Unit 12: Auditing and hardening · Lesson 3 of 7 · 16 min
Hardening SSH
Compare sshd_config with the hardened baseline and turn each difference into a fix.
mission
- You are
- You are closing the door the guessers knocked on.
- Situation
- SSH faces the internet with root logins and passwords allowed. 197 failed passwords in one day say what that invites.
- Goal
- List the risky settings and the baseline values for each.
- Hand in
- A before and after for every SSH setting that drifted.
Read the settings that matter
grep -Ei '^(PermitRootLogin|PasswordAuthentication|MaxAuthTries|X11Forwarding|AllowTcpForwarding|LoginGraceTime)' /etc/ssh/sshd_config
PermitRootLogin yes
PasswordAuthentication yes
MaxAuthTries 10
LoginGraceTime 2m
X11Forwarding yes
AllowTcpForwarding yes
Diff against the baseline
Process substitution <( ) lets diff compare the output of two commands.
diff <(grep -Ei '^(PermitRootLogin|PasswordAuthentication|MaxAuthTries|X11Forwarding)' /etc/ssh/sshd_config) <(grep -Ei '^(PermitRootLogin|PasswordAuthentication|MaxAuthTries|X11Forwarding)' /srv/baseline/sshd_config.hardened)
1,4c1,4
< PermitRootLogin yes
< PasswordAuthentication yes
< MaxAuthTries 10
< X11Forwarding yes
---
> PermitRootLogin no
> PasswordAuthentication no
> MaxAuthTries 3
> X11Forwarding no
you should see Four settings differ; each one is a line in the fix.
sshd_config
PermitRootLogin yes PasswordAuthentication yes MaxAuthTries 10 LoginGraceTime 2m X11Forwarding yes AllowTcpForwarding yes
PermitRootLogin no PasswordAuthentication no MaxAuthTries 3 LoginGraceTime 30s X11Forwarding no AllowTcpForwarding no
Plan the change safely
As root you would edit the file, run sshd -t to check it, reload SSH and keep your current session open until a new login works. In the lab you write the plan, not the change.
What a defender takes away
- 1Root login off: log in as yourself, then sudo.
- 2Passwords off: keys only, guessing ends.
- 3Always test the config and keep a session open when changing SSH.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.