this post was submitted on 10 Nov 2023
34 points (90.5% liked)

Linux

48230 readers
817 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
nooter692@lemmy.ml
AgreeableLandscape@lemmy.ml
MarcellusDrum@lemmy.ml
cypherpunks@lemmy.ml
cyclohexane@lemmy.ml
d3Xt3r@lemmy.nz
34
Have I successfully blocked ssh logins to root? (lemmy.ml)
submitted 1 year ago by cyberwolfie@lemmy.ml to c/linux@lemmy.ml
22 comments fedilink hide all child comments
 

I have a server where I believe I have disabled root login via ssh. I think it is done correctly, as I cannot login with root myself via ssh, but I would've thought that it would be reflected in /var/log/auth.log. Instead, it shows up as failed password entry. Is this intended?

What I've done is to uncomment the PermitRootLogin no line in /etc/ssh/sshd_config. Rest of the config file is left at default.

Bonus question: All login attempts by ssh seems to go over some random port (even my own successful logins). Why is this?

you are viewing a single comment's thread
view the rest of the comments
[–] cyberwolfie@lemmy.ml 3 points 1 year ago (2 children)

Yes that’s the right way to block root login. An added filter you can use the ‘match’ config expression to filter logins even further.

Not sure what you meant about the 'match' config expressions here. Could you elaborate a bit further?

If you’re on the open network, your connection will be heavily hit with login attempts. That is normal. But using another service like Fail2Ban will stop repeated hits to your host.

Hehe, yeah, I've noticed... The reason I get a little anxious whether I did this correctly, is that 95% of the login attempts are to root, so I want to make sure it is disabled. I have set up Fail2Ban, but I am using default settings, which may be a bit laxer than they need?

I've also been advised and considered moving to ssh keys, but I have not gotten to that yet.

Ssh listens on port 22, as soon as a connection is made the host moves the connection to another port to free up 22 for other new connections.

Makes sense. One question that comes from this is: is it possible to disable that? I would never need two ssh-logins at the same time on my server. And the second question is what I asked above regarding whether I should change the port ssh listens to in order to reduce unwanted malicious login attempts?

[–] ipsirc@lemmy.ml 6 points 1 year ago

Ssh listens on port 22, as soon as a connection is made the host moves the connection to another port to free up 22 for other new connections.

Makes sense

No, it's nonsense. Nothing like that happens.

[–] willybe@lemmy.ca 2 points 1 year ago (1 children)

Match blocks allow you to restrict who/what is allowed or not allowed to connect to the server. There is a large number of options to utilize. Put this near the bottom of sshd_config. There should be an example there.

Here are some more examples: https://stackoverflow.com/questions/10829712/sshd-with-multiple-match-sections-override-settings

[–] cyberwolfie@lemmy.ml 2 points 1 year ago

Thanks - I'll look more into that to see if I can make any rules that would make sense for my use case.