Persistently configure the OpenSSH daemon on Linux

Welcome to our tech support article on persistently configuring the OpenSSH daemon on Linux. OpenSSH is a widely used open-source tool that allows secure remote access to Linux systems. By configuring the OpenSSH daemon, you can customize its behavior and enhance the security of your remote connections.

What is the OpenSSH daemon?

The OpenSSH daemon, also known as sshd, is a background process that runs on a Linux system and listens for incoming SSH (Secure Shell) connections. It is responsible for handling authentication, encryption, and secure communication between the client and the server.

Configuring the OpenSSH daemon

To persistently configure the OpenSSH daemon, you need to modify its configuration file located at /etc/ssh/sshd_config. This file contains various settings that control the behavior of the SSH server. Let's explore some common configuration options:

1. Changing the SSH port

By default, SSH listens on port 22. To enhance security, it's recommended to change the default port to a non-standard one. Open the sshd_config file in a text editor:

$ sudo nano /etc/ssh/sshd_config

Locate the line that specifies the port and change it to your desired port number, for example:

Port 2222

Save the file and exit the text editor. Restart the SSH service for the changes to take effect:

$ sudo systemctl restart sshd

2. Disabling root login

Allowing direct root login over SSH is a security risk. It's best to disable it and use a regular user account instead. Find the line that says PermitRootLogin in the sshd_config file and set it to no:

PermitRootLogin no

Save the file and restart the SSH service:

$ sudo systemctl restart sshd

3. Enforcing key-based authentication

Password authentication can be vulnerable to brute-force attacks. By enforcing key-based authentication, you can significantly enhance the security of your SSH server. Look for the line that says PasswordAuthentication and change it to no:

PasswordAuthentication no

Save the file and restart the SSH service:

$ sudo systemctl restart sshd

4. Limiting user access

If you want to restrict SSH access to specific users or groups, you can use the AllowUsers or AllowGroups directives. For example, to allow only the user "john" to connect, add the following line:

AllowUsers john

Save the file and restart the SSH service:

$ sudo systemctl restart sshd

Conclusion

Configuring the OpenSSH daemon is essential for securing remote access to your Linux system. By following the steps outlined in this article, you can persistently modify the SSH server's behavior and enhance its security. Remember to always make a backup of the sshd_config file before making any changes and test the SSH connection after applying the modifications.

References