{"id":5032,"date":"2020-08-27T11:14:24","date_gmt":"2020-08-27T11:14:24","guid":{"rendered":"http:\/\/cloudminister.com\/?p=5032"},"modified":"2020-08-27T11:14:24","modified_gmt":"2020-08-27T11:14:24","slug":"change-ssh-port-and-implement-hardening-centos-7","status":"publish","type":"post","link":"https:\/\/cloudminister.com\/blog\/change-ssh-port-and-implement-hardening-centos-7\/","title":{"rendered":"What is SSH, how to change ssh port and implement ssh hardening on centos 7 server with CWP?"},"content":{"rendered":"

<\/h1>\n

The SSH protocol (also referred to as Secure Shell) is a method for reliable secure server<\/a> remote login from one computer to another. It provides several alternative options for strong authentication, and it protects the communications security and integrity with strong encryption.<\/span><\/p>\n

Change SSH Port<\/b><\/h2>\n

Open CWP panel in browser and login with admin account by using <\/span>https:\/\/your_domain.com:2087<\/span><\/a> (2087 for secure login).<\/span><\/p>\n

<\/p>\n

Click on services config and select SSH configuration under it.<\/span><\/p>\n

<\/p>\n

Port 22 is the default port on which SSH service listens to enhance the security\u00a0 you should change it.<\/span><\/p>\n

<\/p>\n

Now edit the configuration file by changing and uncomment port no from 22 to 2221<\/span><\/p>\n

You can use any port number that is not used with other services and click on save changes.<\/span><\/p>\n

Now restart the ssh service which is found in the dashboard.<\/span><\/p>\n

<\/p>\n

Configure CSF firewall<\/b><\/h2>\n

Changing Port for SSH is not allowed to access until you don\u2019t give the Port number inside the CSF firewall.<\/span><\/p>\n

To configure it click on security and select CSF firewall,\u00a0 then click on Firewall Configuration and replace in the entry of PORTS_sshd=\u201d22\u201d with PORTS_sshd=\u201d2221\u201d and click on save changes.<\/span><\/p>\n

<\/p>\n

<\/p>\n

\u00a0<\/span>Now restart the Firewall with the Firewall Restart button.<\/span><\/b><\/p>\n

<\/b><\/p>\n

Now test this by using ssh without port change and with the port change you will see the effect.<\/b><\/p>\n

<\/p>\n

Other SSH Hardening<\/b><\/h2>\n

1) Limit max authentication attempts<\/b><\/h3>\n

By setting a low threshold for login attempts, you can help prevent brute force attacks. Open the SSH daemon configuration file again with the command:<\/span><\/p>\n

sudo vi \/etc\/ssh\/sshd_config<\/span><\/p>\n

Look for the line:<\/span><\/p>\n

# MaxAuthTries 6<\/span><\/p>\n

Change that line to:<\/span><\/p>\n

MaxAuthTries 3<\/span><\/p>\n

Save and close the file. Restart the SSH server with the command:<\/span><\/p>\n

sudo systemctl restart sshd<\/span><\/p>\n

2) Disable empty passwords<\/b><\/h3>\n

There are some system user accounts that are created without passwords. The administrator of a Cheap Linux vps server<\/a>\u00a0 machine can also create standard users without passwords. Out of the box, SSH is configured so that it doesn’t prevent empty passwords from being allowed. Let’s fix that.\u00a0<\/span><\/p>\n

Open the SSH daemon configuration file again with the command:<\/span><\/p>\n

sudo vi \/etc\/ssh\/sshd_config<\/span><\/p>\n

Locate the line:<\/span><\/p>\n

#PermitEmptyPassword no<\/span><\/p>\n

Change that with:<\/span><\/p>\n

PermitEmptyPasswords no<\/span><\/p>\n

Save and close the file. Restart the SSH server with the command:<\/span><\/p>\n

sudo systemctl restart sshd<\/span><\/p>\n

CONCLUSION<\/b><\/h2>\n

The above configuration shows how to configure different port numbers for SSH servers and different SSH hardening.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

The SSH protocol (also referred to as Secure Shell) is a method for reliable secure server remote login from one computer to another. It provides several alternative options for strong authentication, and it protects the communications security and integrity with strong encryption. Change SSH Port Open CWP panel in browser and login with admin account…<\/p>\n","protected":false},"author":2,"featured_media":5033,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[90,235,309,159],"tags":[324,254,276,325,68,326,320],"class_list":["post-5032","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-beginner","category-centos","category-cwp-panel","category-what-is","tag-authentication","tag-configuration","tag-firewall","tag-secure","tag-server","tag-services","tag-ssh"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t