💻 Proxmox VE Course III-B-4. Changing SSH Port & Disabling Root Login: Hardening Basic Security

 

🛡️ Protect Your Server from Invisible Threats

The moment you connect a server to the outside world, bots from all over the world start knocking on port 22 first

Proxmox VE's default settings are powerful, but settings that everyone knows can often become the easiest prey for hackers

In particular, since the 'root' ID exists commonly on all Linux servers globally, it is the primary target for 'Brute Force' attacks that randomly substitute passwords

In this #lecture, we will redesign the SSH environment, which is the most common path for server intrusion, and learn the security #method to drastically increase the basic physical strength of your infrastructure step-by-step

---

1. Changing SSH Port: The Basics of Hide-and-Seek Security

By simply changing the standard port 22 to an arbitrary high number (e.g., between 20000 and 60000), you can block more than 90% of automated scanning attacks

A. Editing the Configuration File

• You must edit the /etc/ssh/sshd_config file, the heart of SSH configuration

  Uncomment the part that says Port 22 and change it to a number only you know

  This is a very effective means of preventing #data leakage incidents by reducing the external exposure area

B. Updating Firewall Rules in Advance

• Before changing the port, you must allow (Accept) the new port in the Proxmox firewall

  Otherwise, the moment you apply the settings, you will face a lock-out situation where you cannot even access the server yourself

  Such meticulous preparation is an essential procedure for maintaining the #stability of server operation

C. Service Restart and Verification

• Reflect the settings through the systemctl restart ssh command\

Afterward, it is a safe #network management tip to check if access is successful through the new port in a separate session before closing the existing session

---

2. Disabling Root Login and Utilizing Regular User Accounts

Disabling direct login with the root account, which holds the highest authority, is the key to realizing the 'Principle of Least Privilege' in security

A. Creating a General Administrator Account

• Create a user account to replace root and give it a strong password

  This account will be granted sudo privileges and will only exercise administrator authority when necessary

  This account separation acts as a safety device to prevent system damage due to unintentional mistakes in a #virtualization environment

B. Modifying PermitRootLogin Setting

• Return to the sshd_config file and modify PermitRootLogin yes to no

  Now, even if a hacker finds out the root password, they can never log in remotely

  It's like creating a second gateway (sudo) even if an internal intruder occurs

C. Strengthening Security Without #Performance Degradation

• These settings raise the security level to the highest without consuming any hardware resources of the system

  It is like building a basic defense line equivalent to a hardware firewall just with software settings

---

3. Introducing SSH Key-Based Authentication: Passwordless Security

String passwords can be stolen at any time, but mathematically calculated encryption key pairs cannot be breached without the physical file

A. Key Pair Generation and Public Key Copying

• Register the public key (.pub) generated through ssh-keygen on the administrator's PC into the server's authorized_keys

  Now, secure login is possible without a password, which becomes a very useful #resource when operating automated scripts

B. Completely Blocking Password Authentication

• If key authentication is working normally, change the PasswordAuthentication item to no

  An invincible #software-defined security environment where the password itself is not even entered is completed

C. Advancement of #Infrastructure Security

• If operating as a team, issue a unique key for each administrator

  Audit tracking of who accessed when and at what time becomes clear, and since you only need to delete the corresponding key when a specific administrator leaves, security management becomes very simple

---

4. Establishing Monitoring and Additional Defense Systems

Security does not end with configuration; it must be accompanied by continuous surveillance

A. Integration with Fail2Ban

• Install Fail2Ban, which automatically blocks IPs that fail to log in more than a certain number of times

  Through #optimized filters, you can isolate the #IP of an attacker attempting a brute-force attack in real-time

B. Login Log Analysis

• Periodically check the /var/log/auth.log file to see if there were any abnormal access attempts\

Logs become the most precious basic #data for intrusion detection and response planning

C. Synergy with Integrated Firewall

• Combining the Proxmox Datacenter firewall learned previously with this SSH hardening creates a double or triple defense shield

  In the end, security is much more powerful when there are several layers of thin walls rather than one single strong wall

The settings covered today are 'Golden Rules' that must be performed first after installing Proxmox

I hope you protect your precious server resources safely by strengthening the basics

---

Lecture, Method, Data, Stability, Network, Virtualization, Performance, Resource, Software, Infrastructure, IP, Optimization

---

Optimal performance, best cost efficiency! Experience Proxmox VE-based hosting that perfectly fits your project. Go to Luzen Hosting