]

Aside from the previously mentioned suggestions:

Turn off root access in sshd_config:

PermitRootLogin no

Set only specific users to be able to log in:

AllowUsers user_names

Use good passwords and non-standard names. For instance don't have a test or admin user account on there; they like to try those out.

I almost made an admin account, but ruled in favor of enabling su. I just checked my auth.log and it's kind of disturbing all the usernames they try out during these attacks, I'm glad I decided against admin.


I added the lines you suggested, however I'm not sure how to restart SSH so the settings take effect. I tried the commands I found on google but they don't work:

# /etc/init.d/sshd restart
bash: /etc/init.d/sshd: No such file or directory

# service sshd restart
bash: service: No such file or directory

I could reboot, but I'd prefer to understand why the normal way wouldn't be working. Is this common?

[Chess]

I added the lines you suggested, however I'm not sure how to restart SSH so the settings take effect. I tried the commands I found on google but they don't work:

You should not have to add those lines to your sshd_config file. They should already be there, but you may need to uncomment the line and/or change the value. For example. a standard sshd_config file might have this in it:

# Authentication:

#LoginGraceTime 2m
#PermitRootLogin yes
#StrictModes yes
#MaxAuthTries 6

All you need to do is to uncomment the "PermitRootLogin" line by deleting the hash and changing the value to "no", like this:

# Authentication:

#LoginGraceTime 2m
PermitRootLogin no
#StrictModes yes
#MaxAuthTries 6

You can also change the maximum number of login tries by uncommenting and changing the "MaxAuthTries line."

<strike>As far as restarting ssh, what distro are you using? Also, are you tryiing to restart ssh as a regular user? You need to be root to do that.</strike>

I see you are using Ubuntu. I have not used Ubuntu much, but I think you need to do "sudo /etc/init.d/sshd restart". Someone correct me if I'm wrong there. In slackware, you need to su to root and then do /etc/rc.d/rc.ssh restart.

[snarkout]

Debian (and by extension ubuntu) refer to the daemon as simply "ssh" so you'd do /etc/init.d/ssh restart. Using "service" to restart services is, AFAIK, a redhatism.

IMO changing the port ssh listens on is a waste of time. Using keys is a good idea though, and so is using wrappers to either exclude certain networks (difficult) or implicitly only include networks (much easier). Look at hosts.allow and hosts.deny for more info. As far as max connections in a certain timespan, that's entirely doable with iptables, but may be more than you want to get into right now. At the very least, use strong passwords and disable root logins.

[Mortuis]

You should not have to add those lines to your sshd_config file. They should already be there, but you may need to uncomment the line and/or change the value. For example. a standard sshd_config file might have this in it:

.
.
.

I see you are using Ubuntu. I have not used Ubuntu much, but I think you need to do "sudo /etc/init.d/sshd restart". Someone correct me if I'm wrong there. In slackware, you need to su to root and then do /etc/rc.d/rc.ssh restart.

Sorry, I said I added them for the sake of convenience, PermitRootLogin I only had to uncomment as you mentioned, but AllowUsers was not in the file, I checked several times before adding it myself, because sometimes programs expect to see certain values on certain lines. Likewise, I didn't see a MaxAuthTries line, so I added that just now as well.

What happens when the MaxAuthTries value is exceeded? Does the box shut down until someone logs in locally, or something else?

[Mortuis]

Debian (and by extension ubuntu) refer to the daemon as simply "ssh" so you'd do /etc/init.d/ssh restart. Using "service" to restart services is, AFAIK, a redhatism.

IMO changing the port ssh listens on is a waste of time. Using keys is a good idea though, and so is using wrappers to either exclude certain networks (difficult) or implicitly only include networks (much easier). Look at hosts.allow and hosts.deny for more info. As far as max connections in a certain timespan, that's entirely doable with iptables, but may be more than you want to get into right now. At the very least, use strong passwords and disable root logins.

Thanks, <b>/etc/init.d/ssh restart</b> did the trick. Unfortunatly for me I forgot that I set the router to forward port 22 to my Ubuntu box, so now it doesn't respond when I try connecting on 22, and it bounces me when I try on the port I specified it to. I'll have to fix that when I get home, but at least I know it worked. :-)

[Chess]

IMO changing the port ssh listens on is a waste of time.

Maybe, but it certainly can't hurt. As soon as I changed my ssh port from 22 to a super high random number the number of script kiddie hits in my logs went to virtually nil. A simple change to the sshd_config file and then a corresponding port forwarding entry in my nat router was all it took. Now I just connect to that other port instead of 22 and that's it.