SSH (Secure Shell) is the default way to access a remote Linux server. This post will cover securing server access by disabling direct access to the root user and using public/private keys instead of passwords for login.
A new Linux server, ubuntu in this example, only contains a root user. The root user is very important and allows unrestricted access to the entire system. Since the root user is unrestricted it isn't a good idea to allow people to directly login to the system as root. One or more users should be created so their access can be tailored to the individual's/group's specific requirements. If a malicious agent gains access to the system they will be restricted to the rights of the user they were able to penetrate with. Granting a user full sudo permissions isn't as big of a problem because attacks against root itself are still negated. The attacker will have to figure out the name of the user with sudo permissions, crack the public/private key to access the system, and then the user's password to affect system changes. This makes it much more difficult than just getting direct access to the root user
ssh root@{SERVER_IP_OR_URL}
adduser loki
usermod -aG sudo loki
sudo nano /etc/ssh/sshd_config
PermitRootLogin no
sudo systemctl reload sshd
exit
It is also a good idea to restrict users from logging in using passwords, in favor of a public/private key pair. For starters, there is nothing to remember, you setup the keys and you are granted access to login. Passwords are shorter so they can be remembered, making them easier to crack. If they are too long they are usually written down somewhere, where they can be stolen. Some people use the same password in multiple places meaning your server can become compromised even if the password is obtained somewhere else. it is easy enough to generate key pairs for each user in a group so access for a single user can be revoked by removing that individual's key.
On your local system
ssh-keygen -t rsa -b 4096 -C "[email protected]"
ssh-copy-id loki@{SERVER_IP_OR_URL}
ssh loki@{SERVER_IP_OR_URL}
sudo nano /etc/ssh/sshd_config
PasswordAuthentication no
sudo systemctl reload sshd
Now the server is more secure because it doesn't allow direct access to the root user and only allows access using public/private key pairs.
You still need a secure place to store the root and user passwords so they can be accessed to make sudo system changes. Those should only be trusted to administrators.
