5 Best Techniques to Secure SSH on Ubuntu

Securing SSH (Secure Shell) access on servers with various operating systems, including Ubuntu, is crucial to prevent unauthorized access and mitigate security risks. Without the necessary security measures, SSH can become a vulnerable entry point.

I this article, we outline the five best techniques to secure SSH on Ubuntu, including implementing multi-factor authentication, modifying default security settings, and enforcing security with firewalls.

1. Setting Up Second-Factor Authentication

One of the simplest ways to improve SSH security is to add an extra layer of authentication with two-factor authentication (2FA). With 2FA, even if an attacker guesses or obtains a password, they still need a second form of authentication to gain access. Commonly, a combination of a one-time password sent to user’s devices and a passphrase is used.

By adding the second layer to the authentication, users can be sure that any attempt to gain remote access through SSH will be subjected to authentication with more than just one credential.

Popular tools like Google Authenticator or Authy can be integrated into your SSH login process. Enabling 2FA on SSH can significantly reduce the risk of unauthorized access, especially on publicly accessible servers. After all, two layers of protection are better than one.

2. Modifying Default Security Settings

Changing SSH’s default settings can close common attack vectors used by malicious actors.

SSH default options are located in a config file in /etc/ssh/sshd_config. Here are a few key settings to adjust for better security.

Updating the Default Port

By default, SSH runs on port 22. Changing this port to a less common one (e.g., 2222) reduces exposure to automated scanning and brute-force attacks since going to the default ports is what attackers do first.

To change the default port, edit the SSH configuration file /etc/ssh/sshd_config and update the Port directive to your chosen port. Remember to update any firewall rules to reflect this change.

Disabling Root Login

Allowing root login over SSH can be risky, as it provides direct access to the root user. The root privileges grant complete access to the entire system. Thus, by disabling the root login, you can review and control the level of access each user gets to the server.

Disabling root login ensures that attackers need to know a specific username, adding an additional layer of security. To disable root login, open /etc/ssh/sshd_config and set PermitRootLogin to no.

You can set up sudo users if system administrators need privileges to complete certain tasks.

Turning Off Password-Based Authentication

The default password-based authentication though convenient is often the reason why brute-force attacks succeed.

Based on our experience, switching to key-based authentication is optimal, since it requires an SSH key pair, you eliminate the risk associated with weak passwords.

To turn off the default password-based authentification, in /etc/ssh/sshd_config, set PasswordAuthentication to no, which restricts access to only those with a valid SSH key.

It should look like:

PasswordAuthenticationno

Restricting Access with "AllowUsers"

All system users can log in via SSH with their passwords or public keys, but not all of them should be able to. The AllowUsers directive lets you define which users are allowed to SSH into the server. This is a straightforward way to limit access to specific users and prevent unauthorized logins.

In /etc/ssh/sshd_config, add AllowUsers followed by the usernames allowed to access SSH, further hardening security.

3. Using SSH Certificates for Client Authentication

SSH certificates are an alternative to traditional SSH keys and offer a higher level of security. SSH keys are basically words that can be copied so they don’t offer enough protection.

Authentification based on SSH certificates is a better alternative. SSH certificates verify the identity of each key, when those are used for login. With SSH certificates, you can manage access and expiration times more easily, which is ideal for large environments or temporary access. By configuring your SSH server to trust a certificate authority (CA) that issues certificates to users, you gain greater control over who has access to the server, without having to manage individual keys manually.

You can generate certificates through OpenSSH using ssh-keygen.

4. Securing Access with a Bastion Host

A bastion host acts as a secure intermediary between your private servers and external access. By placing SSH access to internal servers behind a bastion host, you create a single, hardened entry point that’s easier to monitor and secure. A bastion host is located right before the firewall, so it’s the first point of system protection.

To implement a bastion host, restrict SSH access to private servers so that only the bastion host can reach them, thereby reducing exposure to external threats.

5. Enforcing Security with Firewalls

Firewalls add an essential layer of security by controlling inbound and outbound traffic; depending on the settings, firewalls can also protect traffic within the private network. On Ubuntu, UFW (Uncomplicated Firewall) is an easy-to-use tool for managing firewall rules.

Start by allowing only the chosen SSH port and deny other unauthorized ports. Additionally, rate-limiting SSH connections can mitigate brute-force attacks by blocking repeated connection attempts from a single IP address.

To strengthen security with firewalls: 

1. Install UFW: sudo apt install ufw
2. Allow only your chosen SSH port (e.g., 2222): sudo ufw allow 2222/tcp
3. Enable rate limiting: sudo ufw limit 2222/tcp
4. Enable the firewall: sudo ufw enable

Configuring your firewall in this way reduces the attack surface and minimizes the risk of unauthorized access.

Users working on Linux can use iptables, where one can define rules governing the incoming SSH traffic and sort it by port, IP address, or protocol. The system of iptables is an interface to the netfilter firewall, so adjusting its setting, adjusts the firewall.

Final Thoughts

Securing SSH on Ubuntu requires a combination of measures, from adjusting default settings to implementing more advanced techniques like SSH certificates and bastion hosts. Each method described here plays an essential role in protecting SSH access and reinforcing server security. Taking these steps can significantly reduce vulnerabilities and improve the overall security posture of your Ubuntu server.