- In this video, I want to talk a little bit more
about running the SSH server.
We've already talked about it in Lesson 7,
which was quite at a basic level.
And SSH is important enough
to discuss some more advanced topics as well.
So you already know
that SSH provides remote access to a Linux terminal.
And you may have to install it before you can use it.
sudo dnf install openssh-server on Red Hat family,
or sudo apt install openssh-server on Ubuntu.
And after installing it,
make sure it is started and enabled by systemd.
Use sudo systemctl status sshd
And if necessary, sudo systemctl enable --now sshd
to run it.
All right, if you run an SSH server,
you should realize that
SSH server are a frequent target by attackers.
And that is because SSH is often exposed on internet ports,
on port 22.
And well, if you're an attacker,
there is nothing easier
to launch a brute-force attack on that port.
In a brute-force attack,
a script is used to try
common usernames and common passwords and combinations.
And just many, many times until the attacker gets access.
You can easily secure that
by modifying a few parameters in /etc/ssh/sshd_config
To start with, the port.
"Port" defines the port on which SSH is listening.
PermitRootLogin should always be disabled.
You don't want to allow a root login directly,
because that would mean that the attacker already has
half of the information required to log in to your server.
AllowedUsers is a nice option.
It allows you to specify a list of users
that is allowed to log in.
By default, any user with an account can log in,
but if you use AllowedUsers
and you specify just one SSH user
with a not-so-frequent username,
that would be a lot more secure.
PasswordAuthentication is the last option to consider.
By default, password authentication is allowed.
Why would you allow that, if you know that
key-based authentication is much more secure?
If you are going to change the settings on your SSH server,
you do need to consider firewalling, though.
If you have firewalld firewall on Red Hat family,
SSH by default is allowed.
But if you are running on a non-default port,
you need to change something.
Just to make sure,
this is the line to ensure that on firewalld
the SSH port is allowed.
But if you use a non-default port, you use
firewall-cmd --add-port 2022/tcp --permanent
After which you reload the firewall
using firewall-cmd --reload
Now, firewalling is different between Red Hat and Ubuntu.
If you want to do something similar on Ubuntu,
you use ufw, the Uncomplicated Firewall.
So sudo ufw allow OpenSSH,
and sudo ufw allow 2022/tcp
if you want to allow the TCP port.
Then there's this other thing.
On Red Hat only, you have SELinux,
and SELinux on Red Hat
will not allow SSH to run on non-default port.
And if you want to configure SELinux
to allow a non-default port as well,
you need to run this command:
semanage port -a -t ssh_port_t -p 2022 tcp
That will flag port 2022/tcp
as a port that is allowed for SSH.
Another option, which is not so very pretty,
is to edit the /etc/sysconfig/selinux configuration file
and set SELINUX to disabled,
and then you reboot.
But then you make your system insecure.
And that doesn't really make sense,
because the mission here was to secure SSH.
And in order to have a secure SSH,
it should be running on a secure system.
Now, let me demonstrate how we can apply
some of this SSH security to an SSH service.
All right, I'm going to start on this CentOS machine
by editing ssh/sshd_config
So I want to change the ports,
because this port really is a problem.
And I want to set the port to Port 2022.
If you look carefully, then you can see
that the SELinux information is already included here.
"semanage port," it's telling me which command to use.
Some people will often complain about SELinux,
and I know SELinux is complicated,
but on Red Hat family systems,
if changes of common parameters
affect SELinux security state,
then it's often indicated in the configuration file.
So if you can read, should be doable,
even without having a full understanding
of what is going on.
This course is not a place to tell you about SELinux.
That's more advanced system administration,
and not really Linux fundamentals.
But we can easily copy-paste this command, right?
So there we go, and this should make sure
that SELinux allows port access.
Then the second thing is the firewall.
So sudo firewall-cmd --list-all
is showing the current firewall configuration.
And on Red Hat family systems,
by default SSH is allowed,
but port 2022 is not allowed.
So let me use
sudo firewall-cmd --add-port 2022/tcp --permanent
That will write this port to the firewalld configuration.
And next we need firewall-cmd --reload
That will reload and, oh, I need superuser powers.
So there we go.
That will reload the firewall with the new setting.
So if I'm using firewall-cmd --list-all
at this point,
I am getting port 2022/tcp.
So now the SSH server is configured
in a somewhat more secure way.
Let's continue,
and let's see how we can tell the SSH client about it.