A service that is commonly used on Linux is Secure Shell. We already talked about it a bit before.
Now it's time to talk about some more advanced features.
So Secure Shell provides remote access to a Linux terminal.
You may have to install it before using it using DNF install or APT install of
Openh SSH server. After installing it, make sure that it is started and enabled by systemd.
That should happen automatically on Ubuntu, but you will
need to do it manually on Red Hat family.
Now if you are running Secure Shell, you might be interested in some securing of secure Shell.
The problem is that Internet based SSH servers that offer access on Port 22 are
a common target for brute force attacks and you could consider modifying a few parameters
in the configuration file in etc SSH SSHD config to make it more secure.
There is port which defines the port on which SSH is listening.
Permit root login is what you should consider disabling so that the root user cannot log in directly.
Allowed users is what you can use to specify a list of users that are allowed to log in.
Make that restricted so that only few users are allowed to log in and not everybody knows about it.
And then we have password authentication which allows or disallows password authentication. If you do that, make
sure that you first create some SSH keys as explained in a later video in this lesson.
Now if you want to run Secure Shell on a non default port, you
do need to open the firewall or Red hat family. That works using firewalld.
So sudo firewall cmd add service permanent followed by
firewall cmd reload and if you use the non
default port then you need Firewall CMD add port
2022 TCP permanent after which you reload the firewall.
On Ubuntu the uncomplicated firewall or UFW is used.
So use sudo UFW allow OpenSSH to allow generic access and allow 2022
TCP to allow access on port 2022. Then there is one more thing
and that is on Red hat only where you have selinux.
Selinux is a security system and it will not allow SSH to run on a non default port.
So if you want to run SSH on a non default port on Red hat, you need to
issue the following command scmanage port A T SSH port T B2022 TCP do that before you are
starting the SSH server because otherwise it won't work. Let me show you how to do this.
I'M going to start with the SC Linux stuff. Sudo semanage port A t
ssh port T P2022 TCP if I wouldn't be doing that, then I can
never start my SSH server on port 2022 and oh no, apparently I'm doing
something wrong in my SIO Linux command. Well, we have man for that and
I'm checking out man scmanage iPhone port and there we can see that it
needs to be P TCP2022 and I've done it the other way around.
So let's fix and do it this way so that it will be better.
Next I'm going to use sudo vim etc sshdconfig and what do we
find? Well, we find the port which is currently set to 22.
I'll make that 2022 so that it takes a little bit longer before the brute force attacks are going to happen.
And then, well, I need to
restart. So sudo systemctl restart sshd.
This is the first example that actually we see where it's needed to restart the service so that it picks up the changes.
So now it should be done and we can use SS tuln
to figure out what is happening. And there we can see that
actually Port 2022 is in a listening state. That's awesome. So I
can use SSH localhost P2022 and that is making contact with localhost.
I like that as a simple test, but I would like it even more
if we also have it in a firewall. So sudo firewall cmd. That's how
you manage firewalls on Red hat. Let me use help and let me grab
all the on add port because I need a quick syntax summary.
That's what I needed.
So sudo firewall cmd add port is 2022 TCP and
permanent. Because in firewall cmd you need to write it
to the permanent configuration and also to the runtime configuration.
And a quick check sudo firewall cmd minus minus list all is
showing that port 2022 is now open and that means that my
secure shell server is remotely accessible, but on port 2022 only.