SSH Hardening and Secure Remote Access

#SSH Hardening and Secure Remote Access#link

SSH (Secure Shell) is the primary remote administration protocol for Linux systems — and it is the number one target for attackers on any internet-facing server. A single misconfigured SSH service can lead to complete system compromise. In this lesson, you will learn how to harden SSH to resist brute-force attacks, credential theft, and unauthorized access.

Understanding the SSH Configuration File

The SSH server configuration lives at /etc/ssh/sshd_config. Every security setting is controlled through this file. After making changes, you must restart the SSH service with 'sudo systemctl restart sshd' (or 'ssh' on some distributions).

Essential SSH Hardening Configuration

Here is a comprehensive hardened SSH configuration. Each directive serves a specific security purpose:

# /etc/ssh/sshd_config — Hardened Configuration

# === Authentication ===
# Disable root login via SSH (use sudo instead)
PermitRootLogin no

# Use SSH Protocol 2 only (Protocol 1 is obsolete and insecure)
Protocol 2

# Disable password authentication — use keys only
PasswordAuthentication no

# Enable public key authentication
PubkeyAuthentication yes

# Specify allowed users (whitelist approach)
AllowUsers analyst admin

# Or allow by group
AllowGroups ssh-users

# === Session Security ===
# Set idle timeout (300 seconds = 5 minutes)
ClientAliveInterval 300
ClientAliveCountMax 2

# Disable empty passwords
PermitEmptyPasswords no

# Disable X11 forwarding (reduces attack surface)
X11Forwarding no

# Disable TCP forwarding unless needed (prevents tunneling)
AllowTcpForwarding no
AllowAgentForwarding no

# Disable .rhosts and /etc/hosts.equiv
IgnoreRhosts yes
HostbasedAuthentication no

# === Cryptographic Hardening ===
# Use strong key exchange algorithms
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org

# Use strong ciphers
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com

# Use strong MACs
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com

# === Logging ===
# Increase logging level
LogLevel VERBOSE

# === Connection Limits ===
# Limit authentication attempts
MaxAuthTries 3

# Limit concurrent unauthenticated connections
MaxStartups 3:30:10

# Set login grace time
LoginGraceTime 30

SSH Key Management

SSH keys are the most secure authentication method. Unlike passwords, they cannot be brute-forced (with sufficient key length) and do not transmit credentials over the network.

Defending Against SSH Brute-Force Attacks

Even with key-based authentication, you should defend against brute-force attempts. fail2ban is the standard tool for this — it monitors log files and automatically bans IPs that show malicious behavior.

Additional SSH Security Measures

• ▪Change the default SSH port (22) — reduces automated scanning noise (security through obscurity, not a primary defense)
• ▪Use port knocking (knockd) — hides SSH behind a sequence of connection attempts to closed ports
• ▪Implement MFA for SSH — use Google Authenticator PAM module or hardware tokens (YubiKey)
• ▪Use SSH certificates instead of raw keys — centralized key management with expiration
• ▪Restrict SSH to VPN-only access — do not expose SSH to the internet at all
• ▪Monitor /var/log/auth.log continuously — detect attacks in real-time
• ▪Use AllowUsers/AllowGroups — whitelist who can log in, rather than blacklisting