Sign in

hardening ssh on a public-facing linux server

Solvedhardeninglinuxssh167 replies · 1.6K views · started
Reply
Accepted solution by Noah Ivanova — Restrict who can connect, not just how. If u have a static IP or use a VPN, allow SSH only from there with the providers firewall or…
  1. Bea Reyes
    @earlybench

    guys pls help I have a small VPS running a website. Looking at the logs, there are thousands of failed SSH login attempts per day from all over. Nothing seems to have gotten in, but it's unsettling.

    Right now I log in as root with a password. I know thats not great ;) What changes should I make to lock this down properly, without locking myself out in the process?

    5
  2. Paula
    @paulam457

    the core changes:

    1. Create a normal user with sudo.
    2. set up key-based login for that user. 3.. 😂 disable password authentication and root login. worked for me anyway 🤷
    2 0 helpful
  3. Noah Ivanova
    @loose_deck
    in reply to @paulam457 Accepted solution

    Restrict who can connect, not just how. If u have a static IP or use a VPN, allow SSH only from there with the providers firewall or ufw/nftables. if u cant, a tool like fail2ban that bans IPs after repeated failures reduces log noise, though with passwords disabled, the attempts cant succeed anyway. lmk how it goes

    lol

    4 4 helpful
  4. Bea Reyes
    @earlybench
    in reply to @loose_deck

    @loose_deck set up an ed25519 key, created a sudo user, disabled password and root login. Tested from a second terminal before closing the first. Logs are much quieter with fail2ban too. worked for me anyway 🤷

    thumbsup

    1 2 helpful
  6. Paula Duarte
    @byte_forge

    hmmm same issue here on my laptop. following this thread good luck man!

    @packetrider legend

    32 8 helpful
  7. Leon
    @shader_builder837

    ok weird one my homelab box is officially haunted what am i doing wrong??

    6 0 helpful
  9. Noah F.
    @noah.ferreira

    @paulam457 did u ever fix it?? ??

    2 0 helpful
  10. Otto
    @otto.bauer

    ehh everyone keeps saying this but nobody posts proof

    0 6 helpful
  11. Farah P.
    @farah.pereira

    came here to say exactly this

    1 2 helpful
  13. Theo Vos
    @tvos

    bump. still happening with hardeinng for me

    3 0 helpful
  15. Paula Duarte
    @byte_forge

    omg finally finally got it working, thx everyone. @packetrider what did u end up doing in the end thank u thank u thank u

    1 1 helpful
  16. Theo Vos
    @tvos

    ok this thread just saved my weekend any ideas??

    1 0 helpful
  17. Theo Vos
    @tvos

    try turning off teh router first, fixed it for me. dumb question but how do i even check the DNS good luck man!

    2 2 helpful
  18. Elena Jansen
    @cipher_fox339
    in reply to @tvos

    @tvos thank u this worked!!, is public-facing even worth bothering with or should i just leave it owe u a beer 🍺

    4 0 helpful
  19. Paula Duarte
    @byte_forge

    bump. still happening with hardeinng for me

    lol no :)

    2 2 helpful

Reply to this topic

Sign in or create an account to reply.