Unix
Windows
 Shell
Scripting 		Mysql Web
Hosting
 Forum Home | About us | FAQ
UNix System Adminitrator Page
GOOGLE ADD
WebHosting -> Security
 
Creating a Welcome message for SSH logins
1. ssh as root to your server
2. vi /etc/motd
3. Type the desired message i.e

---------------- Legal Notice ------------------------------
This computer system is for authorized users only. All activity is logged and regulary checked by systems personal. Individuals using this system without authority or in excess of their authority are subject to having all their services revoked. Any illegal services run by user or attempts to take down this server or its services will be reported to local law enforcement, and said user will be punished to the full extent of the law. Anyone using this system consents to these terms
-------------------------------------------------------------

4. Save the file and quit
5. Now ssh to your server and see the message is coming before the password prompt
 
Disabling Direct Root Login
Note : Before you start the next step, make sure you have a login id as a normal user which can access the server using ssh, if not do it first

1. ssh into your server as 'admin' and gain root access by su

2. open the file to edit /etc/ssh/sshd_config
    # vi /etc/ssh/sshd_config

3. Find the line
Protocol 2, 1

4. Uncomment it and change it to look like
Protocol 2

5. Next, find the line
PermitRootLogin yes

6. Uncomment it and make it look like
PermitRootLogin no

7. Save the file
:wq!

8. Now restart ssh
/etc/rc.d/init.d/sshd restart

9. Now login to your system as root
You will notice you can not login as root any more, So you will need to login to as a normal user first and the su - root
ssh -l user srvr
passwd : enter password for the user
su - root
passwd : enter password for the root

10. All done
 
Disabling telnet for network security

Telnet sends clear text passwords and usernames through logins and should be disabled on all web servers and replaced with SSH.

Some hosting providers are not disabling telnet by default but you should ensure that it has been turned off as it's a great security risk to your servers.

TELNET server listens for incoming messages on port 23, and sends outgoing messages to port 23.

1. Login to your server through SSH and su to root.

2. Type pico /etc/xinetd.d/telnet

3. Look for the line: disable = no and replace with disable = yes

4. Now restart the inetd service: /etc/rc.d/init.d/xinetd restart

5. Turn off it through chkconfig as well because it can still start through that.
/sbin/chkconfig telnet off

6. Scan your server to ensure port 23 is closed.
nmap -sT -O localhost

Also run ps -aux | grep telnet and if you find anything other than "grep telnet" as result kill it.

 
Configuring ssh standard port to a non standard port
1. ssh to the servers

2. vi /etc/ssh/sshd_config
Chagne "Port 22" to other value, we prefer a 4 digit value

Note : Make sure that the port you are choosing is not used for some other services, i.e port 80, is a standard port for httpd

3. Now restart the ssh services
service sshd restart

Note : If you are using a firewall then you will have to make the changes in the firewall configuration and may need to restart the firewall.
For example: service apf restart

See Also : How to install apf firewall
 
Generate Send your SSH Public Key to each host you use
If you do not already have a key, you can generat it using the below command
$ ssh-keygen -t dsa

Send your public key to each of the host you need to ssh
$ cat ~/.ssh/id_dsa.pub | ssh you@host 'cat - >> ~/.ssh/authorized_keys

Now you can use ssh-agent and ssh-add to facilitate a "single signon" situation
 
Limiting SSH Access to Specific IP Addresses
  
Log into the server then become root and follow the below steps:

   1. Edit /etc/hosts.allow
   2. Open a new line before:

      "ALL : ALL : spawn (/usr/sbin/safe_finger -l @%h | /bin/mail -s "Port Denial noted %d-%h" root) & : DENY":

    For each IP address you want to allow, add the following to /etc/hosts.allow (before the line noted):

        sshd: xxx.xxx.xxx.xxx : ALLOW

    Where xxx.xxx.xxx.xxx is the actual IP address you want to grant access. 

   1. Save the file
   2. Edit /etc/hosts.deny

    Add the following line towards the very top (we have it as the 1st line after the initial comments in our file):

        sshd: ALL

   1. Save the file

IMPORTANT:  Before you log off your current SSH session, try to open another SSH session to the 
machine you just made these settings on.  If you cannot get into the system, then in your already 
open SSH session, then comment out the lines you added.
 
   
Untitled Document
Free Link Exchange  Cheap Hosting  Domain Registration  Affiliate Program  
Terms & Conditions | Copyright © 2004-2007