Configure and Secure SSH - RHCSA (RH124).pdf

Configure and Secure SSH - RHCSA (RH124).pdf

• 1.
  Configure and secureSSH
• 2.
  Shell ● Command-line interfaceto interact with OS ● Default shell in RHEL is Bash(Bourne again shell) ● Other types of shells are sh, zsh, ksh, csh
• 3.
  Secure SHell(SSH) ● Majorprotocol to access remote servers. ● Sends the information in encrypted form. ● Works on port #22 ● sshd is the service daemon ● Open-ssh is its software implementation ● Key Features: ○ Secure remote access ○ Authentication: (passwords & public key cryptography) ○ Configurable
• 5.
  Install the openssh-server ●Command: yum install openssh-server Start and enable the ssh ● Command: systemctl start ssh && sudo systemctl enable ssh
• 6.
  Create a user ●Command: useradd <username> Set a password for the user ● Command: passwd <username>
• 7.
  Edit the 'sshd_config'file to add custom configurations to secure SSH server ● Command: vi <path-to-sshd-config> Note: Find the line 'PasswordAuthentication no' and change it to 'PasswordAuthentication yes' and then save the file.
• 8.
  Make changes tothe ‘sshd’ redhat configuration file. ● Command: vi <path-to-sshd-redhat-config> Note: Find the line 'ChallengeResponseAuthentication no' to 'ChallengeResponseAuthentication yes' and save the file.
• 9.
  Restart the 'sshd'service to apply the changes made to the config files. ● Command: systemctl restart sshd Connect to the machine using the 'ssh' command in new terminal. ● Command: ssh <username>@<ip-address>
• 10.
  Switch back toterminal and configure the SSH server to make it more secure. ● Command: cp <path-to-sshd-config> <path-to-sshd-config-backup> Note: Keep a backup of the original 'sshd_config' file before making any changes.
• 11.
  Edit the 'sshd_config'file to add custom configurations to secure SSH server by adding these lines. ● Command: vi <path-to-sshd-config> Note: Restart the ‘sshd’ service to apply the changes.
• 12.
  Re-login with sameusername and wait for sometime to notice the logs and debug messages ● Command: ssh-vvv <username>@<ip-address>
• 13.
  Disable root loginand empty passwords and limit users to student in ‘sshd_config’ file ● Command: PermitRootLogin no PermitEmptyPasswords no AllowUsers <new-user> Note: Restart the ‘sshd’ service to apply the changes.
• 14.
  Try to loginwith old credentials again, login won’t be allowed as only <new-user> is allowed ● Command: ssh <username>@<ip-address> Create that <new-user> account that will have access and perform login ● Command: useradd <new-user> && passwd <password>
• 15.
  Change the portnumber in ‘sshd_config’ file and restart server ● Command: Port <port-number> On ‘ssh’ terminal perform login on the newly created port ● Command: ssh-p <port-number> <username>@<ip-address>