This is an old revision of the document!
Table of Contents
SSH
SSH is the Secure Shell, a secure replacement for telnet. I've installed the OpenSSH client and server.
Installation
Install the package:
apt-get install ssh
Accept the default settings when asked.
Configuration
Fix it so root cannot log in. Edit /etc/ssh/sshd_config to change the PermitRootLogin setting:
PermitRootLogin no
Allow connections on port 443 in case port 22 is blocked. Edit /etc/ssh/sshd_config to add a second Port statement:
Port 443
Startup
Restart to have the settings take effect:
/etc/init.d/ssh restart
Testing
Log into the system as a user via SSH.
Try logging in as root via SSH. Make sure the access is denied, and that the attempt is logged.
Logging
SSH access to the system is logged in /var/log/auth.log.
Security
We've disabled direct root login via SSH. The OpenSSH server and client come built with just about every feature possible to help ensure as secure a connection as possible.
Notes
While SSH replaces Telnet, we've kept the telnet client installed, because it's very helpful in troubleshooting network services by telnetting directly to the port the service runs on. The telnet client should never be used to log into a shell account. The telnet server should never be installed, except perhaps for non-critical non-shell restricted access.
TODO
Enable/disable some more features to provide better security.
Determine when it is appropriate to use key-based authentication instead of password authentication, and configure for such. Use ssh-agent and ssh-add as appropriate. (Note that users can use those already.)
Comments
