Questions about securing SSH and port 22

Jimini · l33t Joined: 31 Oct 2006 Posts: 601 Location: Germany

Greetings.
I want to secure my SSH-access. The preferred way would be, to permit access to port 22 for a number of pcs (my network, my pc at work and so on), every other pc would have to use a non-standard port. For example, every foreign pc would have to connect to port 9981, but "my" pcs could connect to port 22. How do I implement that into an iptables-script and/or my SSHD-config?

Hu · Moderator Joined: 06 Mar 2007 Posts: 21607

Jimini · l33t Joined: 31 Oct 2006 Posts: 601 Location: Germany

Thank you for your helpful reply.
I modified my rules:
iptables -t nat -A PREROUTING -p tcp --dport 10101 -j REDIRECT --to-ports 22
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT
iptables -A INPUT -s 10.0.0.0/24 -p tcp --dport 22 -m state --state NEW -j ACCEPT
iptables -A INPUT -s 123.45.67.89 -p tcp --dport 22 -m state --state NEW -j ACCEPT

SSHD keeps listening on port 22. The IP in the last line is my pc at work - if i comment that line out (and try to connect from there, as if it was a "foreign" machine), it can still connect to 22 and 10101 - I just can't find my mistake.
I've abandoned the option "iprange", because "-s" fulfills my demands absolutely.

Best regards,
Jimini
_________________
"The most merciful thing in the world, I think, is the inability of the human mind to correlate all its contents." (H.P. Lovecraft: The Call of Cthulhu)

Hu · Moderator Joined: 06 Mar 2007 Posts: 21607

NeddySeagoon · Posted: Sat Jun 12, 2010 11:47 pm Post subject:

Jimini,

You could just use key based log in and put up with the noise of username/password guessing bots.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

Jimini · l33t Joined: 31 Oct 2006 Posts: 601 Location: Germany

NeddySeagoon · Posted: Sun Jun 13, 2010 7:45 pm Post subject:

Jimini,

You can allow both key based and password based logins.
If you go key based only, you must have the key files in place before your turn off password based logins.

You can use a password based login to put the key file in place, test the key based login then turn off password based login.
Of course, if you mess up there, you need physical access to fix it.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

Jimini · l33t Joined: 31 Oct 2006 Posts: 601 Location: Germany

Hm, that sounds nice, it could be worth a try! Thanks for the explanation.

Best regards,
Jimini
_________________
"The most merciful thing in the world, I think, is the inability of the human mind to correlate all its contents." (H.P. Lovecraft: The Call of Cthulhu)

Hu · Moderator Joined: 06 Mar 2007 Posts: 21607

To be sure you understand the consequences: once you switch to only allowing key based authentication, you can only get on from those machines which have an allowed private key. This is great for security, but may be undesirable if you have a habit of sitting down at arbitrary machines and connecting to your server. The current configuration allows for such an action, provided you remember to handle the alternate port requirement when using an unrecognized machine. A keys-only configuration would require you to keep the private key available, which you could do through a USB stick (but then be sure to password protect the key!).

All that said, I like running servers as keys-only whenever usage requirements permit it.

Jimini · l33t Joined: 31 Oct 2006 Posts: 601 Location: Germany

Yep, in almost all cases I connect either from my local network or my notebook or my pc at work. If I would use a foreign pc, I would use a server at work (where I would put my keyfile) as a gateway to my own server. Thank you for your warnings :)

Best regards,
Jimini
_________________
"The most merciful thing in the world, I think, is the inability of the human mind to correlate all its contents." (H.P. Lovecraft: The Call of Cthulhu)

Kasumi_Ninja · Posted: Mon Jun 14, 2010 3:46 pm Post subject:

I recommend disabling PasswordAuthentication and using a key based (with password) setup. Furthermore you should install fail2ban and close inactive connections. Having a banner is also a good idea. Before disabling PasswordAuthentication make sure you can login with a your key. See also the links below.

Timeout inactive connections

Jimini · l33t Joined: 31 Oct 2006 Posts: 601 Location: Germany

I've got a few things to add - I have set up everything as follows:
- My router can be reached via SSH from the outside. The daemon listens on a non-standard port. I have set up a few iptables-rules, that direct ssh connections from a few "friendly" machines to port 22 to this non-standard port, so I only have to pay attention to this port when I want to connect from an "arbitrary" machine.
- Although the number of connection attempts from bots has heavily decreased, fail2ban is running.
- All my machines accept only keyfile-based logins now. My router and my fileserver also require a password, the other machines do not require a password anymore, I only need the public key. I guess keyfile + password is more secure than just the keyfile.

Is there anything that I can still do to secure the SSH-daemon(s) and my network?

Best regards,
Jimini

P.S.: here is my sshd_config:

deanpence · Apprentice Joined: 08 Nov 2004 Posts: 158 Location: Earth

Considering the number of automated attacks out there going after port 22, I always recommend people run ssh on a non-standard port (> 1024, of course). It's only mitigation, and other methods (above) should also be used to secure ssh.

(In my case, I just got sick of seeing a few thousand automated login attempts in my logs every day.)