4 ms·
One absolute rule for any *nix-based server: In /etc/ssh/sshd_config, disable root logins: PermitRootLogin no Even if you think your password ist strong. Thi
by bbb 19y ago
One absolute rule for any *nix-based server:
In /etc/ssh/sshd_config, disable root logins:
PermitRootLogin no
Even if you think your password ist strong. This will stop a majority of the brute-force password-guessing attacks. For extra credit, install denyhosts as well. It has stopped a _lot_ of bad guys trying to brute-force my servers.
- dgr 19y agoYou might also want to use: AllowUsers user1 user2... And it's probably best to disable password logins and use keys instead (http://www.google.com./search?hl=en&q=ssh+authorized_keys http://www.google.com./search?hl=en&q=ssh+authorized_key...).
- ghshephard 19y agoMore important is to routinely rotate strong root passwords. What most people neglect to mention, when denying root access to an SSH server, is that people then login with a second account, (you still need ssh), and then su - to root. So, all you've really done is moved the difficultly in logging onto the server from the root account, to the secondary account+root account. Your security is now based on the strength of that bi-pair of passwords. As others have mentioned, moving logins to RSA keys (very easy) is probably a better approach.