Linux – Ultra Secure Linux Server SSH Only

iptableslinuxSecurityssh

I'm setting up a secure server for my use only to store encrypted files, but it will need to be accessed from the internet. The server itself is in a secure location with no physical access which is fine, but I'm more worried about the internet side. I'm thinking of using Ubuntu with no other software apart from open ssh.

How do I set up iptables to block all connections apart from ssh? And how do I set up open ssh to lock out any more than 2 failed attempts?

Best Answer

iptables -A INPUT -p tcp -m state --state NEW --dport 22 -m recent --name sshattack --set
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --name sshattack --rcheck --seconds 60 --hitcount 4 -j LOG --log-prefix 'SSH REJECT: '
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --name sshattack --rcheck --seconds 60 --hitcount 4 -j REJECT --reject-with tcp-reset

See, eg, my writeup on the subject for more details (including where in your firewall rules to put these, which does matter).

The other respondents' recommendations to allow only key-based ssh I thoroughly endorse, because it renders brute-force password guessing useless; but you could go even further and allow only two-factor authentication, see my writeup on the yubikey for more details on that.

Related Topic