Hey, folks, welcome to Configure and Secure S.H. What exactly is SS H SS Age stands for Secure Shell.
All right.
Now, what is a shell?
Well, Shell provides you with an interface to the Linux system.
It takes in your commands and translate them to kernel to manage the hardware.
So let's visualize it.
We have our hardware.
So whatever the hardware that you have, Dell, HP doesn't really matter.
So on top of their hardware, the layer that controls that hardware is the kernel layer.
And who actually controls that kernel layer?
The shell.
So there are different type of corn shell, seashell bash, all the shell.
When you actually log into your Linux machine and you get a prompt and you type in the commands for
those provide that environment is a shell.
It's it's actually a platform that's given to you to control or give commands to your kernel and then
you run utilities on top of that shell.
So when when you are given the shell prompt, you run commands like Ellis, P.W., the copy or whatever
the commands, the Linux standard commands or other commands that you can run.
All right.
So if you notice you probably familiar, you look at that shell, it's most likely if you're not going
to console, if you're putting into it a terminal and doing the shell, looks like that in most cases,
the regular user, when a user logs in, they get a dollar sign.
When a route logs in, they get a hash sign or pound sign.
All right.
Open SSL, which is a package or it's a software like any of the package.
So let's say if you're installing a guaranteed package or A.P. package, HDTV package.
So that package, SSL is also a package and that package name is open.
S.H. by default, when you install a Linux or Red Hat on your computer that opens a search package,
comes installed on your system, it's service.
Deman is is HD.
Adilman is something that runs in the background all the times and listens for commands or execution's.
So when we run open S.H., it starts Deman and that Deman name is SAHD.
You could stop and restart its deman if you know the name of the demon.
So now which port that SSA service runs on by default, the SSA port runs on port number twenty two.
Many programs in Linux have a dedicated port numbers that by default they run on.
All right.
Secich itself is very secure, meaning communication through Sensage is always encrypted.
But there should be some additional configuration can be done to make it more secure.
All right.
Following are the most common configuration and administrator should take to secure S.H..
Now, I'm going to go through some of these configuration.
And by the way, those configuration are not just the only ones.
There could be a lot more, but the very most common ones are as follows.
The very first one is configuring idle time out, and it means avoid having an unattended SSA session.
You could set an idle time out in Turbo by following this direction.
So idle time on meaning when you log into the system or when you put it into the system and let's say
you are being pulled into a meeting, but your computer or you log in session is still there.
So if you leave it open, maybe it's vulnerable and someone could get access to it.
So it's better that you sit in time out and terrible to set that time on enterable.
You have to become route added at the SSA slash SSA underscore config file and add the following lines,
which is client.
Alive enterable 600 client alive, count Max zero, and then you have to restart that demon and the
demon is SAHD, the command is system ctl restart sicad the idle time and Turnersville you are setting
is in seconds.
So we set six hundred, which means it's equal to ten minutes.
You could change it according to your policy, your desire, your standard.
Once the entire interval has passed, the idle usable will be automatically logged out.
All right.
So if I go into my Linux machine I have it open right here.
Let me log in.
I will log in as myself and let me open up the terminal by going to Activities Terminal.
OK, here I am logged in as myself.
I have to become Route Asuda Cheroot now before you modify the SAHD underscore config file, it is always
recommended.
That's my recommendation to a system.
Administration should always make a backup copy of the SSA should underscore config file or any file
sea for that matter.
In case you make a mistake, you can always report back.
So what I'll do is I'll do a copy at C S.H..
I should underscore config and what's the location I'll put in the same location as D underscore config
and I will do Dasch Orridge.
Meaning that's the original.
OK, so copy is done now if you want.
If you have to set that interval time out, then you have to edit the file by buying the file at Secich
SAHD, underscore config.
And then you have to add add these lines.
These are these lines don't already exist.
So it's best that you add these line toward the end of the file.
So to in order to go to the end of the file type shifted G and it will bring you to the end of the file
now hit.
Oh to start a new line.
You could put a comment here setting.
Enterable.
Sorry, sitting time out.
Enterable.
And now you could type in client.
A live.
Into her, well, space, six hundred them client alive, count Max zero.
So now when you escape and save the file and now it's time to restart your system, CTO System CTL restart
SS HD.
When you get your job back, it means the system took the setting and it was not any wrong sitting.
By the way, if it is just for you to show you, if you do not have to set the setting, the environment
is not a requirement, then talk to your security guy and ask if you should make that changes before
getting any approval.
All right.
So what I will do just to make sure we have a consistent setting in our file.
What I'll do is I will copy ATSE, S.H., SAHD underscore config under a dash Orridge file to its original.
Configuration, it will ask overwrite.
Yes, all right, so now if I go V.I. that at S.H. SAHD and just go config file and go to the end,
you will see that setting no longer there because I override it.
All right.
So if you need to keep that, it's really up to you.
All right, then coming back, the next setting that we should do is disable rule log in, disabling
rule log, and should be one of the measures that you should take when setting up the system for the
very first time, disable any user to log into the system with the rude account.
So you should definitely do that to no user can log in directly with user root and the root password.
All right.
In order for that, you could go back to your system and right here is telling you that you have to
edit the file and replace permanent root log in to.
Yes.
And replace it to no.
OK, so let's do VEI again and let's find out where that configuration is aware that parameter is.
In order to find that parameter, you type in slash and then permit route logging hit enter and you
will see right here, it says permit logging replace yes to no.
Save the file and restart SSTO.
All right.
Moving on to the next one.
The next one is disable empty passwords.
So you need to prevent remote logins from accounts with empty password for added security.
So any user that does not have a password, they should be there should be limited.
They should be forced to not login unless they create a password.
And for that, you have to edit the file and remove hash sign from the following line.
So let's go to our Linux machine via the Linux machine again.
So we had the configuration file again and look for permit empty.
Passwords right here.
That's a parameter if you remove this hash pound sign and save the file and restart the demon, then
it will take those configuration.
All right, moving on to the next one limit, it uses SSA x axis to provide another layer of security.
You should limit your sexual organs to only certain users who will need remote access.
So if you know that John and Jason and Peter, those are the three users that only need access to your
system, then why keep it open to everyone?
Just give them the access and then by default, automatically everyone else will be denied.
For that, you have to edit this file and add these lines to allow users, user, one user to whichever
they use a name that you have created in your system.
I would say since we are adding this line, I would say you have to go back to your Linux machine and
go all the way to the end by entering shift.
And here always, any time you add any new parameters, always put in the comment that allow.
The following uses only and then you will do allow users, for example, I have R or Jay Smith or whatever
that you have, then save the file, restart the demon.
So I'm not saving it.
Since we are doing only for lab purposes, I'm just going to quit.
If you saved it, then you will have to restart this SAHD.
All right.
Moving on to the next configuration.
Use a different port.
Now we do know that SSD runs on Witchboard.
Yes, it runs on by default it runs on twenty two so most Rackers looking for any open S.H. servers
will look for twenty two.
So changing that can make the system much more secure.
In order to change that you have to become route.
Edit your SSD, underscore config file and remove that hash sign from the following line and change
the port number.
So you already have a port number there by default is twenty two.
So let's go into a Linux machine via RSS feed underscore config file.
By the way, as you're going into being the file, please continue to make copies.
Now look for PT. 22.
So simply type slash and type it in uppercase P or T hit enter.
It will bring you down to the line which has that key, that matching word right here says POR 22.
Now if you want to change it to a different port, you have to get rid of this hash sign and put in
the port.
No.
Ta ta ta ta.
For example.
Now, I'm coming up with on this point, first of all, this is a very huge, big port.
No, none of the programs that comes in the Linux system have any of these ports aside.
Still, I want you to make sure whatever the port that you're assigning to this SSA is not being used
by any other programs, you could search online to see which ports are available that can be used for
SSA and you will find a lot of them.
All right.
So anyway, I'm not changing the board.
I'm just going to discard any changes by quitting the file and getting out of it.
So if you have make changes, you have to do System CTL restart SNH and that will set you apart.
So next time when you are trying to log into the system to SSA or PUDI, then you have to change that
port.
For example, if I open up my PUDI session right here, I would put in the IP address of my Linux machine.
But you see right here that by default is giving report 22.
So if I try to have it for twenty two and click open, it would not let me get in because I have the
port.
So I have to put in that port that I picked, which was two to two to four for example, then put in
the hostname or IP address and then click open and then it will allow me to connect.
All right.
Moving on to the next one, which is SSL keys access remote server without a password.
OK, so remote server, you you have a Linux machine and you you are trying to access that from a Windows
or from another Linux machine, for example.
Then you could actually skip entering the password because you would have the keys.
By the way, that lecture I have done in the next one.
So stay tuned, go to the next next video to understand and configure your SS keys.