[Security] Secure SSH

Option 1: Disable password-based authentication and use SSH keys

1. Generate a new SSH key pair on your local machine using the ssh-keygen command. This will create a public and a private key in your ~/.ssh directory.
2. Copy the public key to your server using the ssh-copy-id command. For example, ssh-copy-id user@server-ip.
3. Log in to your server using the key-based authentication by running ssh user@server-ip.
4. Open the SSH configuration file /etc/ssh/sshd_config using a text editor such as nano or vim.
5. Find the line that says #PasswordAuthentication yes and change it to PasswordAuthentication no.
6. Uncomment the line that says #PubkeyAuthentication yes and make sure it’s set to PubkeyAuthentication yes.
7. Save and close the file.
8. Restart the SSH service by running sudo systemctl restart sshd or sudo service sshd restart.

Option 2: Change default SSH port

1. Log in to your server as root or a user with sudo privileges.
2. Open the SSH configuration file /etc/ssh/sshd_config using a text editor such as nano or vim.
3. Find the line that says #Port 22 and change it to any other port number of your choice, such as Port 2222.
4. Save and close the file.
5. Restart the SSH service by running sudo systemctl restart sshd or sudo service sshd restart.
6. Update your firewall rules to allow the new SSH port.

Option 3: Use fail2ban to protect against brute force attacks

1. Install fail2ban on your server by running sudo apt-get install fail2ban or sudo yum install fail2ban.
2. Copy the default configuration file by running sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local.
3. Open the configuration file /etc/fail2ban/jail.local using a text editor such as nano or vim.
4. Find the [sshd] section and change enabled = false to enabled = true.
5. Configure the maximum number of failed login attempts and the ban duration as per your requirements.
6. Save and close the file.
7. Restart the fail2ban service by running sudo systemctl restart fail2ban or sudo service fail2ban restart.

Option 4: Use Two-Factor Authentication (2FA)

1. Install Google Authenticator on your Unix server by running sudo apt-get install libpam-google-authenticator or sudo yum install google-authenticator.
2. Run google-authenticator command to configure 2FA for your user account.
3. Follow the prompts to generate a QR code or a secret key.
4. Install a compatible 2FA app on your mobile device such as Google Authenticator or Authy.
5. Scan the QR code or manually enter the secret key in the app.
6. Edit the SSH configuration file /etc/pam.d/sshd using a text editor such as nano or vim.
7. Add the following line to the end of the file: auth required pam_google_authenticator.so.
8. Save and close the file.
9. Restart the SSH service by running sudo systemctl restart sshd or sudo service sshd restart.
10. Log in to your server using your username, password, and the 2FA code generated by your app.