Hardening your unix ssh-server access ( howto by socpuppets )

howto
  

Here’s a quick and dirty ssh-server security improvement howto . Most of these settings are done within the sshd_config file similar to the following file;

# Package generated configuration file
# See the sshd_config(5) manpage for details

# What ports, IPs and protocols we listen for
Port 2022
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
ListenAddress 1.1.1.1
ListenAddress 1.1.1.3

 Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 1024

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
PermitRootLogin no
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile    %h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding no
X11DisplayOffset 10
PrintMotd yes
PrintLastLog yes
TCPKeepAlive yes
UseLogin no

sshd_config

==============

1^st

deny ssh  protocol version#1 support, it’s weaker and prone to abused.

  Protocol 2

==============

Now craft RSA keys with a minimum of  4048bit

ssh-keygen –t rsa –b 4048

Install the key in your correct location for the sshd daemon config. Also, if possible, deploy ECDSA keys  with sha1 and shas256  ( use ssh-keygen -t to specicy key  type )

==============

Remove & disallow rootlogin via ssh

 PermitRootLogin no

==============

Just allow only specific users that needs access via ssh.

 allowUser kfelix1 kfelix2 kfelix2 admin1 database user1 remoteAdmin1 remoteAdmin2

==============

Disable password logins

  PasswordAuthentication no

==============

 

Set SSHD listener to ipv4 or ipv6  or both if required, don't run it blindly on both stacks unless required

==============

Disable empty passwords logins

PermitEmptyPasswords no

==============

With multihomed machines, set the SSHD listener on just the interfaces that's required for ssh. Avoid using 0.0.0.0 ( any )

 ListenAddress  1.1.1.1

==============

Set strict modes for directory checking  to  yes

StrictModes yes

==============

Lastly, if you want to be slick, modify the OpenSSH source code and allow only the ciphers that your want and eliminate potential weaker ciphers.

The source code file  cipher.c file lists the ciphers

Alternate you can set the cipher list in the sshd_config file

Ciphers aes256-cbc,aes256-ctr, blowfish-cbc,aes256-cbc

I personally would strike des and 3des, Don't know what clients still support des, but you are not serious if you allow des imho ;)

============== 

Always deploy firewalls policies to allow what needs access to ssh-servers or use iptables locally. If on a public access network and you have to use  port22, deploy a fail2ban  or similar, but be advise this could lead to valid accounts being block

For  openssh server sources  try the following ftp site;

ftp://ftp.fr.openbsd.org/pub/OpenBSD/OpenSSH/portable/


Ken Felix
Freelance Network/Security Engineer 
kfelix  -----a----t---- socpuppets ---dot---com

    ^    ^
=(  +  -  )=
      @
      /   \