13,420
edits
Changes
no edit summary
<li>Remember that you can view the '''/etc/services''' file in case you need to reference a service with a corresponding port number.</li>
</ol>
===Part 2: SSH Server Security Configuration===
Any time you configure your computer to allow logins from the network you are leaving yourself '''vulnerable to potential unauthorized access''' by so called "hackers". Running the sshd service is a fairly common practice but '''care must be taken to make things more difficult for those hackers that attempt to use "brute force" attacks to gain access to your system. Hackers use their knowledge of your system and many password guesses to gain access'''. They know which port is likely open to attack (TCP:22), the administrative account name (root), all they need to do is to "guess" the password.<br><br> Making your root password (and all other accounts!) both quite complex but easy to remember is not hard.
The Linux system administrator can also '''configure the SSH server to make the SSH server more secure'''. Examples include not permitting root login, and change the default port number for ssh.
:'''Perform the following steps:'''
# For this section, you will still be using your '''c7host''' and '''centos1''' VMs.
# Think of a good quality password and change your root passwords on all 3 VM's to be more secure. (It would be a good idea to do this for non-root accounts also)
# The next change you can make is to prevent the root account from logging in to sshd altogether.
# Change to your '''centos1''' VM and open a terminal.
# Edit the file '''/etc/ssh/sshd_config''' and look for the option <b><code><span style="color:#3366CC;font-size:1.2em;">PermitRootLogin</span></code></b>. <u>'''Un-comment the option'''</u> (or add the option if it does not appear) and change the option value to <b><code><span style="color:#3366CC;font-size:1.2em;">no</span></code></b>.<br><br>'''NOTE:''' Now any hacking attempt also has to guess an account name as well as the password. If you need to ssh with root access, ssh as a regular user and use '''su -''' to become root.<br><br>
# Even better, it is possible to restrict access to just specific users that require it.
# Edit the file '''/etc/ssh/sshd_config''' and add a new option of <b><code><span style="color:#3366CC;font-size:1.2em;">AllowUsers account</span></code></b> using '''your''' login account for account
# In order for these changes to be effective, issue the following command to restart the '''sshd''' service:<br /><b><code><span style="color:#3366CC;font-size:1.2em;">systemctl restart sshd</span></code></b>
# Try sshing from your '''c7host''' VM to your '''centos1''' VM. Where you successful? Would it work if you let "AllowUsers account" without a username, or a non-existent username? Do not do this for your machine!
# Next change the default port number that sshd uses (TCP:22).
# Edit the '''/etc/ssh/sshd_config''' file again, un-comment the port option and change the '''port number''' it uses from ''22'' to <b><code><span style="color:#3366CC;font-size:1.2em;">2200</span></code></b>.
# <u>Restart</u> the service.
# Confirm the new port is being used with the '''netstat''' command.
# Before we can use this new port we must change our firewall to allow traffic through the new port number and block access to port 22 by issuing the command:<br /><b><code><span style="color:#3366CC;font-size:1.2em;">iptables -I INPUT -p tcp -s0/0 --dport 2200 -j ACCEPT</span></code></b>
# Next, we will drop any incoming traffic to port 22 by issuing the command:<br><b><code><span style="color:#3366CC;font-size:1.2em;">iptables -I INPUT -p tcp -s0/0 --dport 22 -j DROP</span></code></b>
# We have now possibly mislead a potential "hacker" to the true port for our ssh server's communication channel (port).
# Switch to your '''centos1''' VM.
# Issue the commmand: <b><code><span style="color:#3366CC;font-size:1.2em;">ssh username@centos1</span></code></b>. What happens? What port do you think that command is using by default?
# Now issue the following command to ssh via port "2200": <b><code><span style="color:#3366CC;font-size:1.2em;">ssh -p 2200 username@centos1</span></code></b>. Where you able to connect?
<ol><li value="17">Finally, as a system administrator, you should periodically monitor your system logs for unauthorized login attempts.</li>
<li>On CentOS systems the log file that is used is '''/var/log/secure''' </li>
<li>It also logs all uses of the '''su''' and '''sudo''' commands.</li>
<li>Attempt to connect to all of your VM's as root and other users using both public key and password authentication. Use some '''su''' and '''sudo''' commands also. </li>
<li>Inspect the log to see what kind of information is logged.</li>
</ol>
<li>Make certain to logout of your '''centos3''' system. Use the '''hostname''' command to verify you are back in your centos2 server.</li>
</ol>
|}