Secure Shell (SSH)

What is SSH?

SSH is a cryptographic network protocol used to securely connect to and communicate with remote computers over an unsecured network.

What it does:

• Provides encrypted, authenticated communication between two systems
• Replaces older, insecure protocols like Telnet, rlogin, and rsh
• Operates on port 22 by default

Why Telnet is insecure?

Telnet is insecure for one fundamental reason: everything is transmitted as plain text — no encryption, no integrity checking.

The main core problems:

1. No encryption All data — including your username, password, and every command you type travels over the network in raw, readable bytes. Anyone with network access between you and the server can read it directly.

2. Susceptible to packet sniffing Tools like Wireshark or tcpdump can trivially capture Telnet traffic. An attacker on the same network (or any hop in between) can read your session in real time credentials and all.

Common real-world use cases:

SSH goes far beyond just “logging into a server” it’s a Swiss Army knife for secure infrastructure work. It is mainly used for:

1. Remote Server Management

The most obvious use — administering servers without physical access.

2. Secure File Transfer

SSH underpins several file transfer tools.

Why attackers love misconfigured SSH?

SSH is secure by design, but insecure by misconfiguration.

Misconfigured SSH is one of the most exploited attack surfaces in the real world it’s low-hanging fruit that attackers actively scan for 24/7.

1. Root Login Enabled (PermitRootLogin yes)

The single most dangerous misconfiguration.

• Attackers brute-force root directly — no need to escalate privileges after getting in
• A successful login gives immediate full control of the machine
• Default on many older distros and cloud images

2. Password Authentication Enabled

Passwords are brute-forceable. Attackers run automated tools like Hydra, Medusa, or Patator with massive wordlists.

3. Default Port 22 Exposed to the Internet

Port 22 is the first thing automated scanners check. Tools like Shodan, Masscan, and ZMap can scan the entire IPv4 internet in under an hour.

• The moment a server gets a public IP, bots find it — often within minutes
• Thousands of brute-force attempts per day are normal on any exposed port 22
• Doesn’t mean changing the port makes you secure — just reduces noise

4. No Fail2Ban or Rate Limiting

Without brute-force protection, attackers can attempt unlimited logins:

• A single machine can try thousands of passwords per minute
• Botnets distribute attempts across thousands of IPs to avoid IP-based blocking
• Without lockout mechanisms, brute force is just a matter of time

Live demo: SSH login

Example:

Identifiers:

Ubuntu: 192.168.74.137

Mac: 192.168.1.6

Objective: SSH to Ubuntu using Mac Base OS ensuring security and best practice

Make sure both the systems are on common network and connected

1. Ubuntu to mac base OS

• Mac base OS to ubuntu

Both systems can ping/connect each other. I am using VMWare Fusion so best configuration is to set Network Adapter as Bridged so that both the systems are on same network.

Create a user in ubuntu

Let’s go ahead and give this user a SSH access

Switch to root user using command “sudo -s” and navigate to /etc/ssh

Open file sshd_config, check if AllowUsers command is present or not. If not, append the command at last of the file.

Save it

And restart the ssh daemon service using below commands

systemctl daemon-reload

systemctl restart sshd

Now let’s try to connect to John using ssh via Mac OS:

Key takeaways:

SSH is secure by design, but insecure by misconfiguration.

Authentication using certificates:

Step 1: Create a SSH key pair using Mac by below command

Ssh-keygen -t rsa -b 4096 -C tester@192.168.74.137

Upload the public key to ubuntu server

Ssh-copy-id tester@192.168.74.137

Open sshd_config file using below command and set or add below configurations:

sudo nano /etc/ssh/sshd_config

PubkeyAuthentication yes

AuthorizedKeysFile .ssh/authorized_keys

Restart ssh

Sudo systemctl daemon.reload

Sudo systemctl restart sshd

Disable password login

Open sshd_config file and uncomment the below mentioned commands by removing #:

PasswordAuthentication no

Restart ssh

Sudo systemctl daemon.reload

Sudo systemctl restart sshd

Changing default port (pros & cons)

Open sshd_config file and uncomment the below mentioned commands by removing #:

Port 2222

Restart ssh

Sudo systemctl daemon.reload

Sudo systemctl restart sshd

Checking access

Login banners

Create a file, for example “banner.txt” in /etc/ssh and enter details.

Open sshd_config file and uncomment the below mentioned commands by removing # and add path to banner file:

Banner /etc/ssh/banner.txt

Restart ssh

Sudo systemctl daemon.reload

Sudo systemctl restart sshd

Idle timeouts

Open sshd_config file and uncomment the below mentioned commands by removing #:

ClientAliveInterval 300

Restart ssh

Sudo systemctl daemon.reload

Sudo systemctl restart sshd

Max auth attempts

Open sshd_config file and uncomment the below mentioned commands by removing #:

MaxAuthTries 3

Restart ssh

Sudo systemctl daemon.reload

Sudo systemctl restart sshd