Google Plus

Howto : Add user and Secure your ssh access

Written by Mel Kham on . Posted in Linux tutorials

One of the biggest security holes you could open on your server is to allow directly logging in as root through ssh. This howto shows you how to add a new user to your server  so  that you can su or sudo to root from it .

We will begin by how to add a new user to your server,after we will show how  to disable root login and use sudo instead.

First Open your terminal, as root type the commands :

adduser  unixmen

passwd  password
After  add the  user  to the  sudo file, open up the /etc/sudoers file in your editor
vi    /etc/sudoers   or   gedit /etc/sudoers
and  add  the line of  the  user  under root line
## Allow root to run any commands anywhere
root    ALL=(ALL)       ALL
unixmen  ALL=(ALL)  ALL
For security reason we advice you  to disable the root user from logging in directly through SSH,to do that  open up the sshd_config file in your editor.
vi  /etc/ssh/sshd_config or  gedit /etc/ssh/sshd_config
#PermitRootLogin yes
Make the line look like this to disable logging in through ssh as root
PermitRootLogin no (without #)

and restart your sshd :

service  sshd  restart
Now for more security we advise you to change your ssh port from the default #port 22 to something  like 4567 or 31022. To do that, go to your sshd_config file and open it with vi or gedit :
1-First open up the sshd_config file in your editor.

vi /etc/ssh/sshd_config  or gedit /etc/ssh/sshd_config
2-In the configuration look for the line below and change #port 22 with for example port 31022

# default value.                       # default value.                             
#Port 22              chage with     port 31022 (without #)
#Protocol 2,1                           #Protocol 2,1
Protocol 2                               Protocol 2
#AddressFamily any                 #AddressFamily any
#ListenAddress 0.0.0.0            #ListenAddress 0.0.0.0
#ListenAddress ::                    #ListenAddress ::

3- Also we advice you to set the LoginGraceTime, the LoginGraceTime configures the server to disconnect the user after a set amount of time if they have not successfully logged in, to do that , always in your sshd_config file :

LoginGraceTime 20s

PermitRootLogin no
#StrictModes yes
MaxAuthTries 3

4-Now restart SSH. As root run the command:

/etc/init.d/sshd restart

Now you can run your sshd secure, and will make it hard for others to login to your server.

 

 

 

 

For questions please refer to our Q/A forum at : http://ask.unixmen.com

Mel Kham

Founder of Unixmen, Living in Amsterdam. Am working in my free time to help people to understand the Opensource and to explain them in easy way how to make the fist steps to the the light. Working day and night with my Co-founder Zinovsky to keep this website live even with less resources.
  • http://enteryoursiteURL... Prakashkumar

    simple but efficient

  • Kevin

    Greate guideline. Thanks

  • Martin

    This was really great, thank you.

Like us on Facebook

This week Top Posts

Write for us

Recent Comments

Pat L

|

I tried it and it works with a regular zip file, but if you password-protect the .zip file it does NOT work.

SK

|

Yes we can. What kind of help you need? We are doing outsourcing and technical support for Linux and Open source worldwide. To know more about the details visit here.

ClintB

|

After install as above, run shell script /opt/Citrix/ICAClient/wfica.sh manually and note lib errors still occur. I had the x64 motif loaded but had to manually install the x86 too. Got that from http://rpmfind.net/linux/rpm2html/search.php?query=libXm.so.4 Even after that, I still had to do a “yum install alsa-lib.i686 alsa-lib.x86_64″ to resolve any additional libasound.so.2 errors. Once those two lib issues were resolved, Citix Web Interface launched apps fine by telling browser to open launch.ica using /opt/Citrix/ICAClient/wfica.sh. Good luck Ernesto!

AD

|

I need some Help on Linux,can you guide me ?

Edson Carlos

|

In debian no found. I need link download install in linux debian

 
IDG Tech Network
Copyright © 2008-2013 Unixmen.com .
Maintained by Anblik .