Securing the SSH server

Do these on your own system. They get harder. Check each result, then tick it off.

1. Warm-upDone

   What is sshd really doing?

   Show the effective values of permitrootlogin, passwordauthentication, pubkeyauthentication and port. Then list the files that contribute to the configuration.

   Check your result

   sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|port) ' prints four lines. ls /etc/ssh/sshd_config.d shows files such as 50-redhat.conf.

   Hint

   sshd -T prints the configuration after all includes and defaults. The main file is /etc/ssh/sshd_config.

   Solution

   sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|port) '
   ls -l /etc/ssh/sshd_config.d/
   grep -n '^Include' /etc/ssh/sshd_config

2. PracticeDone

   Forbid logging in as root

   Prevent direct root login over SSH on node1, using a drop-in file that definitely takes precedence over the files that ship with the system. Check the syntax, reload the service, and test from node2 that ssh root@node1 is refused while ssh alex@node1 still works.

   Check your result

   sudo sshd -T | grep permitrootlogin prints permitrootlogin no. ssh root@node1 fails with Permission denied. ssh alex@node1 works.

   Hint

   sshd uses the first value it reads for each keyword, and reads files in sshd_config.d in alphabetical order, so name yours 01-local.conf. Always run sshd -t before systemctl reload sshd.

   Solution

   echo 'PermitRootLogin no' | sudo tee /etc/ssh/sshd_config.d/01-local.conf
   sudo sshd -t && sudo systemctl reload sshd
   sudo sshd -T | grep permitrootlogin
   # from node2
   ssh root@node1
   ssh alex@node1 true

3. PracticeDone

   Keys only, no passwords

   First confirm that key login works for alex from node2. Then disable password authentication, reload, and show that a client that offers only a password is refused while the key login keeps working. Explain why the order of these steps matters.

   Check your result

   ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no alex@node1 ends with Permission denied (publickey,...). ssh alex@node1 true still works with the key.

   Hint

   PasswordAuthentication no in the drop-in. Keep another session open while you reload.

   Solution

   ssh -o PreferredAuthentications=publickey alex@node1 true     # prove keys work first
   echo 'PasswordAuthentication no' | sudo tee -a /etc/ssh/sshd_config.d/01-local.conf
   sudo sshd -t && sudo systemctl reload sshd
   ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no alex@node1
   ssh alex@node1 true

4. PracticeDone

   Only members of one group may connect

   Allow SSH logins only for members of the group sshusers. Create the group and add alex, but not dana. Verify that alex can log in and dana is refused, and read the log line that explains the refusal.

   Check your result

   ssh alex@node1 true works; ssh dana@node1 fails. journalctl -u sshd shows User dana from ... not allowed because none of user's groups are listed in AllowGroups.

   Hint

   AllowGroups sshusers in the drop-in. A user's membership is read at login, and the primary group counts too.

   Solution

   sudo groupadd sshusers
   sudo usermod -aG sshusers alex
   echo 'AllowGroups sshusers' | sudo tee -a /etc/ssh/sshd_config.d/01-local.conf
   sudo sshd -t && sudo systemctl reload sshd
   # from node2: ssh alex@node1 true ; ssh dana@node1 true
   sudo journalctl -u sshd -n 3 --no-pager

5. ChallengeDone

   Run sshd on port 2222

   Make sshd listen on TCP 2222 in addition to 22. Do everything required so it works with SELinux enforcing and the firewall on, test from node2 with ssh -p 2222, and only then consider removing port 22. List the three separate things that must change, and what error you get if you forget each one.

   Check your result

   ss -tlnp | grep sshd shows both 22 and 2222. ssh -p 2222 alex@node1 true works from node2. Without the SELinux label sshd fails to bind (Permission denied); without the firewall rule the connection times out.

   Hint

   (1) Port 2222 in sshd config (keep Port 22 too while testing), (2) semanage port -a -t ssh_port_t -p tcp 2222, (3) firewall-cmd --permanent --add-port=2222/tcp and --reload. semanage is in policycoreutils-python-utils.

   Solution

   sudo dnf install -y policycoreutils-python-utils
   sudo semanage port -a -t ssh_port_t -p tcp 2222
   sudo firewall-cmd --permanent --add-port=2222/tcp
   sudo firewall-cmd --reload
   printf 'Port 22\nPort 2222\n' | sudo tee -a /etc/ssh/sshd_config.d/01-local.conf
   sudo sshd -t && sudo systemctl restart sshd
   ss -tlnp | grep sshd
   # from node2
   ssh -p 2222 alex@node1 true