Top 10 Tips to Secure SSH Your Server
Tags: server, tutorial, security, linux
Published: 2019-03-16 04:18:04

---
title: Top 10 Tips to Secure SSH Your Server
published: true
description: The SSH protocol is a secure method to remote login one server to another server. It provides several alternative options for strong authentication, and it protects the communications security and integrity with strong encryption. It is a secure alternative to other protocol like telnet and file transfer protocol FTP.
tags: SERVER, tutorial, Security, linux 
---

![Secure SSH Server](https://i2.wp.com/acmeextension.com/wp-content/uploads/secure-ssh-server.jpg?fit=800%2C400)


The SSH protocol is a secure method to remote login one server to another server. It provides several alternative options for strong authentication, and it protects the communications security and integrity with strong encryption. It is a secure alternative to other protocol like telnet and file transfer protocol FTP.

**Locate SSH server configuration file-**
All the changes we are going to discuss will be done in SSH configuration file. This file can be found at /etc/ssh/ssh_config

open this config file using-
<pre>sudo nano /etc/ssh/ssh_config</pre>

<h2>1. Use a different port than 22</h2>
22 is the default port used by SSH protocol. You should not use the default port as it is easy to guess and more vulnerable to brute-force attacks.

To change the default port change the following line(here we are using port 221 instead of port 22).

<pre>Port 221</pre>

<h2>2. Use Protocol SSH 2 only</h2>
The earlier protocol SSH 1 contains many security vulnerabilities. so you should be using SSH 2 instead of SSH 1. SSH 2 should be set to 2 by default. If not you can change using

<pre>Protocol 2</pre>

<h2>3. Disable Direct root login</h2>
Allowing direct root login is one of the most dangerous security hole you can have. No server should be allowed to direct root login through SSH.

To disable direct root login change PermitRootLogin to no from yes

<pre>PermitRootLogin no</pre>

If you really need to log in as root you can add a primary user to login first and you can log in as a root user

to add a user

<pre>useradd peter
passwd peter</pre>
this is an example. I highly recommend using a very strong password.

Once you login to user peter you can switch to root user by using

  
<pre>su -</pre>

<h2>4. Use public_keys instead of passwords</h2>

There are 2 ways to login to an SSH server- using a password or public/private keys. You should be using public keys to login to SSH server security. You can use this link to configure SSH login without a password.

After ensuring your key based login is working properly you can disable password based login using

<pre>PasswordAuthentication no</pre>

<h2>5. Enable two-factor authentication</h2>
You should enable two-factor authentication on your SSH server to make it more secure. So if someone tries to brute force your server, can be blocked by 2-factor authentication.

Google authenticator is one of the most trustworthy and widely used authenticators. You can enable Google authentication on your server using this link.


[**Execute a PHP file on Remote Server Using SSH**](http://acmeextension.com/execute-php-file-remote-server-using-ssh?from=devto)


<h2>6. Disable Empty Passwords</h2>
You should not allow remote login with an empty password. if you allow login with empty password your server is more vulnerable to the brute-force attack.

To disable empty password login set

<pre>PermitEmptyPasswords no</pre>

<h2>7. Use strong passwords and passphrase for ssh users/keys</h2>
Most of the server got attacked because of the weak password. They use easy to guess password like the brand name or some universal password like 123456 or qwerty. Weak password is more likely to cracked by brute-force attacks.

You should be using a very strong password and passphrase to log in your SSH server.

<h2>8. Configure Idle Timeout Interval</h2>
To avoid having an unattended SSH session, you can set an Idle timeout interval.

<pre>ClientAliveInterval 360
ClientAliveCountMax 0</pre>
The idle timeout interval you are setting is in seconds (360 secs = 6 minutes). Once the interval has passed, the idle user will be automatically logged out.

Execute a PHP file on Remote Server Using SSH

<h2>9. Disable port forwarding</h2>

Hackers can use port forwarding technique to tunnel network connections through an SSH session to login into systems.

To disable port forwarding –

<pre>AllowTcpForwarding no
X11Forwarding no</pre>

<h2>10. Restrict SSH logins to specific IP addresses</h2>
By default, SSH will accept connections from any external IP address. If you want to restrict SSH to only allow a connection from a specific IP address, you can add a ListenAddress line.

For example, if you want to only accept SSH connections from IP address 192.168.1.2 you would add the line:

<pre>ListenAddress 192.168.7.2</pre>
**Restart SSH server**
After making any changes to sshd_config file do not forget to restart the SSH server.

<pre>sudo service ssh restart</pre>

Reference - [Secure SSH Server](http://acmeextension.com/secur-ssh-server?from=devto)


<h2>Conclusion</h2>
By making these changes your server will be secure than most of the server and will not be easy for attackers to walk into your server.