3 Important Tweaks for Improving OpenSSH Security on Your Cloud Instance

[@danielyount9812]

Good points on SSH control. Another option is port knockd. This completely shuts down or opens a port when you ping a few ports in sequence. Also, to eliminate the hassle of copying a public key all over the place is to use -A option for forwarding, this is useful when you have a cluster of systems and centralize your access to a single jump server.

[@Brian-Anderson-uk]

The guidance given was lucid and highly informative, simplifying the process for easy comprehension. The accompanying KZbin video proved especially beneficial, offering a visual walk through of the steps. It's essential to mention, though, that there was no coverage of updating UFW (Uncomplicated Firewall), a point of significance for users with an active firewall. In general, the material was well-structured and enlightening. Thanks a lot! P.S. Your videos have been a favourite of mine for many years, and I appreciate the valuable content you consistently provide.

[@jeffherdzina6716]

Jay, Another important thing to remember if running Redhat or Centos is SElinux, is adding a non-standard port to SElinux. with commands like... semanage port -l | grep ssh_port # Which will show which ports SSH is using. semanage port -a -t ssh_port_t -p tcp (port number) # Adds a port number. semanage port -d -t ssh_port_t -p tcp (port number) # Deletes a port number. And of course firewall configurations .... Other wise a great video. Keep up the great work.

[@FunctionGermany]

i know this is an old video, but i think 31:45 would be an important timestamp to put in the description. it's basically "using a user whitelist for SSH". i think the chapters for this video got automatically generated by youtube.

[@ravindranshanmugam782]

This tutorial on ssh hardening is not just good. It's excellent !! Thank you, Jay.

[@jordanjones6131]

Im just starting out with linux and aws, this video was so heplful really appreciate it. implementing these changes into my project tonight thank you!

[@kipsangjacob270]

Awesome video on ssh hardening 🎉🎉🎉 Thanks Jay

[@Slyndc]

What if the computer you use to create the key 🔑 is no longer available for X reason? How would one log into the server?

[@Sdirimohamedsalah]

Thank you very much. clearly explained and very instructive.

[@barbarella7028]

I also install fail2ban, just to prevent those persistent brute-force attacks from clogging up my logs

[@jhhassler]

Fantastic video! 👍👍

[@mikemacdonald2094]

Much appreciated. Very thorough tutorial.

[@nkmicros540]

Nice, and + I've learned one more shortcut: "Ctrl + D" to disconnect from ssh session instead of "exit -> [Enter]" =)

[@fbifido2]

@16:50 - ssh-keygen. How does one generate an ECDSA or ED25519 key? the command you used generate an RSA key. - can i copy the private key (from ubuntu) to another linux PC (ubuntu2) to then login to server1 using the same username (jay)? -

[@Lankanbrothers]

The way you explain is easy to understand for beginer like me. thanks a lot

[@bretttaylor4262]

Jay, thank you for your video! Learned a lot.

[@mojar2680]

For people who didn't have netstat, you can see the port when > running sudo systemct status ssh

[@seihes]

I think you could also point to Lynis as a way to audit the security of a box, respectively, how you can further harden OpenSSH.

[@garygrobard4095]

Thanks as always. What would be the process to go from endpoint A to B and B to A. Can one have a single cert that allows connection to and from countless devices?

[@frederickalcantara2066]

You should also write an article about this. I think it's better for those who don't want to watch a video.

[@redhousetn73]

Nice, thanks for sharing

[@andrewpaige9152]

Great content thank you

[@WeedMIC]

U did not show how to restrict by computer name or ip by editing files in the .ssh dir

[@thetdg]

Extremely useful video, as usual.

[@BobBeatski71]

Lots of good stuff. Thanks.

[@robertchakhroobian4949]

it is very helpful video Thank you

[@LidZLife]

Jay Great Video!

[@Vhoover3609]

You could also use 2fa

[@AnzanHoshinRoshi]

Thank you, Jay.

[@ebol08]

Yet I'm still stuck at Ubuntu Server 14 at work! Let's wait for 20 LTS they say'

[@adamalexander5216]

Godsend. Thanks

[@mikehensley78]

Wait a sec....if you had 2 root ssh sessions to the same server and used one to config then restart the sshd the second root login was stale or there but not connected any longer.

[@Stormy2k3]

He restarts again at 34:15 and uses the connection in the second tab to restore the correct config. The session is still open and usable.

[@mikehensley78]

@@Stormy2k3 ive never seen an ssh connection stay connected when you are shutting down and starting the ssh server!? as a matter of fact i tried this on my VPS ubuntu 16.04 server. when you restart the sshd it kills all connections because what you're connected to has been shut off and restarted. its common sense if you think about it. i believe thats "movie magic" that he uses that connection later.

[@bytelinks937]

Mike Hensley simple answer to you is, you have failed to notice that he is using two user to do all the process. Root*2 and jay accounts. Try to replicate this instead of just watch the video you'll see that it works.

[@ambassadorofpain1]

>standard ssh-keygen Absolutely disgusting.

[@adfjasjhf]

Any recommendation for something else?

[@ambassadorofpain1]

@@adfjasjhf Yep: ssh-keygen -o -a 100 -t ed25519 -C user@host -f ~/.ssh/your-file-name Just change "user@host" to match yours if you want it and the file name.

[@Krynos18]

tcpwrappers