Hack The Sec-Leading Resource Of Linux Tutorial: SSH

How To Setup SSH Keys

<div dir="ltr" style="text-align: left;" trbidi="on">
<h1 class="entry-title" itemprop="headline" style="background-color: #fdfdfd; box-sizing: border-box; font-family: proxima-nova, 'Helvetica Neue', Helvetica, Arial, sans-serif; line-height: 1.1; margin: 21px 0px 0px; text-align: center;">
<span style="color: red; font-size: x-large;"><u>Setup SSH Keys</u></span></h1>
<div>
<div style="text-align: justify;">
<span style="color: #222222; font-family: Verdana, Geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">SSH keys are by far the most secure way of logging into your cloud server via SSH. Passwords can be eventually cracked using brute-force attacks if they are too easy. If they are complex passwords, they become very hard to remember and writing them down defeats the purpose of a password.</span></span></div>
<div style="text-align: justify;">
<span style="color: #222222; font-family: Verdana, Geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><b>SSH </b>keys are nearly impossible to decipher using a brute force attack. If you generate an <a href="http://www.hackthesec.co.in/search/label/SSH">SSH key</a>, you will get a pair of two very long string of characters: a public and private key.</span></span></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgB-K6lGsBayShpawfyJUyK-w_T51_O2aLcOec6JqeyVBVxXPjj0nI2Cip35_7ga-VRAx8sR10WxPBTb8_CEk1t46cedsUG3ZEc_I2G9EWYzmQ6TFMYjhoxyy9cXPxzdseba1rHUiD4DX9H/s1600/ssh_keys_setup-www.hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgB-K6lGsBayShpawfyJUyK-w_T51_O2aLcOec6JqeyVBVxXPjj0nI2Cip35_7ga-VRAx8sR10WxPBTb8_CEk1t46cedsUG3ZEc_I2G9EWYzmQ6TFMYjhoxyy9cXPxzdseba1rHUiD4DX9H/s1600/ssh_keys_setup-www.hackthesec.co.in.jpg" /></a></div>
<div style="text-align: justify;">
<span style="color: #222222; font-family: Verdana, Geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><br /></span></span></div>
<div style="text-align: justify;">
<span style="color: #222222; font-family: Verdana, Geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Public keys are stored on the server that you’re trying to login to, the only possible tool which could unlock this public key is the private key which will be stored with you. SSH uses this to verify your identity by making sure that your private key can unlock the public key installed on the server.</span></span></div>
</div>
<div style="text-align: justify;">
<span style="font-family: Verdana, Geneva, sans-serif;"><span style="line-height: 26px;"><div>
<b><u><span style="color: #0b5394; font-size: large;">Create the <a href="http://www.hackthesec.co.in/search/label/SSH">SSH</a> key pairs</span></u></b></div>
<div style="color: #222222; font-size: 15px;">
The first step is to generate the combination of the public and private key. This can easily be done by opening a terminal window on the machine you will be using to access the remote server (most likely your own workstation).</div>
<div style="color: #222222; font-size: 15px;">
<br /></div>
<div style="color: #222222; font-size: 15px;">
In this example, we will be using RSA keys. The default values should be the correct ones, so you can simply just press enter to accept the default values. However, you may choose to add a passphrase for additional protection.</div>
<div style="color: #222222; font-size: 15px;">
<br /></div>
<div style="color: #222222; font-size: 15px;">
The passphrase is a password which unlocks your private key, which means that in order for someone to gain access, they must have both the private key and your passphrase. You can opt to not using a passphrase if you do not want to type a password each time.</div>
</span></span></div>
<div style="text-align: justify;">
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; text-align: left; vertical-align: baseline;"><div style="text-align: justify;">
<span style="color: lime; font-family: Courier New, Courier, monospace; font-size: large;"><span style="line-height: 15.6px;">[root@hackthesec]# ssh-keygen -t rsa</span></span></div>
<div style="text-align: justify;">
<span style="color: white; font-family: Courier New, Courier, monospace; font-size: large;"><span style="line-height: 15.6px;">Generating public/private rsa key pair.</span></span></div>
<div style="text-align: justify;">
<span style="color: white; font-family: Courier New, Courier, monospace; font-size: large;"><span style="line-height: 15.6px;">Enter file in which to save the key (/Users/user/.ssh/id_rsa): test</span></span></div>
<span style="color: white; font-family: Courier New, Courier, monospace; font-size: large;"><span style="line-height: 15.6px;">Enter passphrase (empty for no passphrase):
</span></span><div style="text-align: justify;">
<span style="color: white; font-family: Courier New, Courier, monospace; font-size: large;"><span style="line-height: 15.6px;">Your identification has been saved in /Users/user/.ssh/id_rsa.</span></span></div>
<span style="color: white; font-family: Courier New, Courier, monospace; font-size: large;"><span style="line-height: 15.6px;">Enter same passphrase again:
</span></span><div style="text-align: justify;">
<span style="color: lime; font-family: Courier New, Courier, monospace; font-size: large;"><span style="line-height: 15.6px;">Your public key has been saved in /Users/user/.ssh/id_rsa.pub.</span></span></div>
</pre>
<div style="background-color: white; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.2px;">
</div>
</div>
<div style="text-align: justify;">
<span style="color: #222222; font-family: Verdana, Geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">As you see by the results of the command, we now have an <b>id_rsa</b> and <b>id_rsa.pub</b> file which contain your private and public key respectively. We can now distribute this public key to servers where we would like to use public key authentication.</span></span></div>
<div style="text-align: justify;">
<span style="font-family: Verdana, Geneva, sans-serif;"><span style="line-height: 26px;"><div>
<b><u><span style="color: #0b5394; font-size: large;">Installing Public Key</span></u></b></div>
<div style="color: #222222; font-size: 15px;">
The SSH software stack comes with a useful little program called ssh-copy-id which facilitates the installation of <b>SSH keys</b> on your target server. All you have to do is run the following, replacing user and host by the appropriate information for your remote host.</div>
</span></span></div>
<div style="text-align: justify;">
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; text-align: left; vertical-align: baseline;"><div style="text-align: justify;">
<span style="font-size: large;"><span style="color: white; font-family: Courier New, Courier, monospace;"><span style="line-height: 15.6px;">[root@hackthesec]# </span></span><span style="line-height: 15.6px; text-align: left;"><span style="color: lime; font-family: Courier New, Courier, monospace;">ssh-copy-id</span><span style="color: white; font-family: Courier New, Courier, monospace;"> user@host</span></span></span></div>
</pre>
</div>
<div style="text-align: justify;">
<span style="color: #222222; font-family: Verdana, Geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">If your operating system does not have that command included, you can run the following command instead. If you get an error about your<b> .ssh</b> folder not existing, you should login to your server and create that folder by running <b>mkdir ~/.ssh.</b></span></span></div>
<div style="text-align: justify;">
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; text-align: left; vertical-align: baseline;"><div style="text-align: left;">
<span style="font-size: large;"><span style="color: white; font-family: Courier New, Courier, monospace;"><span style="line-height: 15.6px;">[root@hackthesec]# </span></span><span style="line-height: 15.6px; text-align: left;"><span style="color: lime; font-family: Courier New, Courier, monospace;">cat /Users/user/.ssh/id_rsa.pub</span><span style="color: white; font-family: Courier New, Courier, monospace;"> | ssh user@host "cat >> ~/.ssh/authorized_keys"</span></span></span></div>
</pre>
</div>
</div>
<div style="text-align: justify;">
<span style="color: #222222; font-family: Verdana, Geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">From now on, you can SSH to the server and you will note that your server will not ask for any passwords at all. The only thing it may ask for is your passphrase if you have configured one for your private key.</span></span></div>
<div style="text-align: justify;">
<a href="http://www.hackthesec.co.in/">hackthesec.co.in</a></div>
</div>

How To Setup SSH Keys

Setup SSH Keys SSH keys are by far the most secure way of logging into your cloud server via SSH. Passwords can be eventually cracked u...

How to protect your SSH server with Fail2Ban on Ubuntu

<div dir="ltr" style="text-align: left;" trbidi="on">
<h1 class="entry-title" itemprop="headline" style="background-color: #fdfdfd; box-sizing: border-box; font-family: proxima-nova, 'Helvetica Neue', Helvetica, Arial, sans-serif; font-weight: 500; line-height: 1.1; margin: 21px 0px 0px;">
<span style="color: red; font-size: x-large;"><u><i>Protect your SSH server with Fail2Ban on Ubuntu</i></u></span></h1>
<div>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="font-family: Georgia, Times New Roman, serif;">The most suitable application for this purpose is <a href="http://www.hackthesec.co.in/search/label/fail2ban" target="_blank">Fail2ban</a>. It is an intrusion prevention framework written in the Python programming language. It is able to run on servers that have an interface to a packet-control system or firewall installed locally. </span></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_4cJIHMGOWul32IjKw2UHT3plp2cfuBxHMY7xFOQn3stZVpLEMarRug4jdQoFnKOtnQlH0Kr_lploQv_re2tP7msBLfE9WnJY18x5OiRKH12pqZMMiA_R0LCFsuAnMTxPffsoA6WjiHso/s1600/fail2ban_www.hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_4cJIHMGOWul32IjKw2UHT3plp2cfuBxHMY7xFOQn3stZVpLEMarRug4jdQoFnKOtnQlH0Kr_lploQv_re2tP7msBLfE9WnJY18x5OiRKH12pqZMMiA_R0LCFsuAnMTxPffsoA6WjiHso/s1600/fail2ban_www.hackthesec.co.in.jpg" /></a></div>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="font-family: Georgia, Times New Roman, serif;"><br /></span></div>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="font-family: Georgia, Times New Roman, serif;">It scans log files and bans IPs that show the malicious signs — too many password failures, seeking for exploits, etc. In order to install <a href="http://www.hackthesec.co.in/search/label/fail2ban" target="_blank">fail2ban</a>, make sure your repositories are up to date and simply install it:</span></div>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<strong style="background-color: white; color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.2px;"><span style="color: #0e0e0e; font-family: Open Sans, serif, sans-serif;"><span style="display: block; font-size: 18px; line-height: 1.4em; max-height: 200px;"></span></span></strong></div>
<ul style="text-align: left;">
<li><strong style="background-color: white; color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.2px;"><span style="color: #0e0e0e; font-family: Open Sans, serif, sans-serif;"><strong style="color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.2px;"><span style="color: #0e0e0e; font-family: Open Sans, serif, sans-serif;"><span style="font-size: 18px; line-height: 1.4em; max-height: 200px;"><a href="http://www.hackthesec.co.in/2016/01/how-to-protect-sshftp-using-fail2ban-on.html" target="_blank">How To Protect SSH/FTP using Fail2ban on CentOS/RHEL</a></span></span></strong></span></strong></li>
</ul>
<br />
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; line-height: 1.42857; margin-bottom: 10.5px; overflow: auto; padding: 10px; word-break: break-all; word-wrap: break-word;"><code style="background-color: transparent; border-radius: 0px; box-sizing: border-box; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; padding: 0px; white-space: pre-wrap;"><span style="font-size: large;"># apt-get update
# apt-get install fail2ban</span></code><code style="background-color: transparent; border-radius: 0px; box-sizing: border-box; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: inherit; padding: 0px; white-space: pre-wrap;">
</code></pre>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="font-family: Georgia, Times New Roman, serif;">Once it is installed, it puts sample configuration file in <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; font-size: 16.2px; padding: 2px 4px;"><b>/etc/fail2ban/jail.conf</b></code>. We should copy the sample configuration file in <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; font-size: 16.2px; padding: 2px 4px;"><b>/etc/fail2ban/jail.local</b></code> and then, open file for editing using our favorite text editor. A lot of the possible services that we need to protect are already inside the sample file in their own section and there is DEFAULT section in the configuration file. Some of the important settings in this file are:</span></div>
<div style="background-color: #fdfdfd; box-sizing: border-box; margin-bottom: 10.5px;">
</div>
<ul style="text-align: left;">
<li><span style="font-family: Georgia, 'Times New Roman', serif; font-size: 18px; line-height: 28px;"><b>ignoreip</b>: We can use single IP, mask or a host name. IP addresses listed here will be excluded and will always be allowed to access the server</span></li>
<li><span style="font-family: Georgia, 'Times New Roman', serif; font-size: 18px; line-height: 28px;"><b>bantime</b>: The time (in seconds) that a host would be blocked from the server if they are found to be in violation of any of the defined rules. The default is set for 600 (10 minutes) but it should be increased to at least 30 minutes or more.</span></li>
<li><span style="font-family: Georgia, 'Times New Roman', serif; font-size: 18px; line-height: 28px;"><b>maxrwtry</b>: This is the number of incorrect login attempts allowed for a client before they get restricted to access the server. The default is 3.</span></li>
<li><span style="font-family: Georgia, 'Times New Roman', serif; font-size: 18px; line-height: 28px;"><b>backend</b>: specifies the backend used to get files modification. It should be set to “auto”</span></li>
<li><span style="font-family: Georgia, 'Times New Roman', serif; font-size: 18px; line-height: 28px;"><b>destemail</b>: We can specify email address where we want to get notifications when IP address is banned.</span></li>
</ul>
<br />
<div style="background-color: #fdfdfd; box-sizing: border-box; margin-bottom: 10.5px;">
</div>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="font-family: Georgia, Times New Roman, serif;">Another important section is the ACTION section. Important lines here line describe that fail2ban will use the system iptables in order to ban suspicious IP address and specify the protocol that fail2ban will monitor which can be TCP or UDP.</span></div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; line-height: 1.42857; margin-bottom: 10.5px; overflow: auto; padding: 10px; word-break: break-all; word-wrap: break-word;"><code style="background-color: transparent; border-radius: 0px; box-sizing: border-box; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; padding: 0px; white-space: pre-wrap;"><span style="font-size: large;">banaction = iptables-multiport
protocol = tcp</span></code><code style="background-color: transparent; border-radius: 0px; box-sizing: border-box; color: inherit; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: inherit; padding: 0px; white-space: pre-wrap;">
</code></pre>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="font-family: Georgia, Times New Roman, serif;">After we are done with the default settings and actions, we should setup our <a href="http://www.hackthesec.co.in/search/label/SSH" target="_blank">SSH </a>section which will make sure that the SSH access to our server is secured. Here is how the <a href="http://www.hackthesec.co.in/search/label/SSH" target="_blank">SSH </a>section should look inside the configuration file:</span></div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; line-height: 1.42857; margin-bottom: 10.5px; overflow: auto; padding: 10px; word-break: break-all; word-wrap: break-word;"><code style="background-color: transparent; border-radius: 0px; box-sizing: border-box; color: inherit; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; padding: 0px; white-space: pre-wrap;"><span style="font-size: large;">[ssh]

enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 4</span></code><code style="background-color: transparent; border-radius: 0px; box-sizing: border-box; color: inherit; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: inherit; padding: 0px; white-space: pre-wrap;">
</code></pre>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="font-family: Georgia, Times New Roman, serif;">This section makes <a href="http://www.hackthesec.co.in/search/label/SSH_Security" target="_blank">SSH monitoring active</a>, it listens on the SSH port for the ssh dameon, using the log file location <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; font-size: 16.2px; padding: 2px 4px;"><b>/var/log/auth.log</b></code> and bans the IP address of the user that will have 4 failed login attempts.</span></div>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="font-family: Georgia, Times New Roman, serif;">After all settings are made, we need to restart fail2ban and it will start monitoring the log files according to our settings, you can also check which rules are currently applied with the following <b><code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; font-size: 16.2px; padding: 2px 4px;">iptables</code> </b>command.</span></div>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="font-family: Georgia, Times New Roman, serif;">Fail2ban is one of the most widely used applications when it comes to server security. It is very simple and effective, so you shouldn’t think twice in order to decide to install it on your server. It is a must have application.</span></div>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="font-family: Georgia, Times New Roman, serif;"><a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></span></div>
</div>
</div>

How to protect your SSH server with Fail2Ban on Ubuntu

Protect your SSH server with Fail2Ban on Ubuntu The most suitable application for this purpose is Fail2ban . It is an intrusion prevent...