YunoHost/doc
1
0
Fork 0
mirror of https://github.com/YunoHost/doc.git synced 2024-09-03 20:06:26 +02:00
Code Issues Projects Releases Packages Wiki Activity

Update security.md to use ssh port setting (#1683)

Browse source 
* Update security.md to use ssh port setting

* Update security.md to use ssh port setting [FR]

* Fix typos and missing translation in security.fr.md

* Typo in security.md

* Typo² in security.md
This commit is contained in:
tituspijean 2021-05-21 19:47:53 +02:00 committed by GitHub
parent 04be45f0ba
commit f45a9fd225
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 8 additions and 102 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

57
pages/01.administrate/06.overview/12.security/security.fr.md
View file

@ -66,66 +66,19 @@ systemctl restart ssh
### Modifier le port SSH
Pour éviter des tentatives de connexion SSH par des robots qui scannent tout Internet pour tenter des connexions SSH avec tout serveur accessible, on peut modifier le port SSH.
**Sur votre serveur**, éditez le fichier de configuration SSH, pour modifier le port SSH.
C'est géré par un paramètre système, qui se charge de configurer les services SSH et Fail2Ban.
```bash
nano /etc/ssh/sshd_config
sudo yunohost settings set security.ssh.port -v <votre_numero_de_port_ssh>
```
**Recherchez la ligne « Port »** et remplacez le numéro du port (par défaut 22) par un autre numéro non utilisé
**Lors de la prochaine connexion SSH**, vous devrez ajouter le paramètre `-p` suivi du port SSH.
```bash
Port 22 # à remplacer par exemple par 9777
```
**Ouvrez le port** choisi dans le parefeu (vous pouvez utiliser l'option `-6` pour interdire la connexion via ipv4)
```bash
yunohost firewall allow TCP <votre_numero_de_port_ssh>
```
Sauvegardez et relancez le démon SSH.
```bash
systemctl restart ssh
```
Ensuite redémarrez le firewall iptables et fermez l’ancien port dans iptables.
```bash
yunohost firewall reload
yunohost firewall disallow TCP <votre numéro de port> # port par défaut 22
```
Il convient également de donner à `fail2ban` le nouveau port SSH à bloquer en cas de bannissement d'une adresse IP.
Pour cela il suffit de créer le fichier de configuration `my_ssh_port.conf` avec
```bash
nano /etc/fail2ban/jail.d/my_ssh_port.conf
```
et de le compléter ainsi :
```ini
[sshd]
port = <votre_numero_de_port_ssh>
```
Il reste enfin à relancer `fail2ban` pour prendre en compte la nouvelle configuration
```bash
systemctl restart fail2ban
```
**Pour les prochaines connexions SSH**, il faudra ajouter l’option `-p` suivie du numéro de port SSH.
**Exemple** :
**Exemple**:
```bash
ssh -p <votre_numero_de_port_ssh> admin@<votre_serveur_yunohost>
```
```
---

53
pages/01.administrate/06.overview/12.security/security.md
View file

@ -57,60 +57,13 @@ systemctl restart ssh
### Modify the SSH port
To prevent SSH connection attempts by robots that scan the Internet for any server with SSH enabled, you can change the SSH port.
**On your server**, edit the ssh configuration file, in order to modify the SSH port.
This is handled by a system setting, which takes care of updating the SSH and Fail2Ban configuration.
```bash
nano /etc/ssh/sshd_config
```
**Search the line "Port" and replace** port number (by default 22) by another unused number
```bash
# What ports, IPs and protocols we listen for
Port 22 # to replace by 9777 for example
sudo yunohost settings set security.ssh.port -v <new_ssh_port_number>
```
**Open the port** in the firewall (you can use `-6` option to deny ipv4 connection)
```bash
yunohost firewall allow TCP 9777
```
Save and restart the SSH daemon. Switch over to the new port by restarting SSH.
```bash
systemctl restart ssh
```
Then restart the iptables firewall and close the old port in iptables.
```bash
yunohost firewall reload
yunohost firewall disallow TCP <your_old_ssh_port_number> # port by default 22
```
You also need to give `fail2ban` the new SSH port.
To do that you need to create the configuration file `my_ssh_port.conf` with the command
```bash
nano /etc/fail2ban/jail.d/my_ssh_port.conf
```
and you can then fill it in with
```ini
[sshd]
port = <your_ssh_port>
[sshd-ddos]
port = <your_ssh_port>
```
Finally you have to restart `fail2ban` in order to apply the new configuration
```bash
systemctl restart fail2ban
```
**For the next SSH connections **, you need to add the `-p` option followed by the SSH port number.
**For the next SSH connections**, you need to add the `-p` option followed by the SSH port number.
**Sample**: