Introduction

Are you using SSH in the best way possible? Have you configured it to be as limited and secure as possible? The goal of this document is to kick in the new year with some best practices for SSH: why you should use them, how to set them up, and how to verify that they are in place.

All of the examples below assume that you are using EnGarde Secure Linux but any modern Linux distribution will do just fine since, as far as I know, everybody ships OpenSSH.

SSHv2 vs. SSHv1

There are numerous benefits to using the latest version of the SSH protocol, version 2, over it’s older counterpart, version 1 and I’m not going into a lot of details on those benefits here – if you’re interested, see the URL in the reference below or Google around. That being said if you don’t have an explicit reason to use the older version 1, you should always be using version 2.

To use SSHv2 by default but permit SSHv1, locate the “Protocol” line in your sshd_config file and change it to:

Protocol 2,1

When doing 2,1 please note that the protocol selection is left up to the client. Most clients will default to v2 and “fall back” to v1, while legacy clients may continue to use v1. To force everybody to use SSHv2, change it to:

Protocol 2

When you make this change don’t forget to generate the appropriate HostKey’s as well! SSHv2 requires the following keys:

# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key

While SSHv1 requires:

# HostKey for protocol version 1
HostKey /etc/ssh/ssh_host_key

Once your changes are made, restart the SSH daemon:

# /etc/init.d/sshd restart

[ SUCCESSFUL ] Secure Shell Daemon
[ SUCCESSFUL ] Secure Shell Daemon

From another machine, try SSH’ing in. You can use the -v option to see which protocol is being used, and the ‘-oProtocol=’ option to force one or the other – for example, “ssh -v -oProtocol=2 ” would force protocol version 2.

Binding to a Specific Address or Non-Standard Port

If you’re running SSH on an internal, firewalled, workstation then you can probably skip this section, but if you’re running SSH on a firewall or on a machine with two network interfaces, this section is for you.

Out of the box OpenSSH will bind to every available network address; while convenient and suitable for most installations, this is far from optimal. If your machine has two or more interfaces then the odds are that one is “trusted” and the other is “untrusted.” If this is the case, and you don’t need nor want SSH access coming in on the untrusted interface, then you should configure OpenSSH to listen on a specific interface.

To have OpenSSH only bind to your internal interface, 192.168.0.1 in the example below, locate the following line in your sshd_config file:

ListenAddress 0.0.0.0

and change the 0.0.0.0 to 192.168.0.1:

ListenAddress 192.168.0.1

To verify that this change took, restart OpenSSH and look at netstat:

# /etc/init.d/sshd restart

[ SUCCESSFUL ] Secure Shell Daemon
[ SUCCESSFUL ] Secure Shell Daemon

# netstat -anp | grep sshd

tcp 0 0 192.168.0.1:22 0.0.0.0:* LISTEN 7868/sshd

As you can see, the sshd daemon is now only listening on 192.168.0.1. SSH requests coming in any other interface will be ignored.

Similarly, you may want to change the port that the SSH daemon binds to. Sometimes there is a functional need for this (ie, your employer blocks outbound 22/tcp) but there is also security-through-obscurity value in this as well. While not providing any real security benefit against a determined attacker, moving the SSH daemon off of port 22 protects you against automated attacks which assume that the daemon is running on port 22.

To have OpenSSH bind to a port other than port 22, 31337 in the example below, locate the following line in your sshd_config file:

Port 22

and change the 22 to 31337:

Port 31337

To verify that this change took, restart OpenSSH and, again, look at netstat:

# netstat -anp | grep sshd

tcp 0 0 192.168.0.1:31337 0.0.0.0:* LISTEN 330/sshd

Finally, to SSH into a host whose SSH daemon is listening on a non-standard port, use the -p option:

ssh -p 31337 user@192.168.0.1

Using TCP Wrappers

TCP Wrappers are used to limit access to TCP services on your machine. If you haven’t heard of TCP Wrappers you’ve probably heard of /etc/hosts.allow and /etc/hosts.deny: these are the two configuration files for TCP Wrappers. In the context of SSH, TCP Wrappers allow you to decide what specific addresses or networks have access to the SSH service.

To use TCP Wrappers with SSH you need to make sure that OpenSSH was built with the -with-tcp-wrappers. This is the case on any modern distribution.

As I indicated earlier, TCP Wrappers are configured by editing the /etc/hosts.deny and /etc/hosts.allow files. Typically you tell hosts.deny to deny everything, then add entries to hosts.allow to permit specific hosts access to specific services.

An example:

#
# hosts.deny    This file describes the names of the hosts which are
#               *not* allowed to use the local INET services, as decided
#               by the '/usr/sbin/tcpd' server.
#
ALL: ALL
#
# hosts.allow   This file describes the names of the hosts which are
#               allowed to use the local INET services, as decided
#               by the '/usr/sbin/tcpd' server.
#
sshd: 207.46.236. 198.133.219.25

In the example above, access to SSH is limited to the network 207.46.236.0/24 and the address 198.133.219.25. Requests to any other service from any other address are denied by the “ALL: ALL” in hosts.deny. If you try to SSH into a machine and TCP Wrappers denies your access, you’ll see something like this:

ssh_exchange_identification: Connection closed by remote host

This simple configuration change significantly hardens your installation since, with it in place, packets from hostile clients are dropped very early in the TCP session — and before they can do any real damage to a potentially vulnerable daemon.

Public Key Authentication

The last item I will cover is public key authentication. One of the best things you can do to tighten the security of your SSH installation is to disable password authentication and to use public key authentication instead. Password authentication is suboptimal for many reasons, but mostly because people choose bad passwords and attackers routinely try to brute-force passwords. If the systems administrator has chosen a bad password and he’s permitting root logins… game over.

Public key authentication is no silver bullet – similarly, people generate passphrase-less keys or leave ssh-agents running when they shouldn’t – but, in my opinion, it’s a much better bet.

Just about every distribution ships with public key authentication enabled, but begin by making sure it is:

RSAAuthentication yes
PubkeyAuthentication yes

Both of these options default to “yes” and the “RSAAuthentication” option is for SSHv1 and the “PubkeyAuthentication” option is for SSHv2. If you plan on using this authentication method exclusively, while you’re there, you may want to disable password authentication:

PasswordAuthentication no

Before you proceed, make sure you have a terminal open on your target machine. Once you restart the SSH daemon you will no longer be able to log in without a key… which we haven’t generated yet!

Once you’re sure, restart the SSH daemon:

# /etc/init.d/sshd restart

[ SUCCESSFUL ] Secure Shell Daemon
[ SUCCESSFUL ] Secure Shell Daemon

Now, from your desktop, try to SSH in to your target machine:

$ ssh rwm@brainy

Permission denied (publickey,keyboard-interactive).

We’re locked out! This is a good thing. The next step, on your desktop, is to generate a key:

$ ssh-keygen -t dsa -C “Ryan’s SSHv2 DSA Key (Jan 2008)”

Generating public/private dsa key pair.
Enter file in which to save the key (/home/rwm/.ssh/id_dsa):
Enter passphrase (empty for no passphrase): **********
Enter same passphrase again: **********
Your identification has been saved in /home/rwm/.ssh/id_dsa.
Your public key has been saved in /home/rwm/.ssh/id_dsa.pub.
The key fingerprint is:
98:4d:50:ba:ee:8b:79:be:b3:36:75:8a:c2:4a:44:4b Ryan’s SSHv2 DSA Key (Jan 2008)

A few notes on this:

• You can generate a DSA (-t dsa), RSA (-t rsa), or SSHv1 (-t rsa1) key. In the example above I’m using dsa.
• I like to put the date I generated the key in the comment (-C) field, that way I can change it out every so often.
• You’re entering a passphrase, not a password. Use a long string with spaces and punctuation. The longer and more complicated the better!

The command you just ran generated two files – id_dsa, your private key and id_dsa.pub, your public key. It is critical that you keep your private key private, but you can distribute your public key to any machines you would like to access.

Now that you have generated your keys we need to get the public key into the ~/.ssh/authorized_keys file on the target machine. The best way to do this is to copy-and-paste it – begin by concatenating the public key file:

$ cat .ssh/id_dsa.pub

ssh-dss AAAAB3NzaC1kc3MAAACBAL7p6bsg5kK4ES9BWLPCNABl20iQQB3R0ymaPMHK…
… ds= Ryan’s SSHv2 DSA Key (Jan 2008)

This is a very long string. Make sure you copy all of it and that you do NOT copy the newline character at the end. In other words, copy from the “ssh” to the “2008)”, but not past that.

The next step is to append this key to the end of the ~/.ssh/authorized_keys file on your target machine. Remember that terminal I told you to keep open a few steps ago? Type the following command into it, pasting the key you’ve just copied into the area noted KEY:

echo “KEY” >> ~/.ssh/authorized_keys

For example:

echo “ssh-dss AAAA5kS9BWLPCN…s= Ryan’s SSHv2 DSA Key (Jan 2008)” >> ~/.ssh/authorized_keys

Now, try to SSH in again. If you did this procedure correctly then instead of being denied access, you’ll be prompted for your passphrase:

$ ssh rwm@brainy

Enter passphrase for key ‘/home/rwm/.ssh/id_dsa’:
Last login: Thu Jan 10 14:37:14 2008 from papa.engardelinux.org
[rwm@brainy ~]$

Viola! You’re now logged in using public key authentication instead of password authentication.

In Summary…

SSH is a wonderful tool and is every systems administrators second best friend (Perl, of course, being the first . It allows you to read your email from anywhere, provided you still use a terminal-based mail reader. It allows you to tunnel an xterm or X11 application from your home server to your desktop at work. It provides you a far superior alternative to FTP in SFTP and SCP.

SSH is great but just like any tool, it’s only as good as you use it. I hope that you found value in some of my best practices and if you have any of your own, leave them in the comments!

Before I go, here are some additional resources on SSH:

• The OpenSSH Project
• SSH, The Secure Shell: The Definitive Guide
• Introduction to SSH Versions 1 and 2
• Knock, Knock, Knockin’ on EnGarde’s Door (with FWKNOP)

1. Firefox – I started out with Mosaic, then Netscape. For years I was an Internet Explorer user but then Microsoft dropped the ball and the Mozilla team ran with it. Firefox is stable, extensible and fast enough. One of the killer features that made me defect was the tabbed browsing. Of course most web browsers now have that feature. Firefox plus Greasemonkey takes an already rockin’ browser into a world of its own.
2. ScribeFire – One of my main jobs is writing on blogs. This means lots of linking, bookmarking, making notes and of course the actual writing. I would say using Scribefire I can do it all in half the time. Scribefire is a Firefox plugin that provides blogging tools including a centralized word-like text editing interface.
3. Skype – Many of my calls are long distance as it is rare for me to have a client in the same country as I live. Skype makes these calls free or much cheaper and allows me to roam around and not be tied to a land-line. With my trusty headset I might look like a geek but I can hear and be heard right across the globe.
4. Fastmail – While many people swear by the free Google GMail my web email service of choice is the paid service at Fastmail. The main advantage is as well as having a web client you can also access your email using imap, allowing me to sync my desktop client and see in a web browser exactly the same email store.
5. WebDav – Talking of web based storage, a fantastic way to get your files on the go is WebDav. Drag and drop your files and folders just like you were working locally. Check out your web host to see if this is an option.
6. SSH – This is an extremely nerdy choice but it has been a life saver in the past. SSH allows you a secure command line login to your remote server. On Windows of course you can use Remote Desktop, and other platforms will have VNC, but when the proverbial hits the fan you can rely on SSH and old school commands to get the job done.
7. WordPress – I love WordPress, I wouldn’t recommend any other blogging platform for the individual or small team. But WordPress can be so much more than a blog! Use it for publishing your corporate website, internal project documentation, team collaboration, making notes, bookmarking, even as a discussion platform.
8. Photoshop – There are cheaper options. I will probably never use even half the features. Photoshop still rules. There is little it can’t do, and if you wander into any design studio you can be sure there will be at least one machine running it. Productivity means being able to do what you need to do well and fast. Once you have learned it, Photoshop makes that happen for working with images.
9. BlogBridge – I need my RSS feeds and I need them with me. While many people can argue in favor of their fave web clients I keep returning to BlogBridge happily time after time. It is a Java based desktop application so works wherever Java works and stores your feeds offline so you can read on the train, in the air or bus home.
10. Flickr – Flickr for me is more than just an online photo gallery, it is a photography archive, a community and a source of royalty-free images (Creative Commons Licensed pics). It’s useful, fun and a constant source of education.