Secure and tune the SSH server

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Examendoelen in dit hoofdstuk

Inloggen met sleutels voor SSH instellen

Know the sshd configuration

The SSH server (sshd) reads /etc/ssh/sshd_config. On RHEL that file first includes /etc/ssh/sshd_config.d/*.conf. For each setting, the first value found wins — so put your own settings in a drop-in file with a low number.

#grep -v '^#' /etc/ssh/sshd_config | grep .
Include /etc/ssh/sshd_config.d/*.conf
#ls /etc/ssh/sshd_config.d/
#sshd -T | grep -iE 'permitrootlogin|passwordauthentication|port '

Write your settings in a drop-in file.
/etc/ssh/sshd_config.d/10-hardening.conf
```
PermitRootLogin no
MaxAuthTries 3
```
Test the syntax, then reload (open sessions stay connected).
```
#sshd -t
#systemctl reload sshd
```

Let op

Keep your current SSH session open while you change sshd. Test a new login in a second terminal before you log out. A mistake can lock you out.

20.2

Limit root access

PermitRootLogin decides how root may log in over SSH.

Value	Meaning
`yes`	Root may log in with a password or a key
`prohibit-password`	Root only with a key (RHEL default)
`no`	Root may not log in at all (best: log in as a user, then sudo)
`forced-commands-only`	Root only with keys that run a fixed command

/etc/ssh/sshd_config.d/10-hardening.conf

PermitRootLogin no

20.3

Use another port

A different port does not make SSH safe, but it removes most automated attacks from the logs. SELinux and the firewall must know the new port too.

Set the port in sshd.
/etc/ssh/sshd_config.d/10-hardening.conf
```
Port 2022
```

Tell SELinux that sshd may use this port.

#semanage port -a -t ssh_port_t -p tcp 2022
#semanage port -l | grep ssh

Open the port in the firewall and reload sshd.

#firewall-cmd --add-port=2022/tcp --permanent
#firewall-cmd --reload
#systemctl restart sshd

Test from another machine.
```
$ssh -p 2022 student@server1
```

Examentip

Three places for a new SSH port: sshd config, semanage port -a -t ssh_port_t, firewall-cmd --add-port. Forget one and the login fails.

20.4

Allow only some users

AllowUsers and AllowGroups list who may log in; everybody else is refused. DenyUsers and DenyGroups block some.

/etc/ssh/sshd_config.d/20-users.conf

AllowGroups sshusers wheel

#groupadd sshusers
#usermod -aG sshusers lisa
#systemctl reload sshd

AllowUsers lisa@192.168.122.* allows lisa only from that network.
If you use both Allow lines, a user must match both.

20.5

Use other useful sshd options

More settings that make SSH safer or friendlier.

Setting	Effect
`PasswordAuthentication no`	Keys only (set up keys first!)
`MaxAuthTries 3`	Fewer password guesses per connection
`LoginGraceTime 30`	Seconds to finish the login
`MaxSessions 4`	Sessions per connection
`X11Forwarding no`	No graphical forwarding
`AllowTcpForwarding no`	No tunnels through this server
`Banner /etc/issue.net`	Show a legal text before login
`UseDNS no`	Faster logins (no reverse lookup)

20.6

Keep connections alive

Firewalls close idle connections. Keepalive messages keep them open — or close dead ones on purpose.

/etc/ssh/sshd_config.d/30-keepalive.conf

ClientAliveInterval 300
ClientAliveCountMax 2

The server asks the client every 300 seconds; after 2 missed answers it closes the session (idle sessions end after 10 minutes of no answer). On the client side:

~/.ssh/config

Host *
    ServerAliveInterval 60

20.7

Use key logins with passphrases

A key with a passphrase is safe even if the private key file is stolen. ssh-agent remembers the unlocked key for your session, so you type the passphrase once.

$ssh-keygen -t ed25519 -C "student@server1"
$ssh-copy-id student@server2
$eval "$(ssh-agent)"
$ssh-add
$ssh-add -l
$ssh student@server2

When all users have keys, turn off password logins.
/etc/ssh/sshd_config.d/10-hardening.conf
```
PasswordAuthentication no
```
Test and reload.
```
#sshd -t && systemctl reload sshd
```

Op het werk

Check who tries to get in: journalctl -u sshd | grep -E 'Failed|Invalid'. Tools like fail2ban (EPEL) block IPs after many failures.

20.8

Remember the main points

The most important facts of this chapter, in short.

The SSH server is sshd; its settings are in /etc/ssh/sshd_config and drop-in files in /etc/ssh/sshd_config.d/*.conf.
The drop-in files are read first and the first value wins, so put your own settings in a drop-in with a low number.
PermitRootLogin no (or prohibit-password) stops root password logins; RHEL 10 already blocks root password login by default.
A new SSH port needs three steps: the Port line, an SELinux port label (semanage port -a -t ssh_port_t -p tcp PORT) and a firewall rule.
AllowUsers and AllowGroups limit who may log in.
PasswordAuthentication no allows only key logins; test a key login before you turn passwords off.
ClientAliveInterval and ClientAliveCountMax close dead sessions; on the client ServerAliveInterval keeps sessions open.
Check the config with sshd -t before systemctl restart sshd.

20.9

Learn the key terms

The words of this chapter in simple English.

Term	Meaning
sshd	The SSH server service.
sshd_config	The main settings file of the SSH server.
Drop-in config	An extra settings file in /etc/ssh/sshd_config.d/.
PermitRootLogin	The setting that allows or blocks root logins.
AllowUsers	The list of users who may log in with SSH.
Key-based authentication	Login with a key pair instead of a password.
ssh_port_t	The SELinux type for ports that sshd may use.
Keep-alive	Small messages that check if a connection is still alive.

20.10

Check what you learned

Think about the answer first, then open it.

1Where do you put your own sshd settings on RHEL 10?

In a file like /etc/ssh/sshd_config.d/10-local.conf.

2Two files set Port. Which value does sshd use?

The first one it reads (drop-in files come first, in name order).

3Which three things do you change to move sshd to port 2022?

Port 2022 in a drop-in, semanage port -a -t ssh_port_t -p tcp 2022, firewall-cmd --permanent --add-port=2022/tcp + --reload.

4How do you allow only users anna and bob to log in?

AllowUsers anna bob, then restart sshd.

5How do you check the sshd config for errors?

sshd -t.

6How do you allow only key logins?

PasswordAuthentication no (test a key login first, keep a second session open).

7How do you see the settings sshd really uses?

sshd -T (shows the final values).

8Which setting closes a session after 3 missed keep-alive checks of 60 seconds?

ClientAliveInterval 60 and ClientAliveCountMax 3.

Oefenen

Lab 20.1Harden the SSH serverGemiddeld · 35 minNog niet begonnen

Oefenen

Alle commando's in dit hoofdstuk