Debian Enable Ssh Server

8 min read Oct 11, 2024

Setting Up a Secure SSH Server on Debian

Setting up an SSH server on your Debian machine allows you to remotely access and manage your system securely. SSH (Secure Shell) provides a secure encrypted connection for transferring files and executing commands on a remote server.

This article will guide you through the process of enabling an SSH server on your Debian system and configuring basic security measures.

Step 1: Install OpenSSH

OpenSSH is the standard SSH implementation for Debian systems. To install it, use the following command in your terminal:

sudo apt update
sudo apt install openssh-server

This command will download and install the necessary packages for the OpenSSH server.

Step 2: Start and Enable SSH Service

Once installed, you need to start the SSH service and configure it to start automatically at boot. Use these commands:

sudo systemctl start ssh
sudo systemctl enable ssh

The systemctl start ssh command starts the SSH service, and systemctl enable ssh ensures that the SSH service automatically starts every time your system boots up.

Step 3: Verify SSH Service Status

After enabling the service, verify that it is running by checking its status:

sudo systemctl status ssh

You should see a message indicating that the SSH service is active and running.

Step 4: Configure SSH Port and Firewall

By default, SSH listens on port 22. While this is a common standard, changing the default port can enhance security by making your server less discoverable.

To change the SSH port, edit the SSH configuration file:

sudo nano /etc/ssh/sshd_config

Locate the line Port 22 and change it to your desired port number. For example:

Port 2222

Save the file and restart the SSH service:

sudo systemctl restart ssh

Important: You need to configure your firewall to allow access to the new port. If you're using ufw (Uncomplicated Firewall), you can add a rule:

sudo ufw allow 2222

Replace 2222 with your chosen port number.

Step 5: Configure SSH Access

The sshd_config file also lets you configure which users can access the server and what security measures to implement. Here are a few important settings:

PasswordAuthentication: By default, SSH allows password authentication. For enhanced security, disable this option and use public key authentication instead. Set PasswordAuthentication to no.
PermitRootLogin: Disabling root login prevents direct access to the server as root, enhancing security. Set PermitRootLogin to no.
AllowUsers: You can restrict access to specific users by listing them here. For example, to allow only user john to access the server:
```
AllowUsers john
```
Public Key Authentication: To enable public key authentication, follow these steps:
1. Generate SSH Keys: Generate an SSH key pair on the client machine you'll use to connect:
```
ssh-keygen -t rsa -b 4096
```
This will create a public key (id_rsa.pub) and a private key (id_rsa).
1. Copy Public Key to Server: Copy the contents of the public key (id_rsa.pub) file to the ~/.ssh/authorized_keys file on the server. You can use ssh-copy-id for this purpose:
```
ssh-copy-id -i ~/.ssh/id_rsa.pub user@server_ip
```
Replace user with the username on the server and server_ip with the server's IP address.
1. Ensure Secure Permissions: It's crucial to set the appropriate permissions on the ~/.ssh directory and the authorized_keys file to prevent unauthorized access:
```
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
```

Remember to save the changes and restart the SSH service after editing the sshd_config file.

Step 6: Connect to Your Server

Once your SSH server is configured, you can connect to it from your client machine using an SSH client like PuTTY or the ssh command.

Using PuTTY:
1. Enter the server's IP address or hostname in the "Host Name (or IP address)" field.
2. Choose your preferred port number if you've changed it.
3. Click "Open" to establish the connection.
Using ssh command:
```
ssh user@server_ip -p port_number
```
Replace user with your username, server_ip with the server's IP address, and port_number with the port you configured.

Security Best Practices:

Use Strong Passwords: If using password authentication, ensure strong, unique passwords that are difficult to guess.
Disable Unused Services: Limit the services running on your server to only the ones you require. This reduces the attack surface.
Keep Your System Up-to-date: Regularly update your Debian system to patch vulnerabilities.
Enable Fail2ban: Fail2ban can automatically block IP addresses that attempt too many failed login attempts, protecting against brute-force attacks.
Regularly Review Security Practices: Periodically review your security configurations and adjust them as needed.

Conclusion

Setting up a secure SSH server on your Debian system is essential for remote access and management. Following these steps and implementing the security best practices will help you establish a secure connection and protect your system from unauthorized access. Remember to regularly review and update your security configurations to maintain a robust defense against potential threats.