How to secure your new VPS: a step-by-step guide

Re:How to secure your new VPS: a step-by-step guide by yjftsjthsd-h on Monday October 21, 2024 @09:46PM (#41910374)

You should always verify that SSH password auth is actually off; run

  ssh -v myserver : 2>&1 | grep continue

and ensure that it only gives "publickey"!

(A surprising number of VPSs will re-enable passwords in a .d config file. And really, even if you've checked for that, the extra 10 seconds to make sure is worth it.)

[ Parent | on HN ]

Re:How to secure your new VPS: a step-by-step guide by remram on Monday October 21, 2024 @10:06PM (#41910475)

Good advice. Another option:

  ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no myserver

[ Parent | on HN ]

Re:How to secure your new VPS: a step-by-step guide by LinuxBender on Tuesday October 22, 2024 @12:20PM (#41915881)

And from the server itself. Some versions won't allow this command without also creating a prevsep directory e.g. mkdir /run/sshd if sshd is not set to automatically start.

    sshd -T | grep -i pas
    passwordauthentication yes
    permitemptypasswords yes

I permit this intentionally for my own reasons on my publicly accessible servers.

[ Parent | on HN ]

Re:How to secure your new VPS: a step-by-step guide by kjs3 on Tuesday October 22, 2024 @07:47PM (#41919948)

"Trust but verify" is good advice.

[ Parent | on HN ]