Options to secure SSH

[pmprog]

I want to open SSH on my Mint PC so I can remote to it from anywhere, and one thing I wanted to do was make sure if somebody tried to brute force it, it'd just deny their IP.

So I've done a bit of digging, and I found this site

DenyHosts and Fail2Ban sound like they do what I'm after, but also sound like they do the same thing. I assume I don't need them both?

I also thought root was always configured to never allow login (though this article is 3 years old) - both locally and remotely - am I right?

Are there any other things that are useful to know?

My other thought is to set up OpenVPN on the machine and connect to it as a VPN first, then just ssh normally. Would this be better? or is it pretty much the same?

 

[sebt3]

Have your sshd to accept only key authentification. Allow only one key for one user. Done

 

[pmprog]

Thanks. I'll probably either do that, or create a key-based VPN

 

[ekianjo]

RSA keys specified to a single device is the safest.

 

[Linux-SWAT]

https://stribika.github.io/2015/01/04/secure-secure-shell.html

 

[Asaggynoodle]

Back in the Late 90's there was this super popular thing called Pretty Good Privacy. 

You could probably find a way to use that with SSH. Basically everything is transmitted as gobbledygook, and can only be read if you have the Encryption key shared from the originating machine.

OR, Just use some kind of encryption like 4096 RSA.

OR, you could just deny access to any NIC MAC address other than the ones you specify, which would make it impossible for them to even get on your network.

 

[Binky]

^

1. I'm fairly sure PGP still exists...
2. Part of the point of Secure SHell is that its already encrypted, isn't it?
3. Are we talking about passive attackers evesdropping, or active ones trying to do nasty things to your computer. and/or steal data off your local storage?

 

[myNewUsername]

I tried to get Fail2Ban working on a siduction machine this fall. If i remember correctly it relied on normal sshd logfiles. Siduction used systemD (with its binary logfiles), so fail2ban could not work in this environment. I dont know if mint uses systemD though.

 

[pmprog]

• Are we talking about passive attackers evesdropping, or active ones trying to do nasty things to your computer. and/or steal data off your local storage?

The latter, because if somebody listens in, they'll get pretty bored pretty quickly.
Thanks for the feedback everyone.

 

[Night]

Key-based SSH authentication should work fine then, you can even stash your keys using something like this: http://is.gd/VNGZDO. If you want to, you could also tunnel everything through a VPN and have another layer on top.

If you want to take things even further, there's always a firewall based solution (which requires quite some trial and error). But i don't think i can really practically help you with that, as my practical skills are kind of lacking in the field.