Limited Time Offer!

For Less Than the Cost of a Starbucks Coffee, Access All DevOpsSchool Videos on YouTube Unlimitedly.
Master DevOps, SRE, DevSecOps Skills!

Enroll Now
Uncategorised

SSH Tutorials Complete Master Guide

November 14, 2024 Leave a Comment

List of Commands to Check, Add, Edit Firewall configuration of SSH in ubuntu

Here is a comprehensive set of commands for managing SSH firewall configurations on Ubuntu, using both UFW and iptables. You can use these commands to check, add, edit, and delete firewall rules for SSH.

List of options to change in SSH configuration from Preventing from DDOS attack

To harden your SSH configuration on Ubuntu and help prevent DDoS attacks, you can adjust several settings in the SSH configuration file (/etc/ssh/sshd_config). Below are options you can modify to improve security against DDoS and brute-force attacks.

List of options to Preventing from DDOS attack in AWS Security Group

To prevent DDoS attacks on AWS EC2 instances, you can configure your AWS Security Groups with specific rules to control access and reduce exposure. Here are some best-practice options for configuring security groups to enhance protection against DDoS attacks:

List of Approach to protect SSH session from Preventing from DDOS attack

To protect SSH sessions from DDoS attacks, you can apply several best practices, configurations, and additional tools to safeguard your SSH access. Below is a comprehensive list of approaches for securing SSH against DDoS and brute-force attacks.

# Approaches to Protect SSH Sessions from DDoS Attacks

# 1. Restrict SSH Access to Specific IP Addresses or Ranges
# Limit SSH access to known IPs by configuring firewall rules to only allow connections from trusted IPs or ranges.
# On AWS: Use Security Groups to allow SSH only from specific IPs.
# On Ubuntu: Use UFW or iptables to permit only trusted IPs for SSH access.

# Example (AWS Security Group): Allow SSH from a specific IP
- Type: SSH
- Protocol: TCP
- Port Range: 22
- Source: <Trusted IP or IP Range>

# 2. Use a VPN for SSH Access
# Set up a VPN to restrict SSH access to users connected through the VPN.
# VPNs, like AWS Client VPN or OpenVPN, add an additional layer of security and restrict access to authorized users only.

# 3. Change the Default SSH Port (Obscurity)
# Use a non-standard port for SSH to reduce random DDoS attacks on port 22.
# Update SSH configuration in /etc/ssh/sshd_config:
Port 2222
# Note: Update firewall rules to allow the new SSH port.

# 4. Limit Concurrent and Unauthenticated Connections
# Configure sshd settings to limit the number of concurrent sessions and new connections.
# Edit /etc/ssh/sshd_config to include:
MaxSessions 2               # Limit the number of sessions per connection
MaxStartups 10:30:60        # Controls unauthenticated connections: 10 allowed, drop rate at 30%, and refuse at 60

# 5. Use SSH Key-Based Authentication and Disable Passwords
# Disable password authentication to prevent brute-force attacks and require SSH keys.
# In /etc/ssh/sshd_config:
PasswordAuthentication no    # Enforces key-based authentication only
# Make sure all users have SSH keys set up before applying this setting.

# 6. Set Up Fail2ban to Ban IPs after Multiple Failed Login Attempts
# Fail2ban automatically bans IPs with repeated failed login attempts, preventing brute-force attacks.
# Install and configure Fail2ban:
sudo apt update
sudo apt install fail2ban
# Edit Fail2ban config in /etc/fail2ban/jail.local to enable SSH protection:
[sshd]
enabled = true
maxretry = 5
bantime = 600               # Ban IP for 10 minutes after 5 failed attempts

# 7. Enable UFW or iptables Rate Limiting for SSH Connections
# UFW:
sudo ufw limit 22/tcp        # Limits SSH to 6 attempts per 30 seconds (default)

# iptables (for custom limits, e.g., 10 attempts in 5 minutes):
sudo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set
sudo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 300 --hitcount 11 -j DROP

# 8. Implement Two-Factor Authentication (2FA) for SSH
# Use 2FA for additional security, requiring a second authentication factor.
# Install Google Authenticator or another 2FA tool:
sudo apt install libpam-google-authenticator
google-authenticator        # Run the setup per user
# Configure SSH to require 2FA in /etc/pam.d/sshd and /etc/ssh/sshd_config.

# 9. Monitor SSH Activity with Logging and CloudWatch Alarms
# Enable SSH logs to monitor failed attempts, and set up alerts for suspicious activity.
# Check /var/log/auth.log on Ubuntu:
sudo tail -f /var/log/auth.log
# On AWS, enable CloudWatch Alarms to notify you of spikes in SSH traffic.

# 10. Enable AWS Shield Advanced for DDoS Protection (for Enterprise-Level Protection)
# AWS Shield Advanced offers dedicated DDoS protection for high-risk applications, including protections for EC2.
# It provides additional support and monitoring for DDoS attacks targeting your instance.

# 11. Enable VPC Flow Logs to Track Suspicious SSH Traffic
# VPC Flow Logs capture IP traffic going to and from your EC2 instance.
# Analyze these logs to detect unusual SSH connection patterns.
# Steps:
# - Go to VPC Console > Flow Logs > Create Flow Log.
# - Enable logs and store in CloudWatch or S3 for review.

# Summary
# - Use IP restrictions, VPNs, and non-standard ports to limit access.
# - Implement SSH session limits, Fail2ban, and rate-limiting to control connection frequency.
# - Use 2FA and key-based authentication for enhanced security.
# - Monitor and log SSH activity to stay proactive in detecting and handling potential threats.
Rajesh Kumar
Follow me
Latest posts by Rajesh Kumar (see all)
Subscribe
Notify of
guest
0 Comments
Newest
Oldest Most Voted
Inline Feedbacks
View all comments
0
Would love your thoughts, please comment.x
()
x