0

I want to install OpenSSH server on Ubuntu. How to do it?

I need to do the following:

  1. Set up OpenSSH server

  2. Set up ssh public-private key pair for user

  3. Disable password login

  4. Enable root user

  5. Set up ssh public-private key pair for root user

  6. Set up password

2

Go to terminal and type:

sudo su
aptitude install openssh-server openssh-client

Test the installation

ps -A | grep sshd

If the output is something like this:

<some number> ?        00:00:00 sshd

Then ssh daemon is running.

Again type in terminal;

ss -lnp | grep sshd

If the output is something like this:

0  128  :::22  :::*  users:(("sshd",16893,4))
0  128   *:22   *:*  users:(("sshd",16893,3))

Then it means that ssh daemon is listening for incoming connections

Now we edit the configuration file. First we make a backup of the original file.

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.factory-defaults

Now we open the configuration file to edit it

sudo gedit /etc/ssh/sshd_config

Weak passwords are easy to guess. The best practice is to use SSH keys instead of password.

So we disable password authentication altogether.

Go to the line

#PasswordAuthentication yes

and replace it with

PasswordAuthentication no

Enabling forwarding gives more options to attackers who have already guessed passwords.

So we disable it. It gives us a little security

Go to the lines

AllowTcpForwarding yes
X11Forwarding yes

and replace them with

AllowTcpForwarding no
X11Forwarding no

We can explicitly allow certain users and deny certain users to login.

For that we have to put the following lines at the bottom of the config file.

AllowUsers Fred Wilma
DenyUsers Dino Pebbles

For optimal performance of laptop we allow two pending connections. Between the third and tenth connection the system will start randomly dropping connections from 30% up to 100% at the tenth simultaneous connection. This can done by the following line

MaxStartups 2:30:10

To log more error and other useful information we alter the line

LogLevel INFO

into LogLevel VERBOSE

To scare away novice attackers we can display a banner We remove the hash tag from the front of the line

#Banner /etc/issue.net

to make it

Banner /etc/issue.net

Then we go to terminal and type:

sudo gedit /etc/issue.net

***************************************************************************
                        NOTICE TO USERS
This computer system is the private property of its owner, whether
individual, corporate or government.  It is for authorized use only.
Users (authorized or unauthorized) have no explicit or implicit
expectation of privacy.
Any or all uses of this system and all files on this system may be
intercepted, monitored, recorded, copied, audited, inspected, and
disclosed to your employer, to authorized site, government, and law
enforcement personnel, as well as authorized officials of government
agencies, both domestic and foreign.
By using this system, the user consents to such interception, monitoring,
recording, copying, auditing, inspection, and disclosure at the
discretion of such personnel or officials.  Unauthorized or improper use
of this system may result in civil and criminal penalties and
administrative or disciplinary action, as appropriate. By continuing to
use this system you indicate your awareness of and consent to these terms
and conditions of use. LOG OFF IMMEDIATELY if you do not agree to the
conditions stated in this warning.
****************************************************************************

Now we save and close the config file and restart ssh by typing in terminal:

systemctl restart ssh

Next we setup SSH keys There are two pairs of SSH keys public and private. Public keys are present in servers and private keys are present with individuals If someone can match his private key with public key, only he/she can login. Furthermore optionally private keys can be protected by passphrase Furthermore when the keys are generated by using 4096 bit encryption it is almost impossible to break them by brute force

Step one - Create the RSA key pair:

Type in terminal

ssh-keygen -t rsa -b 4096

Here we use 64 bit encryption for more security

Step two - Store the keys and passphrase:

Follow the onscreen instructions, give desired location for storage of keys, reccommended to accept the default, opt for passphrase, give a strong passphrase, remember it.

The screen is something like this:

ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/demo/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/demo/.ssh/id_rsa.
Your public key has been saved in /home/demo/.ssh/id_rsa.pub.
The key fingerprint is:
4a:dd:0a:c6:35:4e:3f:ed:27:38:8c:74:44:4d:93:67 demo@a
The key's randomart image is:
+--[ RSA 2048]----+
|          .oo.   |
|         .  o.E  |
|        + .  o   |
|     . = = .     |
|      = S = .    |
|     o + = +     |
|      . o + o .  |
|           . o   |
|                 |
+-----------------+

Step three - Copy the Public Key:

Type in terminal

ssh-copy-id user@123.45.56.78

Here 123.45.56.78 is the server IP address

In case of localhost it is

ssh-copy-id user@localmachinename

The screen is something like this

The authenticity of host '12.34.56.78 (12.34.56.78)' can't be established.
RSA key fingerprint is b1:2d:33:67:ce:35:4d:5f:f3:a8:cd:c0:c4:48:86:12.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '12.34.56.78' (RSA) to the list of known hosts.
user@12.34.56.78's password: 
Now try logging into the machine, with "ssh 'user@12.34.56.78'", and check in:

~/.ssh/authorized_keys

to make sure we haven't added extra keys that you weren't expecting.

Now our installation is complete. To login we need to type in terminal:

ssh username@servername

Then when prompted for passphrase we need to provide it.

Now we to enable root login of opessh server We first have to enable sudo password as it is disabled in Ubuntu by default.

For that, we type in terminal the following, screen will be something like this:

sudo passwd
[sudo] password for [username]: [Type your user password and press return]
Type new UNIX password: [Type the root password you want]
Retype new UNIX password: [Retype the root password you chosen before]
passwd: password updated successfully

Now we have to edit the /etc/sudoers file.

Here we use the editor called visudo

It is because visudo is for the sole purpose of editing sudoes file

In ubuntu by default config files are opened by nano editor

To change it type in terminal:

sudo update-alternatives --config editor

The following screen will appear:

There are 4 choices for the alternative editor (providing /usr/bin/editor).

  Selection    Path                Priority   Status
------------------------------------------------------------
* 0            /bin/nano            40        auto mode
  1            /bin/ed             -100       manual mode
  2            /bin/nano            40        manual mode
  3            /usr/bin/vim.basic   30        manual mode
  4            /usr/bin/vim.tiny    10        manual mode

Press <enter> to keep the current choice[*], or type selection number:

Type 3 and press enter

Then type:

sudo visudo

Move to the line which reads

Defaults    env_reset

Press enter

Above a new line gets created

Type:

Defaults rootpw

use spacebar, not TAB

Press Esc --> :x --> Enter

In terminal type:

gedit /etc/ssh/sshd_config

Move to the line:

PermitRootLogin password-prohibited

and change it to

PermitRootLogin yes

Next move to the line:

PasswordAuthentication no

and change it to

PasswordAuthentication yes

Save and close

Then restart SSH

service ssh restart

Now it's time to again generate the ssh public-private key pair for the user root.

Type in terminal

ssh-keygen -t rsa -b 4096

Step two - Store the keys and passphrase:

Follow the onscreen instructions, give desired location for storage of keys, DON'T accept the default as you have to crete new pair this time, the default one has lready been created, opt for passphrase, give a strong passphrase, remember it.

The screen is something like this:

ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/demo/.ssh/id_rsa): u-root-id_rsa 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/demo/.ssh/u-root-id_rsa.
Your public key has been saved in /home/demo/.ssh/u-root-id_rsa.pub.
The key fingerprint is:
4a:dd:0a:c6:35:4e:3f:ed:27:38:8c:74:44:4d:93:67 demo@a
The key's randomart image is:

+--[ RSA 2048]----+
|          .oo.   |
|         .  o.E  |
|        + .  o   |
|     . = = .     |
|      = S = .    |
|     o + = +     |
|      . o + o .  |
|           . o   |
|                 |
+-----------------+

Then type in terminal:

ssh-copy-id -i u-root-id_rsa.pub root@localmachinename

Output screen may show:

The authenticity of host '12.34.56.78 (12.34.56.78)' can't be established.
RSA key fingerprint is b1:2d:33:67:ce:35:4d:5f:f3:a8:cd:c0:c4:48:86:12.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '12.34.56.78' (RSA) to the list of known hosts.
user@12.34.56.78's password: 

Now try logging into the machine, with "ssh 'user@12.34.56.78'", and check in:

~/.ssh/authorized_keys

to make sure we haven't added extra keys that you weren't expecting.

Now we have granted private key access to root to login

To test type:

ssh root@localmachine

Again in terminal type:

gedit /etc/ssh/sshd_config

move to the line:

PasswordAuthentication yes

and change it to

PasswordAuthentication no

Save and close

Then restart SSH

service ssh restart

It will ask for passphrase. Passphrase remains the same. Give it.

Now the root will be able to successfully login

Now for more security we have to add firewall

Type:

apt install ufw

Now start it

enable ufw

Get a list of currently running processes

ufw app list

OpenSSH will be listed there.

ALow it through firewall
ufw allow OpenSSH

Restart firewall

systemctl restart ufw

Our installation is complete

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.