OpenSSH Installation

Update the package index and install the OpenSSH server daemon:

sudo apt-get update && sudo apt-get upgrade -y
sudo apt-get install -y openssh-server

Verify the installed version:

ssh -V

Security Hardening for SSH

While default settings are generally secure, customizing /etc/ssh/sshd_config can further protect the system.

Modifying the Default Port

Open the configuration file with a text editor:

sudo nano /etc/ssh/sshd_config

Locate the Port directive, uncomment it, and assign a non-standard port, for instance, 9222:

Port 9222

Apply the changes by restarting the daemon:

sudo systemctl restart sshd

Limiting Authentication Attempts

To mitigate brute-force attacks, define the maximum login attempts within the same configuration file by adjusting MaxAuthTries:

MaxAuthTries 4

Save the file and restart the service again.

Disabling Root Login

Prevent direct root access over SSH to minimize attack surfaces. Find and set the PermitRootLogin parameter:

PermitRootLogin no

After saving, reload the SSH daemon configuration:

sudo systemctl reload sshd

Firewall Configuration with UFW

Adjust the Uncomplicated Firewall (UFW) to permit traffic on the newly assigned port before activating it. Failing to do so will lock out remote access.

sudo ufw allow 9222/tcp
sudo ufw enable

Confirm the active rules:

sudo ufw status verbose

Establishing Remote Connections

Connect to the server from a client machine using the OpenSSH client. Specify the custom port, username, and IP address:

ssh -p 9222 admin@10.0.0.50

During the initial connection, accept the host fingerprint by typing yes, then provide the user's password.

Troubleshooting SSH Connectivity

If remote access fails, perform the following diagnostic checks:

1. Daemon Status: Ensure the SSH service is active.
   

   sudo systemctl status sshd

   If inactive, start it:
   

   sudo systemctl start sshd

2. Configuration Syntax: Detect syntax errors in the configuration file.
   

   sudo sshd -t

3. Firewall Rules: Verify that UFW permits the custom port.
   

   sudo ufw status

4. System Logs: Inspect authentication logs for rejected attempts or errors.
   

   sudo tail -n 50 /var/log/auth.log

5. Network Reachability: Confirm basic network connectivity to the server.
   

   ping -c 4 10.0.0.50