SSH Security Best Practices

SSH security best practices are the essential steps to prevent unauthorized access, credential theft, and data breaches on servers and network devices. By implementing key-based authentication, disabling risky settings, and layering protections, you can make your SSH connections substantially more resistant to attack. This guide covers the most effective measures, from key management to fail2ban and beyond.

Why SSH Security Matters

SSH (Secure Shell) is the standard protocol for remotely managing Linux and Unix-like systems, as well as many network devices. It encrypts all traffic, protecting login credentials and commands from eavesdropping. However, SSH is also a primary target for attackers because it exposes a network service to the internet. A misconfigured SSH server can allow brute-force attacks, credential stuffing, or even direct unauthorized access, leading to data loss, ransomware, or complete system compromise. The security of your SSH configuration is often the first line of defense for your entire infrastructure.

Key-Based Authentication Over Passwords

The single most impactful change you can make is to disable password authentication and use SSH keys. Password-based logins are vulnerable to brute-force attacks and can be phished. SSH keys, by contrast, use a pair of cryptographic keys: a private key (kept secret on your local machine) and a public key (placed on the server). Authentication works by the server challenging your client to prove possession of the private key, which is far stronger than any password.

To set up key-based authentication, generate a key pair on your local machine using ssh-keygen -t ed25519 (or RSA with at least 3072 bits). Then copy the public key to the server using ssh-copy-id user@server. Once you confirm that key login works, disable password authentication in /etc/ssh/sshd_config by setting PasswordAuthentication no. Always keep your private key secure with a strong passphrase and never share it.

Disable Root Login and Use Sudo

Allowing direct root login over SSH is extremely risky. Root has unlimited privileges, and if an attacker obtains the root password or key, they control the entire system. The safer practice is to disable root login and instead log in as a regular user, then use sudo to perform administrative tasks. In sshd_config, set PermitRootLogin no. This ensures that even if an attacker compromises a user account, they still need to know the sudo password and are subject to sudo’s logging and restrictions.

Use Strong Key Types and Passphrases

Not all SSH keys are created equal. RSA keys should be at least 3072 bits, but the modern recommendation is to use Ed25519 keys, which are faster, smaller, and more secure. Ed25519 is an elliptic-curve algorithm that is resistant to certain types of attacks that affect RSA. When generating keys, always set a passphrase. A passphrase adds an extra layer of protection: if your private key is stolen, the attacker still needs the passphrase to use it. You can use ssh-agent to remember the passphrase so you don’t have to type it every time.

Harden SSH Configuration

Several other settings in sshd_config can significantly improve security:

• Change the default port? While not a true security measure (attackers scan all ports), moving SSH from port 22 to a non-standard port can reduce automated attack noise. This is security by obscurity and should not be relied upon, but it can cut down on log spam.
• Limit users: Use AllowUsers or AllowGroups to restrict which accounts can log in via SSH. This reduces the attack surface.
• Set idle timeout: ClientAliveInterval 300 and ClientAliveCountMax 0 will disconnect idle sessions after 5 minutes, preventing abandoned sessions from being hijacked.
• Disable empty passwords: Ensure PermitEmptyPasswords no is set.
• Use protocol 2 only: The old protocol 1 is insecure and should be disabled with Protocol 2.

Protect Against Brute-Force Attacks

Even with password authentication disabled, SSH servers can still be flooded with connection attempts. Tools like fail2ban monitor auth logs and automatically ban IP addresses that show malicious patterns, such as repeated failed logins. fail2ban creates firewall rules that drop traffic from offending IPs for a specified time. This significantly slows down brute-force attacks. Alternatively, you can use sshd built-in throttling with MaxAuthTries (set to 3 or less) and MaxSessions (set to a low number).

Keep Software Updated and Monitor Logs

Vulnerabilities in OpenSSH itself are occasionally discovered. Always keep your SSH client and server software updated to the latest patched versions. Enable automatic security updates for your operating system. Regularly review your SSH logs (usually in /var/log/auth.log) for suspicious activity, such as failed login attempts from unknown IPs. Tools like logwatch or a SIEM can help automate log analysis. Additionally, consider using a VPN or firewall rules to restrict SSH access only to trusted IP ranges, especially for critical servers.

Frequently Asked Questions

Is changing the SSH port a good security measure?

Changing the port is not a real security control because attackers scan the entire port range, but it can reduce automated brute-force attempts and log noise. It is often used as a low-effort way to minimize unwanted attention. However, it should never be your only defense; always use keys, disable root login, and use fail2ban.

What is the difference between SSH keys and passwords?

Passwords are strings you memorize and type, and they can be guessed or stolen. SSH keys are cryptographic files that prove your identity through a challenge-response handshake. Keys are mathematically much harder to crack, and they can be further protected with a passphrase. Unlike passwords, keys are never transmitted over the network, so they are immune to keylogging on the server side.

How do I generate an SSH key pair?

On your local machine, open a terminal and run ssh-keygen -t ed25519. You will be asked for a file location (press Enter for default) and a passphrase. This creates a public key (id_ed25519.pub) and a private key (id_ed25519). Then copy the public key to the server with ssh-copy-id user@server. Never share your private key.

What is fail2ban and how does it work?

fail2ban is a log-parsing tool that scans authentication logs for repeated failures. When it detects a pattern (e.g., 5 failed SSH logins from the same IP), it adds a firewall rule to block that IP for a set period. It is highly configurable and can also protect other services like web servers. It is a powerful deterrent against brute-force attacks.

Can I use SSH keys on Windows?

Yes. Windows 10 and 11 include the OpenSSH client and server as optional features. You can use the same ssh-keygen command in PowerShell or Command Prompt. The keys are stored in C:\Users\YourName\.ssh. You can also use tools like PuTTY, but the native OpenSSH is now the recommended approach.

What is the difference between SSH and SSL/TLS?

SSH is primarily used for secure remote command-line access and file transfers, while SSL/TLS is used to secure web traffic (HTTPS), email, and other application protocols. They use different cryptographic handshakes and serve different purposes. SSH provides an encrypted channel for a terminal session, whereas TLS provides an encrypted channel for arbitrary application data.

Related

• AirPlay 2: How It Works and Everything You Need to Know
• How to Set Boundaries at Work When Your Boss Keeps Adding Tasks
• Satellite Messaging vs Wi-Fi Calling Off Grid