no<\/tt> like below.<\/p>\n\n\n\nPermitRootLogin no<\/pre>\n\n\n\nAfterwards, just save the file and exit the text editor.<\/p>\n\n\n\n
Making changes to the SSH configuration file will require you to restart the service, on CentOS cloud servers use the following.<\/p>\n\n\n\n
sudo systemctl restart sshd<\/pre>\n\n\n\nOn systems running Ubuntu, the service is simply called ssh, the same will work with Debian.<\/p>\n\n\n\n
sudo service ssh restart<\/pre>\n\n\n\nPassword policies<\/h2>\n\n\n\n
If your server has more remote users than just yourself, implement and enforce reasonable password policies with a Linux PAM module called pam_cracklib.so. The module will check user passwords against dictionary words to help prevent weak password usage. You can also use it to set the minimum requirements for a new password like length and complexity.<\/p>\n\n\n\n
On Ubuntu and Debian systems, you need to install the module with the command below.<\/p>\n\n\n\n
sudo apt-get install libpam-cracklib<\/pre>\n\n\n\nCentOS and other Red Hat variants already have it installed by default.<\/p>\n\n\n\n
With the module installed, open the configuration file in an editor on Ubuntu or Debian.<\/p>\n\n\n\n
sudo nano \/etc\/pam.d\/common-password<\/pre>\n\n\n\nOn cloud servers with CentOS, the file is stored under a different name, use the following.<\/p>\n\n\n\n
sudo vi \/etc\/pam.d\/system-auth<\/pre>\n\n\n\nInstalling the module on Ubuntu and Debian already pre-configures the password checks, so find the corresponding setting and edit it to look like the example below. On CentOS, depending on your version, you might need to add the whole following line to the configuration file.<\/p>\n\n\n\n
password required pam_cracklib.so retry=3 minlen=8 difok=3 dcredit=1 ucredit=1 lcredit=1<\/pre>\n\n\n\nThe first parameter retry<\/tt> defines how many times the user gets to attempt again. The next minlen<\/tt> marks the minimum length of the password, while difok<\/tt> checks the maximum number of reused characters compared to the user\u2019s old password. The last 3 parameters set requirements for the password complexity, dcredit<\/tt> is a number of numerals, ucredit<\/tt> for upper case characters, and finally, lcredit<\/tt> is a number of lower case characters.<\/p>\n\n\n\n
Once you have set the password requirements to your liking, save the configuration file and exit the editor. Note that these policies only apply to regular user accounts, you as an administrator are still responsible for the root user password strength.<\/p>\n\n\n\n
Restrict SSH to specific user group<\/h2>\n\n\n\n
OpenSSH servers can limit user connections by cross-checking that they belong to the allowed group. This can be useful if you have multiple users which should not need to remote with SSH, or you just want the added security for example\u00a0when running a web service or database with separate users from your own.<\/p>\n\n\n\n
Start by creating a new user group for this purpose, you can name the group whatever you wish, for this example, the group is called sshusers<\/tt>.<\/p>\n\n\n\nsudo groupadd sshusers<\/pre>\n\n\n\nNext, add your own username to the same new group.<\/p>\n\n\n\n
sudo gpasswd -a <username> sshusers<\/pre>\n\n\n\nYou can then check that your username was added to the group successfully.<\/p>\n\n\n\n
groups <username><\/pre>\n\n\n\nThe output will show all the groups the given username belongs to including a user group with the same name as the user.<\/p>\n\n\n\n
user : user sudo sshusers<\/pre>\n\n\n\nWith this done you can specify the allowed group for OpenSSH. To do this, open the configuration file in an editor.<\/p>\n\n\n\n
sudo nano \/etc\/ssh\/sshd_config<\/pre>\n\n\n\nIf you do not have nano installed, or just prefer vi, use the following instead.<\/p>\n\n\n\n
sudo vi \/etc\/ssh\/sshd_config<\/pre>\n\n\n\nYou will need to add the line\u00a0underneath\u00a0the file, for example at the end.<\/p>\n\n\n\n
AllowGroups sshusers<\/pre>\n\n\n\nMake sure your new configuration option is not commented out with the #<\/tt> sign in front of it, then save the file and exit the editor.<\/p>\n\n\n\n
Afterwards just restart your SSH server, on Ubuntu and Debian servers use this command.<\/p>\n\n\n\n
sudo service ssh restart<\/pre>\n\n\n\nWith CentOS and other Red Hat variants, the same can be done using the following instead.<\/p>\n\n\n\n
sudo systemctl restart sshd<\/pre>\n\n\n\nWith the new configuration, any user that does not belong to the allowed group will simply be denied access over SSH, even if their password was entered correctly. This will greatly reduce the chance of having a user password brute-forced, or guessed with dictionary lists, giving you a more secure cloud server.<\/p>\n","protected":false},"featured_media":0,"comment_status":"open","ping_status":"closed","template":"","community-category":[121],"class_list":["post-24639","tutorial","type-tutorial","status-publish","hentry","community-category-security"],"acf":[],"_links":{"self":[{"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/tutorial\/24639","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/tutorial"}],"about":[{"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/types\/tutorial"}],"replies":[{"embeddable":true,"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/comments?post=24639"}],"wp:attachment":[{"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/media?parent=24639"}],"wp:term":[{"taxonomy":"community-category","embeddable":true,"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/community-category?post=24639"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}