sshd_config

The sshd_config file is the main configuration file for the OpenSSH server daemon (sshd) on Unix-like operating systems, including Linux. This file controls various settings and options related to the behavior of the SSH server, such as authentication methods, access control, and connection parameters.

Key Configuration Options in sshd_config:

• Port: Specifies the port number that the SSH server listens on. The default is 22, but changing it can add a layer of security.

  Port 22

• PermitRootLogin: Controls whether the root user can log in via SSH. It’s recommended to set this to no to prevent direct root access.

  PermitRootLogin no

• PasswordAuthentication: Specifies whether password authentication is allowed. Disabling this (no) can enhance security by requiring key-based authentication.

  PasswordAuthentication yes

• PubkeyAuthentication: Enables or disables public key authentication, which is a more secure method than passwords.

  PubkeyAuthentication yes

• PermitEmptyPasswords: Specifies whether the SSH server allows login with an empty password. This should be set to no for security reasons.

  PermitEmptyPasswords no

• AllowUsers or AllowGroups: Restricts SSH access to specific users or groups, providing more granular access control.

  AllowUsers user1 user2

• MaxAuthTries: Limits the number of authentication attempts per connection to prevent brute-force attacks.

  MaxAuthTries 3

• X11Forwarding: Controls whether X11 forwarding is allowed, enabling remote graphical sessions over SSH. If not needed, it’s safer to disable this.

  X11Forwarding no

• Banner: Specifies a file to be displayed before authentication. This can be used to show a legal warning or informational message.

  Banner /etc/issue.net

Example Workflow:

1. Edit the sshd_config File:

   sudo nano /etc/ssh/sshd_config

2. Make Changes: Modify the necessary options according to your security needs.
3. Restart SSH Service: After making changes, restart the SSH service to apply the new configuration.

   sudo systemctl restart sshd

Security Considerations:

• Disable Root Login: Prevents direct SSH access to the root account, reducing the risk of unauthorized access.
• Use Key-Based Authentication: Instead of relying on passwords, use SSH keys, which are more secure and harder to crack.
• Change the Default Port: Moving SSH to a non-standard port can reduce exposure to automated attacks.
• Restrict Access: Limit SSH access to specific users or groups and consider implementing IP-based restrictions.

The sshd_config file is a crucial component in securing SSH access to your server, and understanding its options allows you to customize and enhance your server’s security.