Language Selection

English French German Italian Portuguese Spanish

SSH Security Primer: Server Security Settings

Filed under
HowTos

My previous article in this series discussed SSH client security settings. To summarize, if you can’t control installations of rogue SSH clients, your only control is to limit outbound access through firewalling or other network-layer controls. Another of my articles discusses the issues with allowing outbound SSH access to the Internet.

SSH Servers: A Basic Risk Analysis

How do you secure your SSH servers? What are the total risks of such servers to your organization? You’re well aware of the possibility of people hacking your server and getting unauthorized access. That’s bad. But there are other risks. The SANS Institute’s Top 20 risk list really stresses SSH risks. If compromised, that host can be a router/forwarder that will forward any kind of traffic to any host the p0wned box can access—even your "secured" hosts given Internet Assigned Numbers Authority (IANA) reserved IP addresses. (Read RFC 3330 and RFC 1918 for the gory details on these addresses.) In most cases, those addresses aren’t accessible over the Internet.

More of a concern is your host’s threat to the rest of the Internet.

Full Story.

More in Tux Machines

That Peculiar Linux 3.18 Kernel Bug Might Be Closed Soon

For the past month there's been kernel developers investigating "a big unknown worry in a regression" that have left many key kernel developers -- including Linus Torvalds -- puzzled. It looks like that investigation is finally being close to being resolved. Read more

New Releases

Notifications Without User Interaction on Ubuntu Are Annoying

The Unity desktop environment has a simple and rather ineffective system notification mechanism and it looks like that's not going to change, not even with the arrival of Unity 8. Read more

Librem Linux Laptop Drops NVIDIA Graphics But Still Coming Up Short Of Goal

One of the oddest things I found about the crowd-funded Librem 15 laptop when writing about it last month was that it wanted to be open-source down to the component firmware/microcode yet they opted to ship with a NVIDIA GPU. In an updated earlier this month, at least they came to their senses and dropped the discrete NVIDIA GPU. While I have no problems recommending NVIDIA graphics for Linux gamers and those wanting the best performance, that's only when using the proprietary drivers, and certainly wouldn't recommend it for a fully open-source system -- NVIDIA on the desktop side doesn't do much for the open-source drivers, let alone down to the firmware/microcode level. Instead the Librem folks have opted to upgrade the design to using an Intel Core i7 4770HQ processor that features more powerful Intel Iris Pro 5200 Graphics, which isn't as powerful as a discrete NVIDIA GPU but at least is more open-source friendly. Read more