When attackers target a Linux server, they don\u2019t start with zero-days\u2014they start with SSH. Weak passwords, default ports, and outdated configurations make brute-force attempts almost trivial for bots scanning the internet 24\/7.<\/p>\n\n\n\n
The good news: tightening SSH security takes minutes and drastically reduces risk. Here\u2019s what should be standard on every production server:<\/p>\n\n\n\n
If passwords are allowed, someone will eventually guess one. Make sure you have your keys in order before disabling password authentication. <\/p>\n\n\n\n
Edit Restart SSH:<\/p>\n\n\n\n Now only SSH keys work\u2014brute-force attempts instantly become worthless.<\/p>\n\n\n\n No, this isn\u2019t \u201csecurity through obscurity.\u201d It\u2019s lowering noise. In Always test with a second connection before closing your original session.<\/p>\n\n\n\n If only two people need SSH access, there\u2019s no reason anyone else should even try.<\/p>\n\n\n\n Fail2ban blocks aggressive IPs after repeated failed logins. Some servers have a firewall already setup on them. Make sure your current setup won’t conflict with fail2ban before deploying it.<\/p>\n\n\n\n If attackers don\u2019t know the username, they can\u2019t brute force it. Disable root access and login from an alternate user. If you need root access you can allow sudo access. <\/p>\n\n\n\n Tools like Google Authenticator or Duo make SSH compromise nearly impossible.<\/p>\n","protected":false},"excerpt":{"rendered":" When attackers target a Linux server, they don\u2019t start with zero-days\u2014they start with SSH. Weak passwords, default ports, and outdated...<\/p>\n","protected":false},"author":1,"featured_media":425,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[65,66],"tags":[],"class_list":["post-424","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","category-ssh"],"_links":{"self":[{"href":"https:\/\/servertweakers.com\/blog\/wp-json\/wp\/v2\/posts\/424","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/servertweakers.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/servertweakers.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/servertweakers.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/servertweakers.com\/blog\/wp-json\/wp\/v2\/comments?post=424"}],"version-history":[{"count":3,"href":"https:\/\/servertweakers.com\/blog\/wp-json\/wp\/v2\/posts\/424\/revisions"}],"predecessor-version":[{"id":473,"href":"https:\/\/servertweakers.com\/blog\/wp-json\/wp\/v2\/posts\/424\/revisions\/473"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/servertweakers.com\/blog\/wp-json\/wp\/v2\/media\/425"}],"wp:attachment":[{"href":"https:\/\/servertweakers.com\/blog\/wp-json\/wp\/v2\/media?parent=424"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/servertweakers.com\/blog\/wp-json\/wp\/v2\/categories?post=424"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/servertweakers.com\/blog\/wp-json\/wp\/v2\/tags?post=424"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\/etc\/ssh\/sshd_config<\/code>:<\/p>\n\n\n\nPasswordAuthentication no\nChallengeResponseAuthentication no\n<\/pre>\n\n\n\n
systemctl restart sshd\n<\/pre>\n\n\n\n
2. Move SSH to a Non-Standard Port<\/strong><\/h3>\n\n\n\n
Bots hammer port 22 nonstop; moving to another port cuts junk traffic by 90\u201395%.<\/p>\n\n\n\nsshd_config<\/code>:<\/p>\n\n\n\nPort 2222\n<\/pre>\n\n\n\n
3. Limit SSH to Specific Users<\/strong><\/h3>\n\n\n\n
AllowUsers ike admin backupuser\n<\/pre>\n\n\n\n
4. Reduce Attack Surface With Fail2ban<\/strong><\/h3>\n\n\n\n
yum install fail2ban\nsystemctl enable --now fail2ban\n<\/pre>\n\n\n\n
5. Disable Root SSH Login<\/strong><\/h3>\n\n\n\n
PermitRootLogin no\n<\/pre>\n\n\n\n
6. Use 2FA for SSH (Yes, It\u2019s Worth It)<\/strong><\/h3>\n\n\n\n