Key measures to protect SSH servers include: ① Disable password login and switch to high-strength SSH key authentication; ② Modify the default port to reduce the risk of automatic attacks; ③ Restrict logged-in users and IP access; ④ Optionally enable Fail2ban defense against brute force cracking. The specific approach is to generate a 4096-bit RSA or ed25519 key pair, save the private key locally, add the public key to the server authorized_keys file, and close PasswordAuthentication in sshd_config; change the SSH port to a non-privileged port such as 2222 and adjust the firewall rules; limit the login account through AllowUsers/AllowGroups, and restrict the source IP in combination with iptables/ufw; finally, Fail2ban can be deployed to monitor abnormal login behavior as needed. These steps can significantly improve the security of SSH services.
To protect SSH servers, the key is to reduce the attack surface, strengthen the authentication mechanism, and restrict access. SSH is the core tool for remote management of servers, but it is also a common target for hackers. Therefore, everything from configuration to daily use needs to be handled with caution.
Disable password login and use key authentication instead
Passwords are easily brute-forced, especially simple or default account passwords. A safer way is to authenticate with an SSH key pair.
- It is recommended to use
-t rsa -b 4096
ored25519
type when generating the key to ensure sufficient strength. - Private key files (such as
id_rsa
) must be saved locally and cannot be disclosed. - Add the public key to the
~/.ssh/authorized_keys
file on the server side. - Modify the SSH configuration file
/etc/ssh/sshd_config
, setPasswordAuthentication no
, and then restart the SSH service.
After doing this, only users holding the private key can log in, greatly improving security.
Change the default port to reduce the risk of automatic attacks
SSH runs on port 22 by default, which is the preferred target for most automated scanning and attack tools. Changing the port can effectively avoid many indiscriminate attacks.
- Open
/etc/ssh/sshd_config
, findPort
line, and modify it to an unprivileged port, such as2222
. - Ensure that firewall rules allow new ports to communicate.
- Restart the SSH service to enable the configuration.
While this does not prevent targeted attacks, for most scenarios, exception login attempts in logs have been significantly reduced.
Restrict logged-in users and IP access
Not all system users should have SSH login permissions. Reasonable control over who can log in through SSH and where to log in is an important step in reinforcement.
- Use
AllowUsers
orAllowGroups
to specify a user or group that can be logged in:AllowUsers user1 user2
- In conjunction with a firewall (such as iptables or ufw) restricts SSH ports to be accessed only by a specific IP address.
- This is especially useful if you only operate a server on a fixed network at your company or at home.
For example, your office IP is 192.168.1.100
, you can set it in the firewall that only allows the IP to connect to the SSH port.
Optional: Enable Fail2ban or similar tools
Fail2ban can monitor SSH login attempts and automatically block the IP address after multiple failures are detected.
- After fail2ban is installed, the default configuration usually includes protection against SSH.
- The rules in
/etc/fail2ban/jail.local
can be adjusted as needed, such as the failure threshold and the blocking time. - The blocking method can be iptables or the firewall API of cloud service providers can be integrated.
This is not a must, but if the server is exposed to the public network and there are frequent blasting attempts, turning it on will be a good choice.
Basically that's it. By doing these steps, your SSH service is already much safer than most default configurations.
The above is the detailed content of How to secure SSH server. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

Commands to properly close Linux systems include shutdown, halt, poweroff and reboot. Among them, shutdown is the most recommended, which can arrange shutdown time and send notifications; halt directly stops the system operation; poweroff cuts off the power supply based on halt; reboot is used for restart. To safely arrange a timed shutdown, you can use sudoshutdown-h 10 to indicate shutdown after 10 minutes, use sudoshutdown-c to cancel the timing, and add prompt information such as sudoshutdown-h23:00 "The system will be shut down at 11 o'clock tonight." Under the graphical interface, you can select Shutdown through the menu in the upper right corner.

The steps to add a new hard disk to the Linux system are as follows: 1. Confirm that the hard disk is recognized and use lsblk or fdisk-l to check; 2. Use fdisk or parted partitions, such as fdisk/dev/sdb and create and save; 3. Format the partition to a file system, such as mkfs.ext4/dev/sdb1; 4. Use the mount command for temporary mounts, such as mount/dev/sdb1/mnt/data; 5. Modify /etc/fstab to achieve automatic mount on the computer, and test the mount first to ensure correctness. Be sure to confirm data security before operation to avoid hardware connection problems.

Problems with device drivers will cause the hardware to not be used normally, such as peripherals not responding, system prompts "unknown device" or game stuttering. The solution is as follows: 1. Check the warning icon in the device manager. The yellow exclamation mark represents the driver outdated or compatibility problem. The red cross indicates that the hardware is disabled or the connection is poor. The question mark or "Otherdevices" means that the system has not found a suitable driver; 2. Right-click the device and select "Update Driver", try automatic search first, and manually download and install; 3. Uninstall the device and check delete driver software, and after restarting, let the system re-identify, or manually specify the driver path to install; 4. Use the driver identification tool to assist in finding models, but avoid downloading drivers from unknown sources; 5. Check Windows updates to obtain

Managing AWSEC2 instances requires mastering life cycles, resource configuration and security settings. 1. When selecting an instance type, select C series for calculation-intensive tasks, and select M or R series for memory-sensitive applications, and start with small-scale testing; 2. Pay attention to security group rules, key pair storage and connection methods when starting the instance, and Linux uses SSH commands to connect; 3. Cost optimization can be achieved through reserved instances, Spot instances, automatic shutdown and budget warning. As long as you pay attention to the selection, configuration and maintenance, you can ensure stable and efficient operation of EC2.

The top command can view the Linux system resource usage in real time. 1. Enter top through the terminal to open the interface, and the top displays the system running status summary, including load, task number, CPU and memory usage; 2. The process list is sorted by CPU usage by default, which can identify highly occupant processes; 3. Shortcut keys such as P (CPU sort), M (memory sort), k (end process), r (adjust priority), and 1 (multi-core details) improve operation efficiency; 4. Use top-b-n1 to save output to a file; 5. Adding the -u parameter to filter specific user processes. Mastering these key points can quickly locate performance issues.

In Linux systems, network interface information can be viewed through ip, ifconfig and nmcli commands. 1. Use iplinkshow to list all network interfaces, add up parameters to display only active interfaces, and use ipaddr or ipad to view IP allocation status; 2. Use ifconfig-a to be suitable for old systems, and you can view all interfaces. Some new systems need to install net-tools package; 3. Use nmclidevicestatus to be suitable for systems managed by NetworkManager, which can view interface status and connection details, and supports filtering and query. Select the appropriate command according to the system environment to complete the network information viewing.

The management software RAID array can be maintained through several critical steps. First, use the mdadm command to view the status or view /proc/mdstat; secondly, replace the hard disk and remove the bad disk and add a new disk and rebuild the array; thirdly, expand the capacity to be suitable for RAID types that support capacity expansion by adding disks and adjusting the file system; finally configure daily monitoring to automatically detect abnormalities through scripts and email notifications to ensure the stable operation of the array.

Running Ansibleplaybook requires first ensuring that the structure is correct and the environment is prepared. 1. Write a playbook file, including hosts, tasks, etc.; 2. Ensure that the target host is in the inventory and can be connected through SSH, and can be tested by ansibleping module; 3. Use the ansible-playbook command to run, and you can add -i to specify the inventory path; 4. You can use -v, --check, --limit, --tags and other parameters to debug or control execution; 5. Pay attention to common error points such as YAML indentation, module parameters, permissions and inventory content. Using --check and -v will help troubleshoot errors
