mirror of
https://github.com/YunoHost/doc.git
synced 2024-09-03 20:06:26 +02:00
Update security.md to use ssh port setting (#1683)
* Update security.md to use ssh port setting * Update security.md to use ssh port setting [FR] * Fix typos and missing translation in security.fr.md * Typo in security.md * Typo² in security.md
This commit is contained in:
tituspijean
GitHub
parent
04be45f0ba
commit
f45a9fd225
2 changed files with 8 additions and 102 deletions
|
|
@ -66,62 +66,15 @@ systemctl restart ssh
|
||||||
### Modifier le port SSH
|
### Modifier le port SSH
|
||||||
|
|
||||||
Pour éviter des tentatives de connexion SSH par des robots qui scannent tout Internet pour tenter des connexions SSH avec tout serveur accessible, on peut modifier le port SSH.
|
Pour éviter des tentatives de connexion SSH par des robots qui scannent tout Internet pour tenter des connexions SSH avec tout serveur accessible, on peut modifier le port SSH.
|
||||||
|
C'est géré par un paramètre système, qui se charge de configurer les services SSH et Fail2Ban.
|
||||||
**Sur votre serveur**, éditez le fichier de configuration SSH, pour modifier le port SSH.
|
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
nano /etc/ssh/sshd_config
|
sudo yunohost settings set security.ssh.port -v <votre_numero_de_port_ssh>
|
||||||
```
|
```
|
||||||
|
|
||||||
**Recherchez la ligne « Port »** et remplacez le numéro du port (par défaut 22) par un autre numéro non utilisé
|
**Lors de la prochaine connexion SSH**, vous devrez ajouter le paramètre `-p` suivi du port SSH.
|
||||||
|
|
||||||
```bash
|
**Exemple**:
|
||||||
Port 22 # à remplacer par exemple par 9777
|
|
||||||
```
|
|
||||||
|
|
||||||
**Ouvrez le port** choisi dans le parefeu (vous pouvez utiliser l'option `-6` pour interdire la connexion via ipv4)
|
|
||||||
|
|
||||||
```bash
|
|
||||||
yunohost firewall allow TCP <votre_numero_de_port_ssh>
|
|
||||||
```
|
|
||||||
|
|
||||||
Sauvegardez et relancez le démon SSH.
|
|
||||||
|
|
||||||
```bash
|
|
||||||
systemctl restart ssh
|
|
||||||
```
|
|
||||||
|
|
||||||
Ensuite redémarrez le firewall iptables et fermez l’ancien port dans iptables.
|
|
||||||
|
|
||||||
```bash
|
|
||||||
yunohost firewall reload
|
|
||||||
yunohost firewall disallow TCP <votre numéro de port> # port par défaut 22
|
|
||||||
```
|
|
||||||
|
|
||||||
Il convient également de donner à `fail2ban` le nouveau port SSH à bloquer en cas de bannissement d'une adresse IP.
|
|
||||||
|
|
||||||
Pour cela il suffit de créer le fichier de configuration `my_ssh_port.conf` avec
|
|
||||||
|
|
||||||
```bash
|
|
||||||
nano /etc/fail2ban/jail.d/my_ssh_port.conf
|
|
||||||
```
|
|
||||||
|
|
||||||
et de le compléter ainsi :
|
|
||||||
|
|
||||||
```ini
|
|
||||||
[sshd]
|
|
||||||
port = <votre_numero_de_port_ssh>
|
|
||||||
```
|
|
||||||
|
|
||||||
Il reste enfin à relancer `fail2ban` pour prendre en compte la nouvelle configuration
|
|
||||||
|
|
||||||
```bash
|
|
||||||
systemctl restart fail2ban
|
|
||||||
```
|
|
||||||
|
|
||||||
**Pour les prochaines connexions SSH**, il faudra ajouter l’option `-p` suivie du numéro de port SSH.
|
|
||||||
|
|
||||||
**Exemple** :
|
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
ssh -p <votre_numero_de_port_ssh> admin@<votre_serveur_yunohost>
|
ssh -p <votre_numero_de_port_ssh> admin@<votre_serveur_yunohost>
|
||||||
|
|
|
||||||
|
|
@ -57,60 +57,13 @@ systemctl restart ssh
|
||||||
### Modify the SSH port
|
### Modify the SSH port
|
||||||
|
|
||||||
To prevent SSH connection attempts by robots that scan the Internet for any server with SSH enabled, you can change the SSH port.
|
To prevent SSH connection attempts by robots that scan the Internet for any server with SSH enabled, you can change the SSH port.
|
||||||
|
This is handled by a system setting, which takes care of updating the SSH and Fail2Ban configuration.
|
||||||
**On your server**, edit the ssh configuration file, in order to modify the SSH port.
|
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
nano /etc/ssh/sshd_config
|
sudo yunohost settings set security.ssh.port -v <new_ssh_port_number>
|
||||||
```
|
|
||||||
**Search the line "Port" and replace** port number (by default 22) by another unused number
|
|
||||||
```bash
|
|
||||||
# What ports, IPs and protocols we listen for
|
|
||||||
Port 22 # to replace by 9777 for example
|
|
||||||
```
|
```
|
||||||
|
|
||||||
**Open the port** in the firewall (you can use `-6` option to deny ipv4 connection)
|
**For the next SSH connections**, you need to add the `-p` option followed by the SSH port number.
|
||||||
```bash
|
|
||||||
yunohost firewall allow TCP 9777
|
|
||||||
```
|
|
||||||
|
|
||||||
Save and restart the SSH daemon. Switch over to the new port by restarting SSH.
|
|
||||||
```bash
|
|
||||||
systemctl restart ssh
|
|
||||||
```
|
|
||||||
Then restart the iptables firewall and close the old port in iptables.
|
|
||||||
|
|
||||||
```bash
|
|
||||||
yunohost firewall reload
|
|
||||||
yunohost firewall disallow TCP <your_old_ssh_port_number> # port by default 22
|
|
||||||
```
|
|
||||||
|
|
||||||
You also need to give `fail2ban` the new SSH port.
|
|
||||||
|
|
||||||
To do that you need to create the configuration file `my_ssh_port.conf` with the command
|
|
||||||
|
|
||||||
|
|
||||||
```bash
|
|
||||||
nano /etc/fail2ban/jail.d/my_ssh_port.conf
|
|
||||||
```
|
|
||||||
|
|
||||||
and you can then fill it in with
|
|
||||||
|
|
||||||
```ini
|
|
||||||
[sshd]
|
|
||||||
port = <your_ssh_port>
|
|
||||||
|
|
||||||
[sshd-ddos]
|
|
||||||
port = <your_ssh_port>
|
|
||||||
```
|
|
||||||
|
|
||||||
Finally you have to restart `fail2ban` in order to apply the new configuration
|
|
||||||
|
|
||||||
```bash
|
|
||||||
systemctl restart fail2ban
|
|
||||||
```
|
|
||||||
|
|
||||||
**For the next SSH connections **, you need to add the `-p` option followed by the SSH port number.
|
|
||||||
|
|
||||||
**Sample**:
|
**Sample**:
|
||||||
|
|
||||||
|
|
|
||||||
Loading…
Add table
Reference in a new issue