Open your SSH configuration file with a text editor. You will find this file in the following system location:

/etc/ssh/sshd_config

The OpenSSH suite included in the Enterprise Server installer uses TCP/22 as the default port for SSH connections. Aspera recommends opening TCP/33001 and disabling TCP/22 to prevent security breaches of your SSH server.

To enable TCP/33001 while your organization is migrating from TCP/22, open Port 33001 within your sshd_config file (where SSHD is listening on both ports). As demonstrated by this exercise, SSHD is capable of listening on multiple ports.

...
Port 22
Port 33001
...

Once your client users have been notified of the port change (from TCP/22 to TCP/33001), you can disable Port 22 in your sshd_config file. To disable TCP/22 and use only TCP/33001, comment-out Port 22 in your sshd_config file.

...
#Port 22
Port 33001
...

In OpenSSH versions 4.4 and newer, disable SSH tunneling to avoid potential attacks; thereby only allowing tunneling from Root users. To disable non-admin SSH tunneling, add the following lines at the end of the sshd_config file:

...
AllowTcpForwarding no
Match Group root
AllowTcpForwarding yes

Depending on your sshd_config file, you may have additional instances of "AllowTCPForwarding" that are set to the default "Yes." Please review your sshd_config file for other instances and disable as appropriate.

Note that disabling TCP forwarding does not improve security unless users are also denied shell access, as they can always install their own forwarders. Please review your user and file permissions, as well as refer to the instructions below on modifying shell access.

Public key authentication can prevent brute force SSH attacks if all password-based authentication methods are disabled. Thus, Aspera recommends disabling password authentication in the sshd_config file and enabling private/public key authentication. To do so, add or uncomment PubkeyAuthentication yes in the sshd_config file and comment out PasswordAuthentication yes.

...
PubkeyAuthentication yes
#PasswordAuthentication yes
PasswordAuthentication no
...

OpenSSH defaults to allowing root logins; however disabling root access helps you to maintain a more secure server. Aspera recommends commenting out PermitRootLogin yes in the sshd_config file and adding PermitRootLogin No.

...
#PermitRootLogin yes
PermitRootLogin no
...

Administrators can then utilize the su command if root privileges are needed.

When you have finished updating your SSH server configuration, you must restart or reload the server to apply your new settings. Restarting or reloading your SSH server will not impact currently connected users. To restart or reload your SSH Server, you may use the following commands:

$ sudo service sshd restart

$ sudo service sshd reload

$ sudo /etc/init.d/ssh restart

$ sudo /etc/init.d/ssh reload

Permissions determine who can access certain files within your system, thereby making it a critical component of securing your server. By default, all user accounts are allowed to browse and read all files in the server.

To limit the user's access to a portion of the system, set the user account's shell to use the Aspera secured shell (aspshell) and set a document root for the user. The aspshell permits only the following operations:

You may configure aspshell behavior by editing the aspera.conf file (/opt/aspera/etc/aspera.conf). The following template displays access options:

<file_system>
   <access>
	  <paths>
		 <path>
			<absolute>/sandbox/$(name)</absolute>      <!-- Absolute Path -->
			<read_allowed>true</read_allowed>          <!-- Read Allowed -->
			<write_allowed>true</write_allowed>        <!-- Write Allowed -->
			<dir_allowed>true</dir_allowed>            <!-- Browse Allowed -->
		 </path>
	  </paths>
   </access>
...
</file_system>

The following is a list of your Aspera product's Docroot configuration options:

The asp-check tool performs the following secure checks:

• Searches for full-access users and reports how many exist on the system. Note that the existence of full-access users does not necessarily indicate that your system is vulnerable; however, it is being brought to the attention of the System Administrator to ensure that the existence of full-access users is intentional.
• Searches for restricted users and potential misconfigurations, including incorrect login shell (i.e., one that is not restricted via aspshell); SSH tunnel access (which can be used to work around the restricted shell); and docroot setting that allows the user to access the home directory.

To run the asp-check tool, run the following command in a Terminal window:

$ sudo /opt/aspera/bin/asp-check.sh

Your search results will appear in the Terminal window, as shown in the example below. If potential issues have been identified, please review your users' settings before proceeding.

Users with full access: 22 (not considered insecure)
Restricted users: 0
Insecure users: 0
 - no restricted shell (aspshell): 0
 - docroot above home directory: 0
 - ssh tunneling enabled: 0

Aspera recommends reviewing your SSH log periodically for signs of a potential attack. Locate and open your syslog, for example, /var/log/auth.log or /var/log/secure. Depending on your system configuration, syslog's path and file name may vary.

Look for invalid users in the log, especially a series of login attempts with common user names from the same address, usually in alphabetical order. For example:

...
Mar 10 18:48:02 sku sshd[1496]: Failed password for invalid user alex from 1.2.3.4 port 1585 ssh2
...
Mar 14 23:25:52 sku sshd[1496]: Failed password for invalid user alice from 1.2.3.4 port 1585 ssh2
...

If you have identified attacks:

• Double-check the SSH security settings in this topic.
• Report attacker to your ISP's abuse email (e.g. abuse@your-isp).