3

I'm trying to set up an SSH server which I can access from my home network only, not the Internet.

It's running Ubuntu Linux.

I've installed the ssh package, and I can start/stop the SSH server, and then proceed to log into the computer from my other machine which is on the same network.

However, before proceeding any further, which security considerations should I take? Excluding the obvious one of setting a secure password.

I'm also worried: if someone would find out the IP of the server, would they be able to connect to it? How can I disable connections that don't come from 192.168.*.*?

2 Answers 2

2

You can use UFW (uncomplicated firewall) to open port 22 (SSH) only for certain IP addresses.

It would be something like:

$ sudo ufw allow from 192.168.0.0/24 to any port 22 proto tcp

The 192.168.0.0/24 bit means the IP address range 192.168.0.* -- i.e. 192.168.0.1 through 192.168.0.255 inclusive.

For details, see the UFW docs.

1

However, before proceeding any further, which security considerations should I take? Excluding the obvious one of setting a secure password.

Keys are more secure than passwords, especially if passphrase protected.

Other things (most are set in the config file):

Things that are always a good idea:

  • Don't allow root to directly log in (you can always su or sudo afterwards)

  • Disable any features you won't need in /etc/ssh/sshd_config such as forwarding, etc.

  • Don't have sshd running when you don't need it.

Things to prevent Internet access to your sshd

  • Block port 22 on your router's firewall if possible. Further enforce this with an iptables rule or ufw as suggested by @Greg Hendershott.

  • /etc/hosts_allow controls what IPs can access the server, and you can include lines that deny IP ranges.

If you later expose it to the Internet:

  • Change the port from 22 to another if possible. Won't add any real security but will reduce random attacks.

  • Disable SSH banner, or change it to something that doesn't identify you (you want to do that AFTER the login is completed).

  • Install something like fail2ban that automatically blocks IPs that do many failed logins back to back.

  • Only accept SSHv2, the previous versions have vulnerabilities if I'm not mistaken. I think this is set by default.

2
  • 1
    I still get impressed when I see a server that has its default SSH port changed to something else. I consequently do this for all my boxes and relieves me of a lot of random login tries.
    – Mogget
    Aug 16, 2013 at 14:01
  • 1
    Also, if you go on the Internet. I would also add blocking ranges found in the following: wizcrafts.net/chinese-iptables-blocklist.html. I think 90% of attacks were dropped at that point. Of course this assumes you aren't logging in from those ranges.
    – prateek61
    Aug 16, 2013 at 22:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .