How to harden against SSH brute-forcing?

[Guest]

I understood the comment as "leave the port open to ssh, to easily allow fail2ban to hit the ip's before they get through your full port range." But thanks for the elaborate answer

I agree, what you described is much more work

[sugar_in_your_tea@sh.itjust.works]

It's also one of the biggest targets for attack. Here's a somewhat recent CVE and here is another. Staying on top of security patches is absolutely critical, and many don't do that.

The best security practice is to layer your protections.

your points 4 and 5 are outside the scope of the SSH discussion

They're not about SSH, sure, but they are relevant to securing a system to remote access. Always assume your security infra will be compromised and plan accordingly. Generally speaking, the more layers, the better.

[a_postmodern_hat@lemmy.world]

You could get a hardware key (like a Yubikey) and authenticate with PIV or GPG.

[tomsh@lemmy.world]

In addition to what others say, I also have ntfy notifications on successful login.

[voroxpete@sh.itjust.works]

This is the selfhosted community; Who are you training? In most cases there's literally only one person who would ever need SSH access to this server. Maybe two or three in a tiny handful of cases, but anyone who can't figure out Netbird in 30 seconds absolutely should not be accessing anything via SSH.

And you've clearly never used Netbird, Tailscale, or any similar service, if you think that update, maintenance and config constitute any kind of meaningful burden, especially for something as simple as remote access to a VPS.

[sugar_in_your_tea@sh.itjust.works]

why stop at one vpn

Because an additional one adds a different type of security unrelated to securing your server, it's about securing data en route to your server (e.g. hiding that you're accessing it at all from wherever you are. Maybe you want that, but it's irrelevant to securing your server.

But on the larger topic of diminishing returns, yeah, maybe you don't need it.

However, I would never feel comfortable with just one line of defense, regardless of how good that product is. I trust openSSH, which is why I have it running, but all software has bugs and I want more than domino that needs to fall before I get pwned. If there's a successful attack on openSSH, you can bet the script kiddies will exploit it before you get around to patching your server, especially in a homelab setup.

This setup isn't particularly crazy, and I'd recommend a lot more of someone has special requirements. Setting up WireGuard is like 20 lines of config, it's baked into the kernel (except wg-quick, the frontend), and the project is super stable (no major changes in years). Pretty much everything has great support for it (built-in to Android, Linux DEs, etc), and you really don't need to touch it unless you need to set up a new machine.

But if you don't want a VPN for whatever reason, there are other options for additional security:

• geoip blocking - allow only those regions that you expect to connect from (different rules for each port, so SSH can be special)
• fail2ban - block IPs if they fail to authenticate after a few attempts

But please do more than just securing openSSH, because all software has bugs and an extra layer isn't that much more work.

[loudwaterenjoyer@lemmy.dbzer0.com]

How about 22222?

[Guest]

That's genius. I'll do the same from now on.

[possiblylinux127@lemmy.zip]

Use key based auth only and then run ssh-audit.

[possiblylinux127@lemmy.zip]

Changing the port is a total waste of time

Changing the port is just like putting a picture of a window on your door. Harden SSH properly and don't waste time with security via obscurity

[sugar_in_your_tea@sh.itjust.works]

Agreed, but be careful about the whitelist. If your home IP changes, you'll be locked out until you update it, so you should consider an IP range if that's a possibility for you. Likewise, if you'll be accessing it from multiple locations (say, a family member's house), then make sure to add those as well.

[tomsh@lemmy.world]

There is actually an example on their website.

ntfy ssh login alert

[sugar_in_your_tea@sh.itjust.works]

That's not true.

Security through obscurity isn't real security, sure, but it does a lot to reduce the noise in the logs so you can see the more real attacks. Hardening SSH properly is certainly more important, but changing the port also has value.

[sugar_in_your_tea@sh.itjust.works]

I do log in as root though.

Don't do that. You're one local piece of malware away from getting your server pwned. Logging in as an unprivileged user at least requires another exploit on the server to get root permissions.

[sugar_in_your_tea@sh.itjust.works]

Oh, that one's fine. Everyone knows that 5-digit ports add extra security, which is why WireGuard runs on port 51820 by default. You can verify this by checking the max port number, which is also 5-digits, computers just aren't powerful enough to crack 6-digit port numbers, so Linux hasn't bothered increasing it. /s

[sugar_in_your_tea@sh.itjust.works]

harden sshd

More details:

• require keys to login
• don't allow login as root

That should be plenty, but you could go a bit further and restrict the types of algorithms allowed (e.g. disallow RSA if you're worried about quantum attacks). For this, I recommend a subtractive config (e.g. HostbasedAcceptedAlgorithms=-rsa-*). This is way over the top since an attacker is unlikely to attack the cipher directly, but it could be part of an attack.

[k_rol@lemmy.ca]

I vote for wireguard here, I don't expose anything other than game servers to the internet

[sugar_in_your_tea@sh.itjust.works]

It's absolutely overboard, and you can get 99% of the way there with this:

1. WireGuard config (Tailscale in your case)
2. Bind SSH to WireGuard IP only (so no public SSH port)
3. SSH keys only, and disable root login over SSH

That will require breaking WireGuard and openSSH's key-based authentication, which just isn't happening. The rest looks like mostly auditing. Even a firewall isn't necessary if no ports are accessible anyway (i.e. everything only accessible over Tailscale), and you can just configure iptables to block everything on the WAN IP and call it a day.

[sugar_in_your_tea@sh.itjust.works]

Just remember that you'll only be able to SSH in w/ a device that's already configured for WireGuard. So if you're at a friend's house and haven't set up your phone to do it yet, you'll be forced to use the VPS console to get in. Make sure this is what you want before you do it.

[australiansimon@lemmy.world]

I think the point behind it is to waste the sniffers time sniffing for ports that it could be using to be making attempts.

Its not a security thing, it's just increasing the cost to snoop.