Securing SSH on AlmaLinux: Best Practices

SSH (Secure Shell) is the backbone of remote server management, making its security paramount. This guide will walk you through essential SSH hardening techniques for AlmaLinux systems.

Disabling Root Login

One of the first steps in securing SSH is to disable direct root login:

1. Edit the SSH configuration file:

sudo nano /etc/ssh/sshd_config

2. Find and modify the following line:

PermitRootLogin no

3. Restart the SSH service:

sudo systemctl restart sshd

Creating a New User with Sudo Privileges

Before disabling root login, ensure you have a user account with administrative privileges:

sudo adduser krython-user
sudo usermod -aG wheel krython-user
sudo passwd krython-user

Implementing Key-Based Authentication

Password authentication is vulnerable to brute-force attacks. Key-based authentication provides a more secure alternative:

Generate SSH Key Pair (on your local machine)

ssh-keygen -t rsa -b 4096

Copy Public Key to Server

ssh-copy-id krython-user@your-server-ip

Disable Password Authentication

Edit /etc/ssh/sshd_config:

PasswordAuthentication no

Additional Security Measures

Change Default SSH Port

Modify the port in /etc/ssh/sshd_config:

Port 2222

Configure Idle Session Timeout

Add to /etc/ssh/sshd_config:

ClientAliveInterval 300
ClientAliveCountMax 2

Implement Two-Factor Authentication

Install Google Authenticator:

sudo dnf install google-authenticator -y

Configure for your user:

google-authenticator

Firewall Configuration

Don’t forget to update your firewall rules if you change the SSH port:

sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --reload

Monitoring and Logging

Enable detailed logging in /etc/ssh/sshd_config:

LogLevel VERBOSE

Monitor failed login attempts:

sudo journalctl -u sshd | grep "Failed"

Conclusion

Securing SSH is crucial for maintaining a robust server infrastructure. By implementing these best practices - disabling root login, using key-based authentication, changing default ports, and enabling proper logging - you significantly reduce the attack surface of your AlmaLinux server.

Remember to test your configuration thoroughly before logging out to avoid locking yourself out of the system!