TechPulse by Khalequzzaman
Posted on
• System Administration

Securing SSH: Changing Default Port and Using Key-Based Authentication

Author

SSH (Secure Shell) is a vital tool for managing remote servers, but its default configuration can expose your system to security risks. By changing the default SSH port and switching to key-based authentication, you can significantly enhance your server’s security. In this post, we’ll walk you through the steps to make these changes and protect your system from unauthorized access.

Why Secure SSH?

  • Default Port Risks: The default SSH port (22) is a common target for brute-force attacks.
  • Password Vulnerabilities: Password-based authentication can be compromised through weak passwords or brute-force attempts.
  • Key-Based Authentication: Using SSH keys is more secure than passwords, as it relies on cryptographic keys instead of easily guessable credentials.

Step 1: Changing the Default SSH Port

1. Edit the SSH Configuration File

Open the SSH configuration file using a text editor:

sudo nano /etc/ssh/sshd_config

2. Find and Modify the Port Line

Locate the line that specifies the port (usually Port 22) and change it to a non-standard port (e.g., 2222):

Port 2222

3. Save and Exit

Save the file and exit the editor.

4. Restart the SSH Service

Apply the changes by restarting the SSH service:

sudo systemctl restart sshd

5. Update Firewall Rules

If you’re using a firewall (e.g., ufw), allow the new port:

sudo ufw allow 2222/tcp  
sudo ufw deny 22/tcp  # Block the old port  
sudo ufw reload

6. Test the New Port

Connect to your server using the new port:

ssh username@your_server_ip -p 2222

Step 2: Setting Up Key-Based Authentication

1. Generate an SSH Key Pair

On your local machine, generate a new SSH key pair:

ssh-keygen -t rsa -b 4096
  • Press Enter to save the key in the default location (~/.ssh/id_rsa).
  • Optionally, set a passphrase for added security.

2. Copy the Public Key to the Server

Use ssh-copy-id to copy your public key to the server:

ssh-copy-id -i ~/.ssh/id_rsa.pub username@your_server_ip -p 2222

If ssh-copy-id is not available, manually copy the key:

cat ~/.ssh/id_rsa.pub | ssh username@your_server_ip -p 2222 "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

3. Disable Password Authentication

Edit the SSH configuration file again:

sudo nano /etc/ssh/sshd_config

Find and modify the following lines:

PasswordAuthentication no  
PubkeyAuthentication yes

4. Restart the SSH Service

Restart the SSH service to apply the changes:

sudo systemctl restart sshd

5. Test Key-Based Authentication

Try logging in to your server:

ssh username@your_server_ip -p 2222

If everything is set up correctly, you should be logged in without being prompted for a password.

Additional SSH Security Tips

  1. Use Strong Passphrases: If you set a passphrase for your SSH key, make sure it’s strong.
  2. Limit User Access: Restrict SSH access to specific users:
    bash AllowUsers username1 username2
  3. Disable Root Login: Prevent direct root login:
    bash PermitRootLogin no
  4. Use Fail2Ban: Install Fail2Ban to block brute-force attempts:
    bash sudo apt install fail2ban
  5. Regularly Update SSH: Keep your SSH server and client software up to date.

Troubleshooting

  • Locked Out?: If you lose access to your server, most hosting providers offer a recovery console or VNC access to revert changes.
  • Firewall Issues: Double-check firewall rules to ensure the new SSH port is allowed.
  • Key Authentication Fails: Verify that the authorized_keys file has the correct permissions (600) and the public key is correctly copied.

Conclusion

Changing the default SSH port and using key-based authentication are simple yet effective ways to secure your server. By following these steps, you can protect your system from brute-force attacks and unauthorized access, ensuring a safer environment for your data and applications.

Related posts