How to secure your server: SSH, fail2ban and unneeded services

A server on the internet starts being probed within minutes of launch: bots try password after password on SSH. There is nothing to fear if you do a few things on the very first day.

1. Log in with a key and turn passwords off

This is the most important step. With passwords turned off, there is nothing to guess. For how to do it, see How to connect to your server over SSH.

If several people log in to the server, create a separate account for each: Users and sudo.

2. fail2ban — blocking anyone who guesses passwords

fail2ban watches the log and temporarily blocks addresses from which many wrong passwords have been entered.

Ubuntu: sudo apt install fail2ban. Debian: sudo apt install fail2ban nftables — fail2ban blocks addresses through nftables, which the Debian image doesn’t include. SSH protection is switched on as soon as it is installed.

AlmaLinux — from the EPEL repository. Install fail2ban-server specifically: the fail2ban package pulls in the firewalld firewall, which can lock your website out after a reboot.

sudo dnf install epel-release
sudo crb enable
sudo dnf install fail2ban-server

Create the file /etc/fail2ban/jail.local:

[DEFAULT]
banaction = nftables-multiport
banaction_allports = nftables-allports

[sshd]
enabled = true

and start it: sudo systemctl enable --now fail2ban.

To see who has been blocked: sudo fail2ban-client status sshd. If you block yourself by accident, log in through the console in your control panel and lift the block: sudo fail2ban-client set sshd unbanip 203.0.113.5.

On FreeBSD, sshguard does the same job: sudo pkg install sshguard. It works together with the pf firewall; pkg info -D sshguard explains how to hook it up.

3. A different SSH port

A different port doesn’t protect you by itself, but far fewer bots will knock on port 22 — and your log will be cleaner. Don’t close your current connection until you have checked that you can log in on the new port from another window.

Ubuntu:

echo "Port 2222" | sudo tee /etc/ssh/sshd_config.d/20-port.conf
sudo systemctl daemon-reload
sudo systemctl restart ssh.socket

Debian: the same file, then sudo systemctl restart ssh.

AlmaLinux — first allow the new port in SELinux, otherwise SSH won’t start on it:

sudo dnf install policycoreutils-python-utils
sudo semanage port -a -t ssh_port_t -p tcp 2222
echo "Port 2222" | sudo tee /etc/ssh/sshd_config.d/20-port.conf
sudo systemctl restart sshd

FreeBSD: add the line Port 2222 to /etc/ssh/sshd_config, then run sudo service sshd restart.

Check that you can log in: ssh -p 2222 ubuntu@203.0.113.10. If a firewall is enabled, open the new port in it first. And in fail2ban, add the port to the [sshd] section of /etc/fail2ban/jail.local with the line port = 2222 — otherwise it will only block offenders from the old port.

4. Firewall

Leave only the ports you need open: SSH, plus 80 and 443 if the server hosts a website. How to do this on your system: Ubuntu, Debian, AlmaLinux, FreeBSD.

For every method, including nftables and iptables, and what to do if a port won’t open, see How to open a port on your server.

5. Unneeded services

See which programs are waiting for connections from the internet: sudo ss -ltnp. The addresses 127.0.0.1 and [::1] are reachable only from inside the server, which is fine. 0.0.0.0 and * are open to everyone.

• A database should listen only on 127.0.0.1 unless other servers connect to it. If you need access from your computer, use an SSH tunnel rather than an open port.
• Turn off any service you don’t need: sudo systemctl disable --now name.
• Don’t reveal program versions: in nginx, use server_tokens off;; in Apache, use ServerTokens Prod and ServerSignature Off.

6. Updates

Most break-ins come through outdated software. For how to update the system and turn on automatic security updates, see the guide for your system: Ubuntu, Debian, AlmaLinux, FreeBSD.