← Back to writing
Engineering notes

SSH basics and Fail2Ban

A simple guide to ssh and fail2ban for beginners.

ssh (Secure Shell) is a cryptographic network protocol that lets you safely log into and control remote computers over an unsecured network.

To create a connect between host and target, from the host run:

ssh <target-user>@<target-ip>

For example:

ssh sam@192.168.219.130

Prerequisites:

  • The target must have an SSH server running and open for remote connections.
  • The host must have ssh installed to create connections with the target.

Installation & Setup

To install SSH server on a Linux machine follow the following steps:

  1. Update the packages:
sudo apt update
  1. Install the openssh server:
sudo apt install openssh-server -y
  1. Enable the ssh server:
sudo systemctl enable ssh
  1. Check the status:
sudo systemctl status ssh

if you want ssh server to auto-start on boot, use the following command:

sudo systemctl enable --now ssh

Configuration

Now there are three things you should configure out of the many ssh has to offer.

  1. SSH Key-Pair: These are the cryptographic keys that one can configure between the host and the target to make sure only the trusted communication can happen.
  2. Alias: An alias can help reduce the ssh command length which helps reduce the boiler-plate and keeps the secrets abstracted.
  3. Jail: A jail is used to protect the host from brute-force attacks by banning the malicious IP.

1. SSH Key-Pair

ssh-keygen is a standard command-line utility used to generate, manage, and convert cryptographic key pairs for SSH (Secure Shell) authentication.

  1. To create a ssh key-pair (private & public), use the following command.
ssh-keygen -f path/to/file

Note: always use distinct key-file name.

  1. Next the tool will ask for a passphrase (a password) [it is recommended to have one].
  2. Again, it will ask the same to verify.
  3. At this point, you shall have 2 files at the location you chose.
    1. key-name: Your private key, which you will use from the host to sign the connection.
    2. key-name.pub: Your public key, that shall be hosted on any target you wish to connect.

Note: There are many algorithms (ed family, rsa, etc.) to sign the key, by default ssh-keygen used ed25519.

Once this is done, you need to copy the public key to the target host.

ssh-copy-id is a command-line script used to replicate your local SSH public key to a remote server’s authorized_keys file.

To copy the public ssh-key on the target host, use the following command:

ssh-copy-id -i path/to/key.pub <target-user>@<target-ip>

For example:

ssh-copy-id -i ~/.ssh/key-name.pub sam@192.168.210.110

This will copy the public ssh-key to the target host’s authorised_keys and thus one can now connect to the target using the ssh command.

2. Alias

An alias can help reduce the ssh command length which helps reduce the boiler-plate and keeps the secrets abstracted.

  1. To Create an alias one needs to add an entry in the config file which can be found under the ~/.ssh/ dir.
  2. Use any shell editor such as nano or vim to edit the config file:
nano ~/.ssh/config
  1. Now, this requires few mandatory parameters and many optional ones:
    1. Host: The alias to be used (Required)
    2. HostName: The IP address of the target (Required)
    3. User: The user of the target (Required)
    4. IdentityFile: The location to the ssh private key.
    5. IndentitiesOnly: If set as yes the connection will not fallback to any other authentication method in case of failures, such as passphrase, passkey, etc. Sample:
Host test
	HostName 192.168.210.110
	User sam
	IndentityFile ~/.ssh/id_25519_test
	IdentitiesOnly yes

Now, you can use the follow command to ssh the target:

ssh test

See, how simple it became? That’s an alias in ssh.

3. Jail

Fail2Ban is a free software tool that protects Linux servers from brute-force attacks by monitoring log files and blocking malicious IP addresses.

It generally comes pre-installed with many linux distro, in case it is not there you can download it using the following command:

sudo apt update
sudo apt install fail2ban

Configuration

Once installed, move to /etc/fail2ban, this is where the installed tool will reside by default, unless chosen otherwise.

Here, peek through the jail.conf file, this is the default configuration file generated by the tool that controls:

  • What to ban?
  • When to ban?
  • How to ban?

It is recommended that you do not modify this file, instead you can override this file with a local version of it. To create the file, use the below command:

nano jail.local

Now, you are ready to override the default file. In our case we will be creating a jail for ssh. You can take reference from the jail.conf file to understand the keywords and syntax.

Sample:

[sshd]
maxretry=3
bantime=1m

Save it and reload the fail2ban client using:

fail2ban-client reload

This will create a jail for ssh requests, if 3 successive connection attemp fails from a source, the host shall ban the source ip for 1 minute.

You can check the status using the following command:

fail2ban-client status

Troubleshoot

In case you got yourself jailed for long, use the following command on the host to unban the source ip:

fail2ban-client set sshd unbanip <source-ip>