Red Hat System Administration I
The configuration of the OpenSSH service, sshd, can be changed by editing the file /etc/ssh/sshd_config and restarting the service with systemctl.
Objective
After completing this section, students should be able to customize sshd configuration to restrict direct logins as root or to disable password-based authentication.
The OpenSSH server configuration file
While OpenSSH server configuration usually does not require modification, additional security measures are available.
Various aspects of the OpenSSH server can be modified in the configuration file /etc/ssh/sshd_config.
Prohibit the root user from logging in using SSH
From a security standpoint, it is advisable to prohibit the root user from directly logging into the system with ssh.
The username root exists on every Linux system by default, so a potential attacker only has to guess the password, instead of a valid username and password combination.
The root user has unrestricted privileges.
The OpenSSH server has an internal configuration file setting to prohibit a system login as user root, which is commented out by default in the /etc/ssh/sshd_config file:
#PermitRootLogin yes
By enabling the previous option in the /etc/ssh/sshd_config configuration file as follows, the root user will be unable to log into the system using the ssh command after the sshd service has been restarted:
PermitRootLogin no
The sshd service has to be restarted to put the changes into effect:
[root@serverX ~]#systemctl sshd
Another option is to only allow key-based ssh login as root with:
PermitRootLogin without-password
Prohibit password authentication using SSH
Only allowing key-based logins to the remote command line has various advantages:
SSH keys are longer than an average password, which adds security.
Less effort to initiate remote shell access after the initial setup.
There is an option in the /etc/ssh/sshd_config configuration file which turns on password authentication by default:
PasswordAuthentication yes
To prevent password authentication, the PasswordAuthentication option has to be set to no and the sshd service needs to be restarted:
PasswordAuthentication no
Keep in mind that whenever you change the /etc/ssh/sshd_config file, the sshd service has to be restarted:
[root@serverX ~]#systemctl reload sshd
References
ssh(1), sshd_config(5) man pages
