How to secure the SSH access in ubuntu server.

Question

I just installed Ubuntu Server on one of my computers. I use a Netgear router and it helped me to create a DynDNS account. I have a host name for my dynamic IP address and I have forwarded the ports to my computer's IP address. I can access my computer (Ubuntu Server) with HTTP, HTTPS, FTP and SSH from any remote computer.

Recently when I checked my router logs I found there are several remote computers that have connected to my servers SSH (port 22).

[LAN access from remote] from 218.12.159.34:43871 to 10.X.X.X:22 Monday, Sep 05,2011 04:10:19
[LAN access from remote] from 194.213.42.58:36664 to 10.X.X.X:22 Monday, Sep 05,2011 01:00:41

These IP addresses have tried to access my computer for more than an hour. There are several other IPs trying to do that also. When I logged into my SSH account I found no one has successfully logged in. Is my computer vulnerable? Or are these automated programs that are trying to make a connection, or is someone trying to hack my computer?

Answer 1

This connections you see are from bots trying to access common accounts with well known passwords from across the hole internet. You are not under attack, you are just connected to the internet :)

You can filter this connections by a number of ways:

One way, is to only allow specific IP addresses to access your machine, done with iptables:

# iptables -N SSH
# iptables -A SSH --src <src_ip1> -j  ACCEPT
# iptables -A SSH --src <src_ip2> -j  ACCEPT
# iptables -A SSH --src <src_ipN> -j  ACCEPT
# iptables -A INPUT -i <iface> -p tcp --dport 22 -j SSH
# iptables -A INPUT -i <iface> -p tcp --dport 22 -j DROP

Another way, if you prefer to let anyone access your machine, but drop the access based on failed logins, you can use fail2ban, just apt-get it and follow the documentation. It a service very easy to set up that will drop connections from remote IPs based on how many times they tried to access your computer and failed.

Answer 2

Another option is to disable password/keyboard interactive logins and use ssh keys for authentication.

First you will need to generate your keypair if you dont already have one - depending on your OS this varies, but here are a few guides:

• Windows with Putty: http://www.howtoforge.com/ssh_key_based_logins_putty
• OS X and *nix systems: http://rcsg-gsir.imsb-dsgi.nrc-cnrc.gc.ca/documents/internet/node31.html

Once this is done you will then need to add the public key to the authorized_keys file (under the user account you wish to login as):

mkdir -p ~/.ssh
chmod 0700 ~/.ssh
echo "ssh-rsa AAAA..0Wovw== something@somewhere.local" > ~/.ssh/authorized_keys

Then, try and connect from your client:

ssh -i ~/.ssh/id_rsa user@server.ext

If it doesn't work, edit your SSH config (/etc/ssh/sshd_config) and make sure the following entries are set (and restart the service with service ssh restart):

RSAAuthentication yes
PubkeyAuthentication yes

However, If this works you can then disable password logins on the SSHd server (once again, in the config file /etc/ssh/sshd_config and restart the service with service ssh restart):

ChallengeResponseAuthentication no
PasswordAuthentication no
UsePAM no

Finally, disconnect and retry your connection - if that works, attempt to ssh without the -i ~/.ssh/id_rsa argument and it should fail authentication.