Introduction

This guide explains different methods to secure your Webdock SSH server. SSH or secure shell is a communication protocol used to administer the remote servers securely. We will discuss the following options in the SSH configuration file which impact security:

• Changing the default SSH port
• Using public/private key pair instead of password
• Allow a single IP to login
• Setting up idle timeout
• Setting up limited password retries
• Disabling X11 forwarding
• Disable root login

Prerequisites

• Webdock cloud Ubuntu instance (18.04 or later)
• You have shell access to your VPS

Note: “sshd” is the service name on some distros. So if “ssh” service is not found and can’t be restarted, you need to restart “sshd” instead

Using public/private key pair instead of password

Please note: This is already the installed default in Ubuntu and thus on Webdock Servers. You can enable Password authentication (not recommended) on the Shell Users screen in Webdock.
Using a public/private key pair to access an SSH server is more secure than using password based authentication. A password protected SSH server is more vulnerable to the brute force attacks.

Open the /etc/ssh/sshd_config file.

$ sudo nano /etc/ssh/sshd_config

And set the PasswordAuthentication option to no.

PasswordAuthentication no

Restart the SSH server to apply changes.

$ sudo systemctl restart ssh

Allow only a single IP to login

The default configuration of the SSH server allows the SSH server to accept connection from any IP address. Restrict your SSH server to accept the connections from your trusted IP addresses only. You do this by configuring your firewall to only accept connections from a specific IP to a specific port on your server.

Please note: Make sure your trusted IP addresses are static. Otherwise your trusted IP may change and you will not be able to access your server.

Warning: Limiting to a single IP will break our Web SSH Terminal functionality. You can allow 157.90.77.137 and 2a01:4f8:141:4398::607 which should retain access through Web SSH (as of late 2021) but these IPs may change at any time.On Webdock Perfect Server stacks where we use UFW and your IP is 192.168.0.200 and SSH is on the default port 22, you would execute:

$ sudo ufw allow from 192.168.0.200 to any port 22

Keepalive / timeout settings

On Webdock Perfect Server stacks we keep the connection alive by default with the below settings. But you can remove these lines if you do not want to keep connections alive and time them out automatically. On a stock Ubuntu install, connections will be dropped after a minute or two of inactivity automatically.

Open the SSH configuration file.

$ sudo nano /etc/ssh/sshd_config

And set the value of TCPKeepAlive, ClientAliveInterval and the ClientAliveCountMax options.

TCPKeepAlive yes
ClientAliveInterval 60
ClientAliveCountMax 3

Before dropping the connection, the SSH server will check the status of the client after 60 seconds of inactivity and send null packets to keep the connection alive. If no response is received the server will repeat this process two times before terminating the connection.

Restart the SSH server to apply changes.

$ sudo systemctl restart ssh

Setting up limited password retries

Setting up limited password tries is a good way to prevent your SSH server from brute force attacks., in addition to fail2ban which does this automaticaly for SSH The SSH server provides configuration to set the number of authentication attempts permitted per connection. Open the SSH configuration file.

$ sudo nano /etc/ssh/sshd_config

And set the value of the MaxAuthTries option.

MaxAuthTries 3

The SSH server will allow only 3 login attempts per connection.

Restart the SSH server to apply changes.

$ sudo systemctl restart ssh

Disable root login

Using the root user to access the SSH server is not a good practice. Always access the SSH server using non privileged user accounts.

Please note: Root login is already disabled by default in Ubuntu and thus also on Webdock servers.

Open the configuration file.

$ sudo nano /etc/ssh/sshd_config

And disable the root login using the PermitRootLogin option.

PermitRootLogin no

Now the root login is disabled and the SSH server can only be accessible by a non root user.

Restart the SSH server to apply changes.

$ sudo systemctl restart ssh

Conclusion

In this tutorial we discussed how we can harden the security of our SSH server by modifying various security related configuration on a typical Ubuntu server.