Configure and Secure SSH - RHCSA (RH124).pdf

Slides on how to configure and secure SSH - Part of RHCSA (RH124) syllabus

1. Configure and secure SSH

2. Shell
●Command-line interface to interact with OS

●Default shell in RHEL is Bash(Bourne again
shell)

●Other types of shells are sh, zsh, ksh, csh

3. Secure SHell(SSH)
●Major protocol to access remote servers.
●Sends the information in encrypted form.
●Works on port #22
●sshd is the service daemon
●Open-ssh is its software implementation
●Key Features:
○Secure remote access
○Authentication: (passwords & public key
cryptography)
○Configurable

5. Install the openssh-server
●Command: yum install openssh-server
Start and enable the ssh
●Command: systemctl start ssh && sudo systemctl enable ssh

6. Create a user
●Command: useradd <username>
Set a password for the user
●Command: passwd <username>

7. Edit the 'sshd_config' file to add custom configurations to secure SSH server
●Command: vi <path-to-sshd-config>
Note: Find the line 'PasswordAuthentication no' and change it to
'PasswordAuthentication yes' and then save the file.

8. Make changes to the ‘sshd’ redhat configuration file.
●Command: vi <path-to-sshd-redhat-config>
Note: Find the line 'ChallengeResponseAuthentication no' to
'ChallengeResponseAuthentication yes' and save the file.

9. Restart the 'sshd' service to apply the changes made to the config files.
●Command: systemctl restart sshd
Connect to the machine using the 'ssh' command in new terminal.
●Command: ssh <username>@<ip-address>

10. Switch back to terminal and configure the SSH server to make it more secure.
●Command: cp <path-to-sshd-config> <path-to-sshd-config-backup>
Note: Keep a backup of the original 'sshd_config' file before making any
changes.

11. Edit the 'sshd_config' file to add custom configurations to secure SSH server
by adding these lines.
●Command: vi <path-to-sshd-config>
Note: Restart the ‘sshd’ service to apply the changes.

12. Re-login with same username and wait for sometime to notice the logs and
debug messages
●Command: ssh -vvv <username>@<ip-address>

13. Disable root login and empty passwords and limit users to student in
‘sshd_config’ file
●Command: PermitRootLogin no
PermitEmptyPasswords no
AllowUsers <new-user>
Note: Restart the ‘sshd’ service to apply the changes.

14. Try to login with old credentials again, login won’t be allowed as only
<new-user> is allowed
●Command: ssh <username>@<ip-address>
Create that <new-user> account that will have access and perform login
●Command: useradd <new-user> && passwd <password>

15. Change the port number in ‘sshd_config’ file and restart server
●Command: Port <port-number>
On ‘ssh’ terminal perform login on the newly created port
●Command: ssh -p <port-number> <username>@<ip-address>