Ssh

Obie · 09-26-2004, 01:03 AM

Do I need to install a SSH server on my Linux box if I wish to SSH into it? Also what do I need to perform to lockdown SSH?

d0odman · 09-26-2004, 02:50 AM

You sure do need an ssh server if you want to ssh in to your box. There's a bunch of documentation on the server if you unpackage the source, providing you compile it from source. Even if you don't, there should be a bunch of documentation in the distribution you use.

For the most part, pretty much all the major distributions have as a default ssh server install. There's a system wide configuration file called ssh_config that you can look at that's pretty well commented. Then there's user ssh configuration files.

Just look through your tree for stuff related to ssh, 'locate ssh' more stuff than you can shake a stick at should show up.

Cerbere · 09-27-2004, 03:37 AM

Just want to clarify one point: The relevant file is sshd_config. The ssh_config file is the ssh client configuration. Whereas the sshd_config file is the server (or ssh daemon) configuration file.

And, on the subject of 'locking down' your ssh server, two things to implement are:
a) Change the line which reads 'Protocol 1,2' in sshd_config to 'Protocol 2'.
b) Change the line which reads 'PermitRootLogin yes' to 'PermitRootLogin no'. It is more secure to log in as a regular user, then su to root if necessary.

Enjoy!
--- Cerbere

Obie · 09-28-2004, 03:17 AM

Cerbere,

Thanks for your advice. I just wish to clarify what happens when I "Change the line which reads 'Protocol 1,2' in sshd_config to 'Protocol 2'."

Cerbere · 09-28-2004, 04:25 AM

Making that change will instruct sshd to not accept connections using protocol 1, which has been superseded by protocol 2. The following is an excerpt from a nessus scan run on a server which allows both:

Quote:

Warning found on port ssh (22/tcp)

The remote SSH daemon supports connections made
using the version 1.33 and/or 1.5 of the SSH protocol.

These protocols are not completely cryptographically
safe so they should not be used.

Solution :
If you use OpenSSH, set the option 'Protocol' to '2'
If you use SSH.com's set the option 'Ssh1Compatibility' to 'no'

Risk factor : Low

Notice the risk from this is considered low. However, IMHO it's a simple fix, so why leave even a remote vulnerability. Give it a try, then if your ssh client can't connect, you can either get a newer client, or change the config back to allow protocol 1.

You can find more info about 'problems' with ssh here: http://www.sans.org/top20/#u8

Enjoy!
--- Cerbere

Obie · 09-28-2004, 02:38 PM

Cerbere,

Thank you for your advice and detailed illustration.