+++
date = '2024-10-26T16:59:23-03:00'
title = 'Advanced SSH Hardening Best Practices'
description = "Strengthen your SSH server security with key-based authentication, 2FA, encryption hardening, access restrictions, and disabling unused auth methods."
tags = [
    "webserver",
    "GNU/Linux",
    "Basics Series",
]
+++

As you could see on my last post about [fail2ban]({{< ref "/posts/fail2ban-basics" >}} "Fail2ban basics"), the SSH service is a popular target for brute force attacks, we really should take our time to improve our server's security.

On top of iptables rules and fail2ban jails, we have a couple parameters that we can fine-tune on our servers to make another layer of protection.

## SSH authentication methods

By default, SSH allows for password authentication for all users except root, which is a good starting point, but we can improve this behavior.

### Key authentication

The first step you need to take is to disable password authentication and use SSH keys exclusively. This will greatly reduces the risk of brute force attacks since SSH keys are harder to break.

I will not cover this setup, since there are a lot of great tutorials available on the internet, [check this one from Github](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent).

Another step is to disable root login, because root is present on all GNU/Linux servers by default and this makes this user an easier target.

```bash
#PermitRootLogin prohibit-password
PermitRootLogin no
```

### Two-Factor Authentication (2FA)

If you would like to have yet another level of security, you can implement [2FA with SSH using Google Authenticator](https://docs.vultr.com/how-to-use-two-factor-authentication-with-sudo-and-ssh-on-linux-with-google-authenticator).

### Disable unused authentication methods

By default, OpenSSH server comes with more authentication methods that you probably are not using enabled by default. You can disable them to reduce the attack surface of your server:

```bash
ChallengeResponseAuthentication no
KerberosAuthentication no
GSSAPIAuthentication no
```

## Improve SSH Encryption and Protocol Settings

By following [those guides](https://www.sshaudit.com/hardening_guides.html) you can disable vulnerable authentication algorithms and prioritize strong ones (AES-256-GCM, chacha20-poly1305).

When you finish those tunings, check with the [ssh-audit tool](https://github.com/jtesta/ssh-audit).

## Restricting SSH Access

On top of iptables rules, the `/etc/ssh/sshd_config` file can apply restrictions based on users, groups and/or source IPs.

For example, to whitelist by IP, you can add the following:

```bash
# Restrict to a specific IP address
AllowUsers *@192.0.0.2
# Restrict using CIDR notation
AllowUsers *@192.0.0.0/24
# Restrict a specific user to a specific IP address
Match User alice
  AllowUsers alice@192.0.0.2
```

## Conclusion

SSH hardening is a continuous process, not a one-time task. Start with key-based authentication and disable password login, then layer on 2FA, encryption hardening, and access restrictions. Combined with iptables rules and fail2ban jails, you can significantly reduce the attack surface of your server. Review your SSH configuration periodically and keep up with the latest security recommendations.
