Securing OpenSSH: Filter Host To Limit Access

One technique to secure OpenSSH is to filter hosts that are allowed to access your server through SSH. This technique will prevent brute force attacks on OpenSSH. To filter hosts that are allowed to connect on port 22 (SSH port), we can use a firewall. You can use either ConfigServer Security & Firewall or denyhosts. Both are free to use. To use CSF you may need cPanel for easy configuration. So let’s choose denyhosts instead.

DenyHosts is a script intended to be run by Linux system administrators to help thwart SSH server attacks (also known as dictionary based attacks and brute force attacks).

To install denyhosts on Ubuntu server to secure OpenSSH is easy, since it is available in the Ubuntu repository:

sudo apt-get install denyhosts

After installation you can tweak the denyhosts configuration under /etc/denyhosts.conf

#if you want to receive email for new blocked host
ADMIN_EMAIL = [email protected]

Now we need to edit our /etc/hosts.allow to make sure our hosts won’t be blocked:

vim /etc/hosts.allow
#insert
sshd: 192.168.1.0/255.255.255.0
sshd: 192.168.10.5/25

Save and restart the denyhosts service:

/etc/init.d/denyhosts restart

This is just a prevention technique for securing OpenSSH connections by filtering host access. It is not enough to fully secure your SSH line but it is enough to start with. There is still more work to do to secure OpenSSH. I will write more, so stay tuned.