Hi all,

I've got a 13.37 server that's running just fine - I'm very happy with it, it's both my local proxy and development / testing platform.
I'm running into a problem: I'm working more and more often away from home on my laptop. Up until now I did not want to open the SSH access to the outside world, but it seems this is becoming necessary. Especially since I do all my file transfers through SSHFS (even locally, this is so easy to set up that I prefer it over Samba or NFS). So I have two security steps in mind:

1. I want to make sure only normal users - and maybe even just ONE particular user - can log in through SSH from the outside. Especially not root, obviously. As long as I can su at a later time, that's fine, and that's how it should be done anyway. But this, I should be able to figure out on my own I believe, this must be quite common.

2. I'd like to be notified by e-mail each time an SSH login is attempted. If I could get the user name & IP in the e-mail it'd even be better... And this is likely to be more tricky than the first task! Anyone has an idea on how to do that?

In the meantime if you have any further idea on how to make it even safer I'm interested...

Thanks.

Seb.

There is sticky post on this issue in the Security forum. http://www.linuxquestions.org/questi...tempts-340366/

Short answer:
Use a non-standard port. Port 22 is targeted by automated attack tools.
Use public key authentication. If only you have the key, it is unlikely that anyone will pick the lock.
Disable password logins and root access.

Do not bother with the email alerts. Unsuccessful attempts are not a problem. Successful logins are recorded in /var/log/messages.

you can also use an AllowUsers option in /etc/ssh/sshd.conf
to let only myuser login by ssh.

By the way, Always use passphased keys for login.

In addition to the steps already mentioned I use denyhosts (http://denyhosts.sourceforge.net/) which automatically blacklists ip addresses which try to break into your server.

Take a look at the messages log (grep ssh) and you will be amazed at how often your server is attacked. You definitely don't want an email every time.

Brian

Ok thanks guys, I think with all this I should be able to get it right.
This is important as this is not exactly the kind of subject with which you can take the trial & error route...