+++
date = '2024-10-26T16:59:23-03:00'
title = 'Advanced SSH Hardening Best Practices'
description = "Thanwer's Blog Post about best practices for hardening SSH servers"
+++

As you could see on my last post about [fail2ban]({{< ref "/posts/fail2ban-basics" >}} "Fail2ban basics"), the SSH services are a popular target for brute force attacks, we really should take our time to improve our server's security.

On top of iptables rules and fail2ban jails, we have a couple parameters that we can fine-tune on our servers to make another layer of protection.

## SSH authentication methods

By default, SSH allows for password authentication for all users except root, which is a good starting point, but we can improve this behaviour.

### Key authentication

The first step you need to take is to disable password authentication and use SSH keys exclusively. This will greatly reduces the risk of brute force attacks since SSH keys are harder to break.

I will not cover this setup, since there are a lot of great tutorials available on the internet, [check this one from Github](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent).

Another step is to disable root login, because root is present on all GNU/Linux servers by default and this makes this user an easier target.

```bash
#PermitRootLogin prohibit-password
PermitRootLogin no
```

### Two-Factor Authentication (2FA)

If you would like to have yet another level of security, you can implement [2FA with SSH using Google Authenticator](https://docs.vultr.com/how-to-use-two-factor-authentication-with-sudo-and-ssh-on-linux-with-google-authenticator).

### Disable unnused authentication methods

By default, OpenSSH server comes with more authentication methods that you problaly are not using enabled by default. You acn disable them to reduce the attack surface of your server:

```bash
ChallengeResponseAuthentication no
KerberosAuthentication no
GSSAPIAuthentication no
```

## Improve SSH Encryption and Protocol Settings

By following [those guides](https://www.sshaudit.com/hardening_guides.html) you can disable vulnerable authentication algorithms and prioritize strong ones (AES-256-GCM, chacha20-poly1305).

When you finish those tunings, check with the [ssh-audit tool](https://github.com/jtesta/ssh-audit).

## Restricting SSH Access

On top of iptables rules, the `/etc/ssh/sshd_config` file can apply restrictions based on users, groups and/or source IPs.

For example, to whitelist by IP, you can add the following:
```bash
# Restrict to a specific IP address
AllowUsers *@192.0.0.2
# Restrict using CIDR notation
AllowUsers *@192.0.0.0/24
# Restrict a specific user to a specific IP address
Match User alice
  AllowUsers alice@192.0.0.2
```