Part 6: Security layer

28. Tighten SSH#

What you'll do: switch off SSH features you don't use, while keeping the tunnels the AI and the dashboard need. Time: 15 minutes.

Chapter 10 already turned passwords off. This adds a few more locks.

Step 1: Create the settings file#

Type on: the server

sudo nano /etc/ssh/sshd_config.d/00-homeserver.conf

File: /etc/ssh/sshd_config.d/00-homeserver.conf

PermitRootLogin no
PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no
AuthenticationMethods publickey
PermitEmptyPasswords no
X11Forwarding no
AllowAgentForwarding no
AllowTcpForwarding local
GatewayPorts no
PermitTunnel no
LogLevel VERBOSE

Line	Meaning
`AuthenticationMethods publickey`	A key is the only way in
`X11Forwarding no`	No remote graphical windows (not needed)
`AllowAgentForwarding no`	Your keys can't be borrowed from the server
`AllowTcpForwarding local`	Keeps your `ssh -L` tunnels working; blocks the reverse kind
`GatewayPorts no`, `PermitTunnel no`	No other ways to turn the server into a network bridge
`LogLevel VERBOSE`	Logs which key was used for each login (Fail2ban and you can read it)

Why 00- at the start?

SSH reads files in this folder in alphabetical order and the first value wins. 00- makes sure these settings beat anything else. The 99-lockdown.conf from Chapter 10 can stay; it says the same thing.

Step 2: Check for mistakes#

Type on: the server

sudo sshd -t

No output = OK. Then see what SSH will really use:

Type on: the server

sudo sshd -T | grep -E '^(port|permitrootlogin|passwordauthentication|kbdinteractiveauthentication|authenticationmethods|allowtcpforwarding) '

You should see:

port 22
permitrootlogin no
passwordauthentication no
kbdinteractiveauthentication no
authenticationmethods publickey
allowtcpforwarding local

If a value is different, another file wins over yours. Find it with sudo grep -rn VALUE /etc/ssh/ and fix that file.

Step 3: Apply#

Type on: the server

sudo systemctl reload ssh

Step 4: Test from a second window#

Type on: your Mac or PC (new window)

ssh homeserver

It must log in. Leave the first window open.

Step 5: Test that tunnels still work#

Skip this if you don't have Part 5.

Type on: your Mac or PC (another window)

ssh -N -o ExitOnForwardFailure=yes -L 127.0.0.1:19095:127.0.0.1:8095 homeserver

With that window open, visit http://127.0.0.1:19095/health in your browser. You should see {"status":"ok"}. Close the tunnel with Ctrl+C.

channel 2: open failed: administratively prohibited

Forwarding is switched off somewhere. Check that allowtcpforwarding says local in step 2.

Done when: a new login works and the tunnel test shows ok.

Next: 29. Tighten the firewall