How to Configure SSH on a Linux Server: Comprehensive Guide for Beginners

Himanshu Joshi Knowledgebase

SSH (Secure Shell) is a cryptographic network protocol that allows secure remote access to Linux servers. It is widely used by system administrators to manage servers and other devices over unsecured networks. SSH offers encrypted communication, making it an essential tool for managing Linux servers securely. Properly configuring SSH ensures that unauthorized access is prevented and enhances the overall security of the system.

Install OpenSSH and Configure SSH

In this guide, we’ll walk you through the entire process to configure SSH on a Linux server, from installation and basic configuration to securing your server and setting up key-based authentication. We will also cover best practices to enhance the security of your SSH connection.

Prerequisites

Before configuring SSH, make sure you have the following:

  • A Linux-based server (Ubuntu, CentOS, Fedora, or any similar distribution).
  • Root or sudo access to the server.
  • Basic knowledge of Linux commands and the terminal.
  • Internet connectivity for installation and updates.
  • Firewall privileges (if needed) to adjust the firewall settings.

Once you’ve verified these prerequisites, you’re ready to begin setting up SSH on your server.

Install OpenSSH Server

To begin using SSH, you need to install the OpenSSH server on your Linux system. OpenSSH is an open-source implementation of the SSH protocol that is commonly used on Linux.

For Ubuntu/Debian:

  • Update the package list:
sudo apt update
  • Install the OpenSSH server:
sudo apt install openssh-server
  • Start the SSH service:
sudo systemctl start ssh
  • Enable SSH to start automatically on boot:
sudo systemctl enable ssh
  • Verify the installation:
sudo systemctl status ssh

For CentOS/RHEL:

  • Install the OpenSSH server:
sudo yum install openssh-server
  • Enable and start the SSH service:
sudo systemctl enable --now sshd
  • Verify the status of the SSH service:
sudo systemctl status sshd

Check Listening Port:

You can confirm that SSH is running by checking the listening port:

sudo netstat -tulnp | grep ssh

Secure SSH Configuration

The default SSH settings are sufficient for basic usage, but they leave your server vulnerable to brute-force attacks. It’s important to secure your SSH installation by adjusting its configuration.

Edit SSH Configuration File:

  • Open the SSH configuration file:
sudo nano /etc/ssh/sshd_config
  • Disable root login: Prevent unauthorized users from accessing the system as root by disallowing direct root login.
PermitRootLogin no
  • Allow specific users only: Restrict SSH access to authorized users only.
AllowUsers username
  • Disable password authentication: To enforce more secure logins, disable password-based authentication and use SSH keys instead.
PasswordAuthentication no
  • Change the default port (optional): By default, SSH listens on port 22. Changing the port can reduce the number of automated attacks.
Port 2222
  • Apply the changes:

After modifying the configuration file, restart the SSH service to apply the changes.

sudo systemctl restart sshd

Set Up SSH Key-Based Authentication

Using SSH keys for authentication is more secure than using passwords. This method eliminates the risk of brute-force attacks and ensures that only users with the private key can log in.

Generate SSH Keys on the Client Machine:

  • Generate a new SSH key pair (public and private keys):
ssh-keygen -t rsa -b 2048 -C "your_email@example.com"
  • Follow the prompts to save the keys. The default location is ~/.ssh/id_rsa.

Copy the Public Key to the Server:

  • Copy the public key to your server using the ssh-copy-id command:
ssh-copy-id username@server_ip
  • Verify SSH key-based login by attempting to log in to the server:
ssh username@server_ip

Disable Password Authentication:

  • To enforce SSH key-based login, disable password authentication in the SSH configuration file.
PasswordAuthentication no
  • Restart SSH:
sudo systemctl restart sshd

With key-based authentication, you have a more secure login mechanism in place for accessing your Linux server remotely.

Configure SSH for Remote Access

By default, SSH is configured to allow remote access, but if your server is behind a firewall or uses a custom network configuration, you may need to modify the firewall settings and adjust network configurations.

Allow Remote Connections:

Adjust the firewall to allow incoming connections on the SSH port (usually port 22 or a custom port if changed):

  • For UFW (Ubuntu/Debian):
sudo ufw allow ssh
  • For Firewalld (CentOS/RHEL):
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload
  • Test remote access by attempting to connect from a different machine using:
ssh username@server_ip

Monitor and Maintain SSH Access

Regular monitoring of SSH access helps identify any unauthorized login attempts or security breaches.

View SSH Login Attempts:

To check the SSH login attempts, you can use the following command:

sudo journalctl -u sshd

Install Fail2Ban:

Fail2Ban helps protect your server from brute-force attacks by banning IP addresses that show suspicious behavior.

sudo apt install fail2ban # Ubuntu/Debiansudo yum install fail2ban # CentOS/RHEL
  • Configure Fail2Ban to protect SSH:
sudo nano /etc/fail2ban/jail.local
  • Add or modify the SSH settings:
[sshd] enabled = true port = ssh logpath = /var/log/auth.log maxretry = 3 bantime = 3600
  • Start Fail2Ban:
sudo systemctl start fail2bansudo systemctl enable fail2ban

Conclusion

By following the steps outlined in this guide, you’ve successfully configured SSH on your Linux server, ensuring secure remote access. You’ve learned how to install SSH, secure your configuration, set up key-based authentication, allow remote access, and monitor SSH activity.

For added security, make sure to disable password authentication, regularly rotate SSH keys, and monitor access logs for unusual activities. SSH is a powerful tool for remotely managing servers, and with these best practices, you can ensure that your SSH access remains secure and reliable.

For more advanced SSH security configurations, refer to the official OpenSSH documentation.

Tags:
Leave A Comment