Now that the server is online, it’s time to lock it down so only those permitted can access it. I will be logging in through SSH (Secure Shell). On any Ubuntu box, the command to install the SSH server is as simple as running the following:
$> sudo tasksel install openssh-serverWhich will install the openssh package.
Now, the default installation of the SSH server is fine, but let’s trim it up a little. With your favourite editor (and root permissions), open up /etc/ssh/sshd_config. Don’t forget to back up the original, just in case. The following code block contains the lines I changed or added.
LoginGraceTime 60
PermitRootLogin no
MaxAuthTries 2
AllowUsers <user names separated by spaces>
Banner /etc/ssh/ssh_banner
These are not the only things possible to change, and for more, I offer the sshd_config man page. The above shortens the grace time to enter one’s password from 120 seconds to 60, disables root login, reduces the number of times you may try to login to two, and permits only the users listed to SSH in. I have also introduced a banner message before one authenticates. The contents of /etc/ssh/ssh_banner are below:
This computer system is for authorized users only. All activity is logged and regularly checked by systems personnel. Individuals using this system without authority or in excess of their authority are subject to having all their services revoked. Any illegal services run by users or attempts to take down this server or its services will be reported to local law enforcement, and said user will be punished to the full extent of the law. Anyone using this system consents to these terms.
Now that all the SSH configurations have been made, restart the SSH service so it starts using them:
$> sudo /etc/init.d/ssh restart
One more useful tip for Ubuntu users involves editing /etc/motd.tail and /var/run/motd to add a nice welcome message to the authenticated users.
My current MOTD upon successful login. Look, there's colour!
Next, to avoid unwanted brute force attacks on your (hopefully very strong) passwords involves setting up and tearing down iptables rules. The rule shown here will block an IP if three incorrect attempts to login are received within 60 seconds, which should stop brute force attacks, but not hamper any normal, human logins. Enter the following into the new file /etc/network/if-up.d/bfa_protection:
#!/bin/bash
[ "${METHOD}" != loopback ] || exit 0
/sbin/iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
/sbin/iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 3 --rttl --name SSH -j DROPThen make it executable:
$> sudo chmod u+x /etc/network/if-up.d/bfa_protection
Next, we need the code to tear the rules down when the network interface goes down. Enter the following into /etc/network/if-down.d/bfa_protection:
#!/bin/bash
[ "${METHOD}" != loopback ] || exit 0
/sbin/iptables -D INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
/sbin/iptables -D INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 3 --rttl --name SSH -j DROP
Then make it executable:
$> sudo chmod u+x /etc/network/if-down.d/bfa_protection
That’s it. To get it running without a restart of the network interface, do the following:
$> sudo /etc/network/if-up.d/bfa_protection
$> sudo iptables -L
The last line will show all rules, and should be displaying the the brute force protection rule.
SSH is a useful tool, and can be combined with many other programs to provide very interesting functionality (such as VNC connections through an SSH tunnel). The key thing to remember is to use it intelligently, and that strong passwords are important. If you are even more concerned about security, the use of private keys might be more suitable.
Subscribe
