Hack Forums
[The Academy] Harden SSH & Secure Remote Access (Linux) - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [The Academy] Harden SSH & Secure Remote Access (Linux) (/showthread.php?tid=6310214)

Harden SSH & Secure Remote Access (Linux) - Vectura - Oct 5, 2025

Harden SSH & Secure Remote Access (Linux)


Introduction:
This practical, legal tutorial shows how to harden SSH on Linux servers: key-based auth, fail2ban, firewalls, user restrictions and basic 2FA. Test everything in your own lab VMs.

Prerequisites:
  • A Linux server/VM (Ubuntu/Debian/CentOS)

  • A separate client machine to SSH from

  • Basic shell knowledge



Steps (do this in your lab):
  1. Create recovery admin user — make sure you have local/console access before locking SSH.


  2. Generate an SSH key on client and copy it to server
    Code
    # on client
    ssh-keygen -t ed25519 -C "[email protected]"
    ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server


  3. Edit SSH server config — open /etc/ssh/sshd_config and set:
    Code
    PermitRootLogin no
    PasswordAuthentication no
    PubkeyAuthentication yes
    AllowUsers youruser
    ChallengeResponseAuthentication no
    UsePAM yes
    Reload SSH:
    Code
    sudo systemctl reload sshd


  4. Install and configure fail2ban to block brute-force:
    Code
    sudo apt update && sudo apt install -y fail2ban
    # minimal /etc/fail2ban/jail.d/local.conf
    [sshd]
    enabled = true
    maxretry = 5
    bantime = 3600


  5. Limit source IPs with firewall (optional)
    Code
    sudo ufw allow from 203.0.113.0/24 to any port 22 proto tcp
    sudo ufw enable


  6. Optional: Add 2FA for SSH (Google Authenticator PAM) — test thoroughly in lab before deploying.



Lab exercises:
  • Attempt a wrong password 6 times from attacker VM and verify fail2ban blocks it.

  • Verify only key-based login works and password login is rejected.



Notes: Always keep a recovery console and do not lock yourself out. Do this only on machines you own or are permitted to manage.


RE: Harden SSH & Secure Remote Access (Linux) - purplerain84 - Oct 9, 2025

Hit me up for ssh/rdp access pm