[SOLVED] using GUI UFW RULE TO BLOCK ALL IN?OUT SSH PORT 22 REQUESTS PLEASE HELP!

akiras rain · 12-26-2015, 04:02 PM

looked at MY THREADS AND ALL OF THEM ARE LISTED EXCEPT THIS ONE> I KNOW OTHERS CAN SEE THIS THREAD DID I SOMEHOW POST THIS WRONG AND THAT'S WHY IT DOESN'T SHOW ON THE "MY THREADS LIST"?

ok so if I create a ufw rule to block ALL Inbound/outbound ssh requests on port 22. IS THIS AS GOOD AS CHANGING ALL THE SSH PASSWORD OR USING KEYS.

basically what i am asking is am I secure using the firewall to block ssh in this way or should i create keypairs for all my accounts root/user/guest etc and do it that way because it is more secure than using the UFW?????

i have checked the AUTH.LOG and see NO FAILED ATTEMPTS FROM ANY IP ADDRESS IN THE LAST 3 days......

please help!

berndbausch · 12-26-2015, 04:52 PM

Blocking port 22 disables ssh access to the default port. If the ssh daemon listens on a different port, it's not blocked. In this sense, it's not the same as setting up keys or passwords, or disabling the service.

The usual recommendation is to have several defense layers. Read this post about securing network services: http://www.linuxquestions.org/questi...1/#post2122954.

Habitual · 12-26-2015, 05:15 PM

Code:

ufw allow from IP/32 to any port 22

See https://help.ubuntu.com/community/UFW

akiras rain · 12-26-2015, 05:55 PM

ok so what if i modify my ufw rule to not all ANY port to work for SSH??

Quote:

Originally Posted by berndbausch

Blocking port 22 disables ssh access to the default port. If the ssh daemon listens on a different port, it's not blocked. In this sense, it's not the same as setting up keys or passwords, or disabling the service.

The usual recommendation is to have several defense layers. Read this post about securing network services: http://www.linuxquestions.org/questi...1/#post2122954.

Habitual · 12-26-2015, 06:36 PM

I think it's as simple as

Code:

ufw deny ssh

berndbausch · 12-27-2015, 09:26 AM

Quote:

Originally Posted by akiras rain

ok so what if i modify my ufw rule to not all ANY port to work for SSH??

I might be wrong, but I doubt that ufw knows or cares for the program that listens on a port. You can use ufw to block ports, but you can't use it to block ports for a certain service.

Again, the recommendation is several layers of defense, e.g. block the port and disable the ssh service.

Habitual · 12-28-2015, 09:13 AM

1. ssh Keys first and foremost.
2. Don't allow root access via /etc/ssh/sshd_config
3. Don't allow passwords via /etc/ssh/sshd_config
4. Prohibit/limit ssh access via "wrappers"
5. ufw (Default rules are fine for the average home user)

If you are behind a router, most of this is an exercise.

What ssh are you trying to defend? Server or Desktop? Physical or Virtual?

akiras rain · 12-29-2015, 01:56 PM

so I can open the sshd_config file but when i try to save it it doesn't work. Is there a command in the terminal i can use that just disables SSH entirely from working at all?

Quote:

Originally Posted by Habitual

1. ssh Keys first and foremost.
2. Don't allow root access via /etc/ssh/sshd_config
3. Don't allow passwords via /etc/ssh/sshd_config
4. Prohibit/limit ssh access via "wrappers"
5. ufw (Default rules are fine for the average home user)

If you are behind a router, most of this is an exercise.

What ssh are you trying to defend? Server or Desktop? Physical or Virtual?

Habitual · 12-29-2015, 02:08 PM

Quote:

Originally Posted by akiras rain

so I can open the sshd_config file but when i try to save it it doesn't work. Is there a command in the terminal i can use that just disables SSH entirely from working at all?

Yes, turn it off or remove it.
How would you then access the server?

Habitual · 12-29-2015, 02:15 PM

Disable all ssh requests to port 22 using ufw

Code:

sudo ufw disable ssh

Allow "MY_IP" to use ssh via ufw

Code:

sudo ufw allow from MY_IP/32 to any port 22

"MY_IP" is your home/desktop/other/safe/computer's ip address.

Code:

curl icanhazip.com

for what you should use for MY_IP/32

If you solely want to turn off ssh

Code:

service ssh stop

or similar...

Warning: How would you then access the server?

If you don't know enough that /etc/ssh/sshd_config is only writable by a privileged user, should you really be attempting this exercise?

akiras rain · 12-30-2015, 11:36 AM

this is not a server setup it is a desktop OS setup. i unfortunately am just starting to burrow into the giant wood house that is linux

so i am a newb. i don't have a server running yet but i feel like if i could secure a linux desktop well i would at least have a chance at having so so server security when i do that in future.

Quote:

Originally Posted by Habitual

Disable all ssh requests to port 22 using ufw

Code:

sudo ufw disable ssh

Allow "MY_IP" to use ssh via ufw

Code:

sudo ufw allow from MY_IP/32 to any port 22

"MY_IP" is your home/desktop/other/safe/computer's ip address.

Code:

curl icanhazip.com

for what you should use for MY_IP/32

If you solely want to turn off ssh

Code:

service ssh stop

or similar...

Warning: How would you then access the server?

If you don't know enough that /etc/ssh/sshd_config is only writable by a privileged user, should you really be attempting this exercise?

Habitual · 12-30-2015, 01:29 PM

you could either tell ufw to not allow ssh using:

Code:

sudo ufw disable ssh

or you could stop the ssh service deamon using:

Code:

service ssh stop

or remove the ssh server daemon software using:

Code:

sudo apt-get remove openssh-server

Your choice.

akiras rain · 12-30-2015, 03:15 PM

OK excellent i am just going to stop that service. can i do the same for the telnet signin service? i have telnet blocked on the UFW as well.

Quote:

Originally Posted by Habitual

you could either tell ufw to not allow ssh using:

Code:

sudo ufw disable ssh

or you could stop the ssh service deamon using:

Code:

service ssh stop

or remove the ssh server daemon software using:

Code:

sudo apt-get remove openssh-server

Your choice.

Habitual · 12-30-2015, 03:51 PM

Quote:

Originally Posted by akiras rain

cdan i do the same for the telnet signin service? i have telnet blocked on the UFW as well.

telnet the client, or telnetd the daemon?

You don't need a ufw rule for using the telnet client utility and NEVER run the telnet daemon.
telnet signin? wtf is that?

akiras rain · 01-01-2016, 11:09 AM

before reading below i found why i can't signin to either linux pc

I used your command "sudo apt-get remove openssh-server"

and it's not installed on either linux pc! DOLP! "homer simpson"

well from this i have learned a valuable lesson when trying to secure my pc. make sure the thing i am trying to protect is actually on my system in the 1st place!

lol

OK so i know this is the exact opposite of what i've been asking on this thread but

i figure what better way to test if i am protected than to try and sign in remotely with ssh myself! on my own network from a different linux pc i tried the
command in the terminal "ssh 192.168.1.xxx"

then from the computer itself i tried "ssh 127.0.0.1"

for both these i get "connection refused port 22"

now i turned the firewall off and I STILL get "connection refused port 22"

why would it refuse me if the firewall is set to OFF??

Quote:

Originally Posted by Habitual

telnet the client, or telnetd the daemon?

You don't need a ufw rule for using the telnet client utility and NEVER run the telnet daemon.
telnet signin? wtf is that?