Introduction:

With the increasing dependence on technology, securing our data has become more crucial than ever before. Whether it's personal or business-related information, keeping it safe from prying eyes is of utmost importance. One effective way to achieve this is by using SSH (Secure Shell), a network protocol that allows secure remote access and control over a networked device. In this article, we will guide you through the process of installing and hardening an SSH server on Debian 12 Bookworm, ensuring the safety of your data.

Chapter 1: Introduction to SSH Server

1.1 What is SSH?

SSH or Secure Shell is a cryptographic network protocol that provides a secure channel for remote access to devices over an unsecured network. It allows you to securely log into a remote system, execute commands, and transfer files.

1.2 Why is SSH Server important?

SSH Server is essential for secure remote administration of systems, especially in environments where multiple users need access to a machine. It not only provides a secure connection but also ensures that the data remains confidential and protected from unauthorized access.

Chapter 2: Installing SSH Server

2.1 Verify Debian 12 Bookworm Installation

Before proceeding with the installation of SSH server, ensure that Debian 12 Bookworm is installed and up-to-date on your system. Use the package manager to update and upgrade your system.

2.2 Installing OpenSSH Server

OpenSSH is the most widely used implementation of the SSH protocol. To install it on Debian 12 Bookworm, open a terminal and enter the following command:

```

sudo apt install openssh-server

```

2.3 Starting and Enabling SSH Service

Once the installation is complete, start and enable the SSH service using the following command:

```

sudo systemctl start ssh

sudo systemctl enable ssh

```

Chapter 3: Securing SSH Server

3.1 Configuring SSH Server

To secure SSH server, we need to modify its configuration file. Open the SSH server configuration file `/etc/ssh/sshd_config` using a text editor:

```

sudo nano /etc/ssh/sshd_config

```

3.2 Enable Key-based Authentication

Key-based authentication provides a more secure way of logging into an SSH server. Locate the `PasswordAuthentication` setting in the configuration file and set it to `no`:

```

PasswordAuthentication no

```

3.3 Change SSH Port

Changing the default SSH port (22) adds an extra layer of security by making it harder for potential attackers to find your SSH server. Locate the `Port` setting in the configuration file and modify it to your desired port number:

```

Port 2222

```

3.4 Restrict Root Logins

Disabling direct root logins is a security best practice. Locate the `PermitRootLogin` setting in the configuration file and set it to `without-password`:

```

PermitRootLogin without-password

```

3.5 Configure SSH Idle Timeout

Setting an idle timeout ensures that SSH sessions are automatically disconnected after a period of inactivity. Locate the `ClientAliveInterval` and `ClientAliveCountMax` settings in the configuration file and modify them as follows:

```

ClientAliveInterval 300

ClientAliveCountMax 0

```

Chapter 4: Key-based Authentication

4.1 Generating SSH Key Pair

To use key-based authentication, we need to generate an SSH key pair on the client machine. Open a terminal on your local machine and enter the following command:

```

ssh-keygen -t rsa

```

4.2 Copying Public Key to SSH Server

After generating the SSH key pair, we need to copy the public key to the SSH server. Use the following command to copy the public key to the server:

```

ssh-copy-id username@server_ip_address -p ssh_port_number

```

Replace `username` with your SSH username, `server_ip_address` with the IP address of the SSH server, and `ssh_port_number` with the custom SSH port you have configured (e.g., 2222).

Chapter 5: Firewall Configuration

5.1 Configuring UFW Firewall

UFW (Uncomplicated Firewall) is the default firewall configuration tool for Debian 12 Bookworm. To allow SSH traffic, enter the following command:

```

sudo ufw allow ssh

```

5.2 Enabling UFW Firewall

Once the SSH rule is added, enable the UFW firewall with the following command:

```

sudo ufw enable

```

Chapter 6: Login Monitoring and Fail2Ban

6.1 Monitoring SSH Logins

Monitoring SSH logins is crucial to identify any unauthorized access attempts. Use the following command to monitor SSH logins in real-time:

```

sudo tail -f /var/log/auth.log | grep sshd

```

6.2 Installing and Configuring Fail2Ban

Fail2Ban is an automated security tool that protects SSH servers from brute-force attacks. Install it using the following command:

```

sudo apt install fail2ban

```

After installation, edit the Fail2Ban configuration file `/etc/fail2ban/jail.local` to specify the SSH port and enable SSH jail:

```

[sshd]

enabled = true

port = ssh_port_number

```

Replace `ssh_port_number` with the custom SSH port you have configured (e.g., 2222).

Conclusion:

Securing your data is a vital aspect of maintaining a safe and protected online environment. By following the steps outlined in this article, you can install and harden the SSH server on Debian 12 Bookworm, ensuring that your data remains confidential and inaccessible to unauthorized individuals. Remember to regularly update and maintain your server's security measures to stay one step ahead of potential threats.