Hardening SSH security on a Debian 9 server

Question

I am running the following version of GNU/Linux Debian:

cat /etc/issue 

says:

Debian GNU/Linux 9 

Using the following kernel:

uname -r 

says:

4.9.0-2-amd64 

And running the following version of OpenSSH:

apt-cache policy openssh-server | grep Installed 

says:

Installed: 1:7.4p1-7 

---

My intention is to harden a little one server's SSH security, since I need to have access from any IP, even from any VPN.

These steps I have done so far:

1. Disabling direct root access:

   cat /etc/ssh/sshd_config | grep PermitRootLogin 

   is set to:

   PermitRootLogin no 

2. Enforcing SSH protocol version 2:

   cat /etc/ssh/sshd_config | grep Protocol 

   is set to:

   Protocol 2 

3. Changed port to a random one, which I will not write here, so say 12345:

   cat /etc/ssh/sshd_config | grep Port 

   is set to:

   Port 12345 

4. I have punched hole in firewall for it:

   sudo iptables -A INPUT -p tcp -m tcp --dport 12345 -m comment --comment "ssh" -j ACCEPT 

5. I have generated a new key of 8 kilobits length (I am aware of the CPU overhead and other disadvantages of such a large key):

   ssh-keygen -t rsa -b 8192 

6. I have then verified the size matches:

   ll /home/fictional_user/.ssh/id_rsa* 

   is as it should be, as well as the access rights:

   -rw------- 1 fictional_user fictional_group 6.3K Mar 16 11:53 /home/fictional_user/.ssh/id_rsa -rw-r--r-- 1 fictional_user fictional_group 1.4K Mar 16 11:53 /home/fictional_user/.ssh/id_rsa.pub 

7. I have added this key and verified there is no other:

   eval $(ssh-agent -s) ssh-add ssh-add -l 

   results in:

   8192 SHA256:gibberish /home/fictional_user/.ssh/id_rsa (RSA) 8192 SHA256:gibberish fictional_user@fictional_computer (RSA) 

8. I have imported the key to two machines, which will be maintaining the server:

   ssh-copy-id fictional_user@public_ip -p 12345 

9. Afterwards, I have disabled password authentication completely:

   cat /etc/ssh/sshd_config | grep PasswordAuthentication 

   is set to:

   PasswordAuthentication no 

Question: Did I forget on anything or this is maximum I can do?

Answer 1

There are a number of things you can do:

• Set up a private key that uses a key-stretching algorithm to protect brute-forcing the passphrase.
• Configure AllowUsers in sshd so only named accounts can gain access
• Use fail2ban or fwknop to further prevent outside attacks (remember that CVE-2008-0166 caused Debian users to generate only one of 32,767 possible keys)
• Actively monitor your machine for attacks

Answer 2

Just a few thoughts:

• sshd supports tcpwrappers, this adds protection when your firewall is down.
• does your file system support attributes on those public keys? Rather make them as read-only as possible.
• consider ssh-keysigning to limit the time keys are usable.