Skip to content

ssh-administration.md

Latest commit

 

History

History
503 lines (330 loc) · 5.48 KB

ssh-administration.md

File metadata and controls

503 lines (330 loc) · 5.48 KB
Raw

SSH Administration Runbook

Ubuntu Linux Environment

Purpose

This runbook provides procedures for administering, troubleshooting, securing, and recovering Secure Shell (SSH) access on Ubuntu Linux servers.

Scope

Applies to:

  • Ubuntu Server 20.04 LTS
  • Ubuntu Server 22.04 LTS
  • Ubuntu Server 24.04 LTS

Services Covered:

  • OpenSSH Server (sshd)
  • SSH User Authentication
  • SSH Key Management
  • SSH Access Control
  • SSH Incident Response

1. Verify SSH Service Status

Check if SSH is installed

dpkg -l | grep ssh-server

Check Service Status

sudo systemctl status ssh

Expected Output:

Active: active (running)

Check if SSH is Enabled at Boot

sudo systemctl is-enabled ssh

Expected Output:

enabled

Start SSH Service

sudo systemctl start ssh

Stop SSH Service

sudo systemctl stop ssh

Restart SSH Service

sudo systemctl restart ssh

Reload Configuration Without Disconnecting Sessions

sudo systemctl reload ssh

2. Verify SSH Connectivity

Check Listening Port

sudo ss -tulpn | grep ssh

Expected Output:

LISTEN 0 128 0.0.0.0:22

Verify Local Connectivity

ssh localhost

Verify Remote Connectivity

ssh username@server-ip

3. SSH Configuration Management

Configuration File:

/etc/ssh/sshd_config

Backup Configuration

sudo cp /etc/ssh/sshd_config \
/etc/ssh/sshd_config.backup

Validate Configuration

Before restarting SSH:

sudo sshd -t

Expected Output:

(no output)

4. User Access Management

Create New User

sudo adduser username

Add User to Sudo Group

sudo usermod -aG sudo username

Lock User Account

sudo passwd -l username

Unlock User Account

sudo passwd -u username

Verify Account Status

sudo passwd -S username

5. SSH Key Management

Generate Key Pair (Client)

ssh-keygen -t ed25519

Copy Public Key to Server

ssh-copy-id username@server-ip

Verify Authorized Keys

cat ~/.ssh/authorized_keys

Correct Permissions

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

6. Security Hardening

Disable Root Login

Edit:

sudo nano /etc/ssh/sshd_config

Set:

PermitRootLogin no

Disable Password Authentication

PasswordAuthentication no

Allow Only Specific Users

AllowUsers adminuser cloudadmin

Change Default Port

Port 2222

Validate:

sudo sshd -t

Restart:

sudo systemctl restart ssh

7. Firewall Verification

Check UFW Status

sudo ufw status

Allow SSH

sudo ufw allow 22/tcp

Allow Alternate SSH Port

sudo ufw allow 2222/tcp

Reload Firewall

sudo ufw reload

8. Log Monitoring

View SSH Logs

Ubuntu 22.04+

sudo journalctl -u ssh

Real-Time Monitoring:

sudo journalctl -fu ssh

Authentication Events:

sudo grep sshd /var/log/auth.log

Failed Login Attempts:

sudo grep "Failed password" /var/log/auth.log

Successful Logins:

sudo grep "Accepted" /var/log/auth.log

9. Incident Response Procedures

Incident A: Connection Refused

Symptoms

ssh: connect to host x.x.x.x port 22:
Connection refused

Investigation

sudo systemctl status ssh
sudo ss -tulpn | grep ssh

Resolution

sudo systemctl start ssh

Incident B: Connection Timed Out

Symptoms

Operation timed out

Investigation

sudo ufw status
ping server-ip

Resolution

Verify:

  • Network connectivity
  • Firewall rules
  • Security groups (AWS/Azure/GCP)

Incident C: Permission Denied

Symptoms

Permission denied (publickey)

Investigation

ls -la ~/.ssh
cat ~/.ssh/authorized_keys

Resolution

Correct permissions:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Reinstall key if necessary.

Incident D: SSH Service Fails to Start

Investigation

sudo systemctl status ssh
sudo journalctl -xe
sudo sshd -t

Common Root Cause

Invalid sshd_config directive

Resolution

Restore backup:

sudo cp \
/etc/ssh/sshd_config.backup \
/etc/ssh/sshd_config

Restart:

sudo systemctl restart ssh

10. Recovery Checklist

Verify:

  • SSH service running
  • Port listening
  • Firewall rule present
  • Network connectivity operational
  • User account unlocked
  • SSH key valid
  • Configuration validated
  • Logs reviewed

Validation Commands:

sudo systemctl status ssh
sudo ss -tulpn | grep ssh
sudo ufw status
sudo sshd -t

Escalation Criteria

Escalate if:

  • Root filesystem full
  • Suspected compromise
  • Repeated brute-force attacks
  • Service repeatedly crashes
  • Authentication subsystem corruption
  • Multiple production servers affected

References

OpenSSH Documentation

man ssh
man sshd
man sshd_config

Ubuntu Service Management

man systemctl

To check if a service is already instaled on your linux machine:

  1. List all installed packages and filter output bu specific package name
dpkg -l | grep <service-name>

For example, to check if open ssh is installed:

dpkg -l | grep openssh-client
  1. Check version

''' -V '''