YunoHost/doc
1
0
Fork 0
mirror of https://github.com/YunoHost/doc.git synced 2024-09-03 20:06:26 +02:00
Code Issues Projects Releases Packages Wiki Activity

Update security.md to use ssh port setting

Browse source
This commit is contained in:
tituspijean 2021-05-21 10:58:30 +02:00 • committed by GitHub
parent 04be45f0ba
commit 9c9f3dfffd
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 49 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

51
pages/01.administrate/06.overview/12.security/security.md
View file

@ -57,57 +57,10 @@ systemctl restart ssh
### Modify the SSH port
To prevent SSH connection attempts by robots that scan the Internet for any server with SSH enabled, you can change the SSH port.
**On your server**, edit the ssh configuration file, in order to modify the SSH port.
This is handled by a system setting, which takes care of updating the SSH and Fail2Ban configuration.
```bash
nano /etc/ssh/sshd_config
```
**Search the line "Port" and replace** port number (by default 22) by another unused number
```bash
# What ports, IPs and protocols we listen for
Port 22 # to replace by 9777 for example
```
**Open the port** in the firewall (you can use `-6` option to deny ipv4 connection)
```bash
yunohost firewall allow TCP 9777
```
Save and restart the SSH daemon. Switch over to the new port by restarting SSH.
```bash
systemctl restart ssh
```
Then restart the iptables firewall and close the old port in iptables.
```bash
yunohost firewall reload
yunohost firewall disallow TCP <your_old_ssh_port_number> # port by default 22
```
You also need to give `fail2ban` the new SSH port.
To do that you need to create the configuration file `my_ssh_port.conf` with the command
```bash
nano /etc/fail2ban/jail.d/my_ssh_port.conf
```
and you can then fill it in with
```ini
[sshd]
port = <your_ssh_port>
[sshd-ddos]
port = <your_ssh_port>
```
Finally you have to restart `fail2ban` in order to apply the new configuration
```bash
systemctl restart fail2ban
sudo yunohost settings set security.ssh.port -p <new_ssh_port_number>
```
**For the next SSH connections **, you need to add the `-p` option followed by the SSH port number.