How to secure your SSH Connections for Safe Remote Access

SSH (Secure Shell) is the most common protocol for securely accessing remote servers. While SSH provides encrypted communication, it’s important to take extra steps to further secure the connection and protect your system from unauthorized access. This article covers key methods to secure SSH, including key-based authentication, restricting root login, and configuring firewalls.

If you do not know how the SSH works, you can check this guide:

1: Disable Password Authentication and Use SSH Keys

SSH keys provide a more secure authentication method than passwords. By disabling password authentication and using key-based authentication, you can significantly reduce the chances of unauthorized access.

On your local machine, generate an SSH key pair by running the following command on CMD or terminal:

After that you will be asked to choose where to save the files generated and enter the passphrase for the key, you can proceed with hitting enter for the default file location, and choose a strong passphrase

This will create a public/private key pair. By default, the keys are saved in ~/.ssh/id_rsa (private key) and ~/.ssh/id_rsa.pub (public key).

Copy the Public Key to the Server: Use the ssh-copy-id command to copy your public key to the remote server:

This adds the public key to the ~/.ssh/authorized_keys file on the server, allowing you to log in without a password.

(optional) you can Disable Password Authentication with the editing the file /etc/ssh/sshd_config and doing the following change:

2: Change the Default SSH Port

Changing the default SSH port from 22 to another number can reduce the risk of automated attacks and port scanning.

Open the SSH configuration file:

Find the Port directive and change the number:

Restart the SSH service:

After changing the port, make sure to specify the new port when connecting like this:

3: Configure a Firewall for SSH

Use a firewall to restrict SSH access to specific IP addresses, blocking unauthorized connections. If UFW is not installed, you can install it using the command:

Allow SSH connections through the firewall:

If you want to limit SSH access to a specific IP address:

Enable the firewall:

4: Use Fail2Ban to Prevent Brute-Force Attacks

Fail2Ban is a security tool that scans log files and bans IP addresses that show signs of malicious activity, such as too many failed login attempts.

Install Fail2Ban:

Configure Fail2Ban for SSH with the local configuration file:

Add the following configuration:

save the file and exit and then restart Fail2Ban:

5: Enable Two-Factor Authentication (2FA)

Adding two-factor authentication (2FA) to SSH provides an additional layer of security by requiring a one-time code along with your SSH key. Install Google Authenticator:

Run the Google Authenticator setup:

Follow the prompts to configure 2FA for your SSH account.

Edit the SSH PAM Configuration, Open the PAM configuration file:

Add the following line:

Edit the SSH configuration file to require both SSH keys and 2FA:

Set:

Restart the SSH service:

Securing SSH connections is crucial for protecting your server from unauthorized access and brute-force attacks. By implementing key-based authentication, changing the default port, disabling root logins, configuring firewalls, using Fail2Ban, and enabling two-factor authentication, you can significantly enhance the security of your SSH setup. Taking these proactive steps will help safeguard your system from potential threats and ensure safe remote access.