In this video, you learn how to harden your S SSH server.
Our plan is to explore how to harden SSH server. Amazon Lennox does a good job,
but we'll review five configuration parameters that you should make sure are
set.
You will test the SSH server changes for any errors and then restart.
Here are the five configuration changes that we're gonna go over in our config
file. Some of these will already be set as the default,
but it's better to be explicit and set them anyway.
Once we are in the configuration file,
I'll go over what each of these actually do.
Permit route login should be set to know password authentication should be set
to know.
Max auth try should be set to three client live interval should be set
to 300 x 1140 should also be set to know.
Okay, let's get started. Okay,
so we're gonna set some explicit configuration settings in our S SSH server.
The configuration file for the SSH server is located under the Etsy directory,
under the Etsy s SSH direct to be explicit.
And our config file is SS h d underscore config.
You will need pseudo access to run any of the ssh uh commands and also to make
any changes to this file or restart the service.
So let's go ahead and open up our config file in your editor.
Don't forget pseudo
and ss h d underscore config. Make sure you get that one.
Cause we want the one for the server. Okay.
So as you can see here,
there's a lot of configuration changes and the format of it is like it'll
be the name of the setting and then the value.
So a lot of these are commented out, not because uh,
they're not in use, but some of these are defaults. Like port 22 is the default,
but they have it here, commented out.
We're gonna ignore all that and we're just gonna go through what we and do what
we think is right. And this way,
if you're ever on a host that is not set up like this, you will know what to do.
Okay, so let's go down to our first one here under the authentication level.
And it says permit root login. So if we set this to yes,
if we uncommon this and we keep it as yes,
that means root can log into our SSH server.
We don't ever want route to be able to log into a host v SSH root account is
very special and uh, we don't want to just be using it for everyday activities.
That is what pseudo is for. If you need some temporary elevated permission.
So we are going to change the permit route Login into
No, we're gonna set it explicitly, no.
Okay. So there is another one that we're gonna go to here,
which is max off price.
I'm gonna just gonna go in a row here as we see them on the screen.
They may not be the exact same. They, they were laid out in the uh,
slide though. So Max Auth tries.
So this sets the max amount of login attempts the server will allow.
This should help cut down some of the brute force attacks we were seeing in the
last video. So we're gonna set that to three. Okay.
And we're gonna keep going down here. Okay,
so this permit empty passwords is no,
sometimes you can create users that with, uh, without a password,
but instead of allowing non empty passwords,
we're just not gonna allow passwords at all. And as you can see on line 62 here,
password authentication is set to know.
This will deny anyone trying to log into the host using their Lennox account
password. This means that everybody who wants to access this host must be using,
uh, your key, a key pair. So it's already set to know. So we'll just leave that,
uh, we'll keep going down here.
Okay, the next one we're gonna talk about here is the X 11 forwarding.
So the X 11 server is a graphical server and it can be used.
One of the neat things it can do is, um,
you can have a graphical application running on one host remotely and on the
client that you're ss from,
you can have it forward or tunnel that application information over to your
screen. So it's like you're actually on that machine, but you're not,
you're using your own, uh, X 11 server. While that is a great feature,
it's not shrouded in security, excuse me,
it's not shrouded in security. So if we don't need it, you should turn it off.
You know,
the least amount of stuff you can do is a great security habit in something you
should always be in, uh, looking forward to.
So we're also gonna come down here and we're gonna say client interval.
Okay? So the client interval is, uh, this will limit the client connection.
Idle state right now, zero means unlimited.
The client connection will just stay alive forever. Basically,
if the client does not respond with a keep alive,
the server will sever the connection, which is what we want.
You don't wanna have a whole bunch of long-lived SSH connections connecting
into, let's say a production host. You leave your laptop, uh,
unlocked or something, somebody comes in, now they have full access.
So we're gonna uncommon that. Remove the pound sign and we're gonna set this.
We go to insert mode with I and Vim and we're gonna set this to 300, which is,
should be five minutes.
Okay? Let's just go down here to the bottom. Uh,
we just wanna make sure we're not missing any. Um,
here's a good example as well. You could do a match, which is really nice.
So if you wanted to match for a specific user that you could disable or
enable settings based on that user.
So like remember when we created the Acui user,
you could do something here that says, uh,
we want a ki to be able to x 11 forward and they could use,
uh, the password, the condition for only for them, them.
But we're not gonna use that here. I just want you to know exist. All right,
so we're gonna shift colon x, we're gonna write and quit out of this file.
We wanna save our changes obviously. So what we're gonna do,
I'm gonna clear the screen and what we're gonna do is we're gonna use pseudo and
we're gonna use the SS h d command.
But what you're gonna use a capital T and what the capital T does is gonna test
our configuration file for errors.
So reason why you want this is a good habit to get into is let's say I made an
error in that configuration file and then I go to restart our S SSH server and
it doesn't come back up. I don't realize it, it doesn't work.
And then now nobody can access it. So it's important to go ahead and run this.
So if you run this, it'll spit out errors and lines, uh,
where it thinks is a problem. If it is not an error,
you'll get the output of basically a summary of all this overall setting.
So let's go ahead and pseudo S S H D minus T here now. Okay,
so as you can see, there was no errors that came out.
I'll scroll over here to the top. Excuse the uh,
fast scroll and we could see here these are all the defaults,
everything that's been using. And let's see,
we could see here max off retry or tries is now three,
which is what we set it to. Client interval is 300,
the client alive count max. Um, what this basically does, it says,
okay, the five minutes is up,
I'm gonna send you a keep alive and I will do that three different times before
I kill the connection.
You could honestly lower that to one if you really wanted to,
or two in case cuz I mean network hiccups do happen, but let's keep going down.
Permit route login is no, which is exactly what we wanted.
X 11 forwarding is no.
All right, so that is all that.
The rest of this you can safe ignore. These are just other commands that,
that were not either set or commented out in the uh, file.
But now, so the next thing we want to do is we wanna restart our s SSH server.
Now, it shouldn't drop your connection. Nothing should happen.
So let me go ahead and clear the screen.
And then I am going to do pseudo system CTL restart SS
HD dot service. I'll go ahead and pause the video here,
cause this might take a second and then I'll be right back. Okay,
so here we are. I restarted it. Um, my connection wasn't severed.
And if we run the SS H D T command, um, I'll scroll back up.
And our settings are now permanent.
So any new connections coming in, we'll have to obey by these rules.
All right, so there we are with the five quick, easy, uh, hardening tips.
Um, let's jump back over and let's do a full recap. Okay,
so let's talk about what we did. In this video,
you learn how to harden an s SSH server on Lennox.
You explicitly set five parameters like password authentication,
permit route login, and X 11 forwarding. To improve our SSH security posture,
you applied changes and tested the configuration file for any errors using the
SS h d command. Well,
we've reached the end of section six, Lennox Security.
In this section you gotta crash course in authentication and Lennox security.
You learn how to monitor your host for specific security events and search logs
for bad actors. In the next section,
you will learn some more common Lennox and AW S commands that you can apply to
your everyday job. See you soon.