From 118fd7192c874571972872d05989519ed3b8c613 Mon Sep 17 00:00:00 2001
From: Thanwer <lordthanwer@gmail.com>
Date: Sat, 26 Oct 2024 21:12:44 -0300
Subject: [PATCH] Add SSH Hardening post.

---
 content/posts/ssh-hardening.md | 61 ++++++++++++++++++++++++++++++++++
 1 file changed, 61 insertions(+)
 create mode 100644 content/posts/ssh-hardening.md

diff --git a/content/posts/ssh-hardening.md b/content/posts/ssh-hardening.md
new file mode 100644
index 0000000..e374685
--- /dev/null
+++ b/content/posts/ssh-hardening.md
@@ -0,0 +1,61 @@
++++
+date = '2024-10-26T16:59:23-03:00'
+title = 'Advanced SSH Hardening Best Practices'
+description = "Thanwer's Blog Post about best practices for hardening SSH servers"
++++
+
+As you could see on my last post about [fail2ban]({{< ref "/posts/fail2ban-basics" >}} "Fail2ban basics"), the SSH services are a popular target for brute force attacks, we really should take our time to improve our server's security.
+
+On top of iptables rules and fail2ban jails, we have a couple parameters that we can fine-tune on our servers to make another layer of protection.
+
+## SSH authentication methods
+
+By default, SSH allows for password authentication for all users except root, which is a good starting point, but we can improve this behaviour.
+
+### Key authentication
+
+The first step you need to take is to disable password authentication and use SSH keys exclusively. This will greatly reduces the risk of brute force attacks since SSH keys are harder to break.
+
+I will not cover this setup, since there are a lot of great tutorials available on the internet, [check this one from Github](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent).
+
+Another step is to disable root login, because root is present on all GNU/Linux servers by default and this makes this user an easier target.
+
+```bash
+#PermitRootLogin prohibit-password
+PermitRootLogin no
+```
+
+### Two-Factor Authentication (2FA)
+
+If you would like to have yet another level of security, you can implement [2FA with SSH using Google Authenticator](https://docs.vultr.com/how-to-use-two-factor-authentication-with-sudo-and-ssh-on-linux-with-google-authenticator).
+
+### Disable unnused authentication methods
+
+By default, OpenSSH server comes with more authentication methods that you problaly are not using enabled by default. You acn disable them to reduce the attack surface of your server:
+
+```bash
+ChallengeResponseAuthentication no
+KerberosAuthentication no
+GSSAPIAuthentication no
+```
+
+## Improve SSH Encryption and Protocol Settings
+
+By following [those guides](https://www.sshaudit.com/hardening_guides.html) you can disable vulnerable authentication algorithms and prioritize strong ones (AES-256-GCM, chacha20-poly1305).
+
+When you finish those tunings, check with the [ssh-audit tool](https://github.com/jtesta/ssh-audit).
+
+## Restricting SSH Access
+
+On top of iptables rules, the `/etc/ssh/sshd_config` file can apply restrictions based on users, groups and/or source IPs.
+
+For example, to whitelist by IP, you can add the following:
+```bash
+# Restrict to a specific IP address
+AllowUsers *@192.0.0.2
+# Restrict using CIDR notation
+AllowUsers *@192.0.0.0/24
+# Restrict a specific user to a specific IP address
+Match User alice
+  AllowUsers alice@192.0.0.2
+```
\ No newline at end of file