KB ID 0000881
The following is by no means an extensive list of everything that can be done. It’s just a run though of what I would consider ‘good practice’.
Create a user for SSH and Remove Shell access for the ‘root’ user.
1. Connect to the server via SSH or open a terminal session and su to root. Create a new user then set and confirm the new users password.
2. Test access for your new user.
3. To make changes to shell access, you need to edit the sshd_config file, to do that I’m using the nano editor.
Note: If you do not have nano installed, run ‘yum install nano’.
4. Locate PermitRootLogin and change it to no.
5. Locate the PermitRootLogin without-password”. line and comment it out (prefix it with a hash #, (or pound if you’re American).
Limit SSH / Shell access to particular User(s)
6. Add the following line to allow the user you create above only.
Note: If you had multiple users, you can add them separated by a space.
Disable SSH Version 1 and Force SSH Version2
7. Ensure Protocol 2 is NOT hashed out and activation of protocol 1 IS hashed out.
Change the SSH / shell Port Number
Note: There is not hard and fast rule on what port to use, but for production, I would suggest a random number above 1024 but below 65535.
9. At this point close nano and save the changes, (press CTRL+W and Y to save the changes).
10. The changes will not take effect until after you have restarted the SSH service/daemon.
11. At this point you can check that the root user no longer has SSH / Shell access.
12. But your SSH user has.
Related Articles, References, Credits, or External Links