How do you secure SSH access in CentOS?

Learn how to secure SSH access in CentOS by implementing key-based authentication, changing default ports, and utilizing firewall rules for enhanced security.

CentOS Jul 30, 2024 0 62 Add to Reading List

Securing SSH Access in CentOS

SSH (Secure Shell) is a widely used protocol for secure remote access to servers. Securing SSH access is essential to protect your server from unauthorized access and potential security threats. In CentOS, you can implement several measures to enhance the security of your SSH configuration. Below are some recommended steps to secure SSH access in CentOS:

1. Update SSH Configuration

Start by updating the SSH configuration file located at /etc/ssh/sshd_config. You can modify the following settings to enhance security:

Disable Root Login: Set PermitRootLogin no to prevent root login via SSH. Use a regular user account and switch to root using sudo after login.
Change SSH Port: Change the default SSH port (22) to a custom port to reduce the risk of automated attacks. Modify the Port directive in the configuration file.
Limit User Access: Use the AllowUsers directive to specify which users are allowed to connect via SSH.
Disable Empty Passwords: Ensure that PermitEmptyPasswords is set to no to disallow empty passwords.
Use SSH Key Authentication: Disable password authentication and only allow SSH key-based authentication for added security.
Set Idle Timeout: Use the ClientAliveInterval and ClientAliveCountMax directives to set an idle timeout for SSH sessions.

2. Implement Firewall Rules

Use firewalld or iptables to implement firewall rules that restrict access to the SSH port from specific IP addresses or networks. This can help prevent unauthorized access attempts from external sources.

3. Enable Fail2ban

Fail2ban is a popular intrusion prevention tool that monitors log files for authentication failures and bans IP addresses that exhibit malicious behavior. Install and configure Fail2ban to automatically block repeated failed login attempts.

4. Keep SSH and System Packages Updated

Regularly update your CentOS system and SSH packages to ensure that you have the latest security patches and bug fixes. Use the yum or dnf package manager to update your system.

5. Monitor SSH Logs

Monitor SSH logs for any unusual login attempts or suspicious activity. Reviewing log files can help you detect potential security breaches and take appropriate action to secure your system.

6. Harden SSH Key Management

When using SSH keys for authentication, follow best practices for key management:

Use Strong Key Pairs: Generate strong SSH key pairs with a secure passphrase.
Limit Key Access: Restrict key access by specifying the allowed users or hosts in the authorized_keys file.
Rotate Keys Regularly: Rotate SSH keys periodically to mitigate the risk of key compromise.
Protect Private Keys: Secure the private keys and avoid sharing them insecurely.

7. Disable Unused SSH Protocols and Ciphers

Disable outdated or insecure SSH protocols and ciphers to strengthen the security of your SSH connections. Modify the Ciphers and MACs directives in the SSH configuration file to only allow secure algorithms.

8. Restrict SSH Access with SELinux

SELinux (Security-Enhanced Linux) is a security mechanism that can be used to further restrict SSH access based on SELinux policies. Enable SELinux and configure policies to control access to SSH resources.