|
This time we will see a short and simple tip that will help us improve security, of our remote connections with SSH. |
OpenSSH, which is the package provided by GNU / Linux systems to handle SSH connections, has a wide variety of options. Reading the book SSH The Secure Shell and the manual pages I found the -F option, which tells the SSH client to use a different configuration file than the one found by default in the / etc / ssh directory.
How do we use this option?
As follows:
ssh -F / path / to_your / configuration / file user @ ip / host
For example, if we have a custom configuration file named my_config on the Desktop, and we want to connect with the user Carlos to the computer with the IP 192.168.1.258, then we would use the command as follows:
ssh -F ~/Desktop/my_config ppgad@pucrs.br
How does it help the security of the connection?
Remember that an attacker, being inside our system, will immediately try to obtain administrator privileges if he does not already have them, so it would be quite easy for him to execute ssh to connect to the rest of the machines on the network. To avoid this, we can configure the / etc / ssh / ssh_config file with incorrect values, and when we want to connect via SSH we will use the configuration file that we will have saved in a location that only we know (even on an external storage device), that is say, we would have security by darkness. In this way the attacker would be puzzled to find that he cannot connect using SSH and that he tries to make the connections according to what is specified in the default configuration file, so it will be somewhat difficult for him to realize what is happening, and we will complicate him a lot. the job.
This, along with changing the SSH server's listening port, disabling SSH1, specifying which users can connect to the server, explicitly allowing which IP address or IP range can connect to the server, and other tips that can be found at http://www.techtear.com/2007/04/08/trucos-y-consejos-para-asegurar-ssh-en-linux , will allow us to increase the security of our SSH connections.
Everything described above can be done in one line. For my taste it would be quite tedious to have to write a large line with multiple options every time we try to log in via SSH to a remote PC, for example the following would be a sample of what I am saying:
ssh -p 1056 -c blowfish -C -l carlos -q -i myself 192.168.1.258
-p Specifies the port to connect to on the remote host.
-c Specifies how the session is to be encrypted.
-C Indicates that the session should be compressed.
-l Indicates the user that will be logged in to the remote host.
-q Indicates that diagnostic messages are suppressed.
-i Indicates the file to be identified with (private key)
We must also remember that we could use the terminal history so that we do not have to type the entire command every time we need it, something that an attacker could also take advantage of, so I would not recommend it, at least when using SSH connections.
Although the security issue is not the only advantage of this option, I can think of others, such as having a configuration file for each server we want to connect to, so we will avoid writing the options every time we want to make a connection to a server SSH with a specific configuration.
Using the -F option can be very useful in case you have several servers with different configuration. Otherwise, all the settings will have to be remembered, which is practically impossible. The solution would be to have a configuration file perfectly prepared according to the requirements of each server, facilitating and ensuring access to those servers.
You can find instructions on how to edit the SSH client configuration file at this link http://www.openbsd.org/cgi-bin/man.cgi?query=ssh_config .
Remember, this is just one more tip of the hundreds that we can find to ensure SSH, so if you want to have secure remote connections, you must combine among the possibilities that OpenSSH offers us.
That's all for now, I hope this information will be of some use to you and wait for another post about SSH security next week.
Interested in make a contribution?