Best Practices for Securing Windows SSH Server

Security becomes paramount in remote management tools like SSH. If you’re running a Windows server, securing your SSH server is important to protect your data and systems from unauthorized access.

In this blog, we’ll explore how to secure the Windows SSH server. But first, let’s understand briefly what is Windows SSH Server, What are its importance is, and some of the common security risks.

So, let’s get started.

What is an SSH Server?

SSH, known as Secure Shell, is a protocol used to securely access and manage remote servers. It’s like a secure tunnel that protects your data from being seen by others.

With an SSH server on Windows, administrators and users can remotely connect to the server, perform tasks, and manage resources while keeping everything encrypted and secure.

Importance of SSH Server on Windows

Using an SSH server on Windows is important for securely managing your computer from a distance. It’s a safe way to move files, give commands, and control system resources.

But, if it’s not properly protected, an SSH server can be targeted by cyber-attacks, which can result in data leaks and unauthorized entry. That’s why securing your Windows SSH server isn’t just a good idea—it’s necessary.

Common Security Risks Associated with SSH on Windows Servers

Even if you have security features, SSH servers can still be at risk if they’re not set up properly. Here are some typical threats to watch out for:

• Brute Force Attacks: Hackers attempt to gain access by trying multiple passwords.
• Unauthorized Access: Weak or default credentials can be easily exploited.
• Data Interception: Without proper encryption, sensitive data can be intercepted.

Having an insecure SSH server can cause serious problems like losing data, unauthorized access to important information, and harm to your organization’s reputation.

So, let’s discuss the best ways or best practices to secure your Windows SSH server.

Best Practices for Securing Windows SSH Server

1. Use Strong Authentication Methods

Start by implementing strong authentication methods. Instead of relying on passwords alone, use key-based authentication. This involves generating a pair of keys one public and one private. The public key is stored on the server, while the private key remains secure on your device.

This way, even if someone steals your password, they still can’t access the server without the private key.

To set this up:
1. Generate a key pair using an SSH client.
2. Upload the public key to the server and add it to the ~/.ssh/authorized_keys file.

Disable password authentication by setting PasswordAuthentication no in the SSH configuration file (/etc/ssh/sshd_config).

2. Disable Empty Passwords

Disable empty passwords to “NO” to effectively secure your server. Now everyone has to have a password, which adds a really important layer of security.

Here are the steps to disable empty passwords by modifying the SSH configuration file, which is usually found at /etc/ssh/sshd_config.

• Access the SSH Configuration File: Please open the SSH configuration file using a text editor that has administrative privileges.
• Modify the Configuration: In the configuration file, find the line that says #PermitEmptyPasswords yes.

  By default, this setting might be commented out with a # symbol. Change this line to PermitEmptyPasswords no and remove the # symbol if it’s there. This change will prevent the use of empty passwords.

Save the changes to the configuration file and restart the SSH service for the changes to take effect.

It’s a simple yet effective way to increase the security of your server, preventing attackers from exploiting weak or non-existent passwords.

3. Configure Idle Timeout Interval

Setting an idle timeout interval feature will automatically end inactive sessions after a certain period. This helps reduce the chance of unauthorized access if someone leaves their session unattended.

In an environment where many users can access the server, this is important for preventing any potential misuse of an open session.

Here’s how to set up an idle timeout interval on your Windows SSH server:

• Configure ClientAliveInterval:

  The ClientAliveInterval setting determines how often the server checks if the client’s session is still active by sending a message. This interval is measured in seconds.

  For example, if you set ClientAliveInterval to 300, the server will send a message every 300 seconds (which is 5 minutes). If the client doesn’t respond, it means that the session might not be active anymore.

• Set ClientAliveCountMax:

  The ClientAliveCountMax setting determines how many times the server can send a message to a client without getting a response before it ends the session.

  For instance, if ClientAliveCountMax is set to 3, and the server doesn’t get a response after sending three messages (as specified by ClientAliveInterval), it will close the session.

Remember to set the ClientAliveInterval to 300 and the ClientAliveCountMax to 3. This will automatically disconnect the SSH session if there is no activity from the client side for 15 minutes.

Add the following lines to your SSH configuration file:

ClientAliveInterval 300
ClientAliveCountMax 3

This measure helps protect against unauthorized access, especially if a user forgets to log out or if a session is accidentally left open.

4. Backup of Your SSH Configuration File

Don’t forget to make a backup of the SSH configuration file on your Windows server before you start making any changes. The file is usually called sshd_config and it holds all the important settings that manage how the SSH server works.

Backing up this file means you’ll have a copy of it saved. This can be helpful if something goes wrong when you’re setting things up, as it means you can go back to the original file without losing anything.

Here’s how you can back up the SSH configuration file on your Windows server:

Create a Backup

1. 1. Manual Copy:
      • Navigate to the directory containing sshd_config.
      • Right-click on the file and select “Copy.”
      • Paste the copied file into a safe location, such as another folder or an external storage device. Rename the copied file to something like sshd_config_backup to indicate that it’s a backup version.
   2. Command Line

To create a backup using the command line, open Command Prompt or PowerShell with administrative privileges and run a command like this:

C:\ProgramData\ssh\sshd_config
C:\ProgramData\ssh\sshd_config_backup

This command copies the sshd_config file to the same directory with a new name, preserving the original file.

Please make sure the backup file has been created successfully and can be accessed. Also, store the backup file in a safe place, preferably where unauthorized users can’t get to it.

If you can, keep the backup on a different device or external storage to protect it from potential data loss on the main server.

Once you’ve saved a copy of the configuration file, you can go ahead and make changes like adjusting how you log in, setting up firewall rules, or adding extra security.

If something goes wrong, just put the original file back and restart the SSH service, and your server should go back to how it was.

5. Limiting Root Access

It’s really important to limit root access for SSH servers because the root account has maximum control and is a main target for attackers.

By default, SSH allows direct root login, which can be risky if someone gets hold of the root password. To make it more secure, it’s better to disable direct root login by setting “PermitRootLogin no” in the sshd_config file.

Instead, use the principle of least privilege. This means users should log in with a regular account and then switch to an administrative account using sudo when they need to do administrative tasks. This helps reduce the risk of unauthorized access and prevents potential
misuse of the root account.

6. Changing the Default SSH Port

It’s a good idea to change the default SSH port from 22 to a different port for better security. The default port is often targeted by automated bots and brute-force attacks.

By using a different port for your SSH service, you make it harder for attackers to find and target your system. You can change the port by editing the sshd_config file and specifying a new port number (for example, Port 2222).

Don’t forget to update your firewall rules to allow traffic on the new port after making this change. Doing so can help decrease the number of automated attack attempts on your server.

7. Disabling Unused SSH Features

Make sure to turn off any SSH features that you don’t use. Things like X11 forwarding and TCP forwarding can make your server vulnerable to attacks if they’re not properly secured. If you don’t need these features, it’s best to disable them in the SSH configuration file.

For example, In the configuration file (sshd_config), you can disable X11Forwarding and AllowTcpForwarding by setting them to ‘no’. By doing this, you reduce the chances of attackers exploiting these features, which makes your server more secure. This is part of the bigger idea of minimizing the risks to your server.

8. Applying Firewall Rules

Implementing firewall rules is important for securing your Windows SSH server. Firewalls help by controlling the network traffic coming in and going out, acting like a barrier against potential attackers.

You can reduce the risk of unauthorized access by creating firewall rules to limit SSH access to trusted IP addresses. Here’s a step-by-step guide for setting up firewall rules on a Windows server:

• Opening Windows Firewall:

  To access the Windows Firewall settings, you can go to the Control Panel or search for “Windows Defender Firewall” in the Start menu. Another way is to use the command wf.msc in the Run dialogue (press Win + R) to open the Windows Firewall with the Advanced Security console.

• Creating a New Inbound Rule:

  Open the Windows Firewall with the Advanced Security console. Go to “Inbound Rules” and click on “New Rule…” in the Actions pane. Choose “Port” as the rule type because you want to control traffic for the SSH port.

• Configuring the Port and Protocol:

  Specify the port number that your SSH server is using. If you’ve changed the default SSH port from 22 to another number, enter that specific port. Make sure to choose “TCP” as the protocol, as SSH typically uses TCP for
  communication. For example, if your SSH server uses port 2222, enter 2222 in the port field.

• Specifying Allowed IP Addresses:

  To ensure only specific IP addresses can access your SSH server, choose “Allow the connection if it is secure” and list the allowed IP addresses or ranges. You can enter individual IP addresses or a range of IPs. For instance, if you want to permit only your office’s static IP, just enter that address. This way, you can ensure that only devices from trusted locations can connect to your server using SSH.

• Naming and Activating the Rule:

  After setting up the rule, give it a clear name like “SSH Access Control” and then click “Finish” to turn on the rule. Check that the rule is enabled and applies to the right network profiles (Domain, Private, Public) based on your server’s network settings.

By implementing these firewall rules, you create a secure perimeter around your Windows SSH server.

It’s important to check and update these rules often to make sure they still match your security policies and any changes in your network. You should also think about using other security tools like intrusion detection systems to add extra protection for your server.

Now let’s take a look at some of the advanced security measures for your Windows SSH server.

Advanced Security Measures for Windows SSH Server

• Two-factor authentication (2FA)

  Two-factor authentication (2FA) is a strong security feature that adds protection to your Windows SSH server.

  With 2FA, you need to provide two forms of identification – usually a password and a one-time code sent to your phone. This means that even if someone gets your password, they can’t access your account without the second code.

  It’s a good idea to use two-factor authentication (2FA) to add an extra layer of security to your accounts. To set it up, you can use apps like Google Authenticator or Authy on your phone.

  These apps will generate unique codes that you’ll need to enter along with your password when logging in. This makes it much harder for unauthorized people to access your accounts, which is important for keeping your information safe.

• IP Whitelisting

  Use IP Whitelisting to secure your Windows SSH server by only allowing specific, trusted IP addresses to connect. This limits the number of devices that can access your server, making it harder for attackers to target it.

  This method is really helpful; therefore, when you only want a few specific people to be able to access a server using SSH, like an internal IT team or remote admins. To use IP whitelisting, you just need to set up your server’s firewall to only allow connections from certain approved IP addresses.

  Use Windows Firewall or another firewall management tool. Keep the whitelist up to date to match any changes in your network or team. IP whitelisting adds extra security by only allowing authorized users from known locations to access your SSH server.

• Intrusion Detection Systems (IDS)

  It’s really important to use Intrusion Detection Systems (IDS) to keep an eye on and protect your Windows SSH server from possible security threats. An IDS works by looking at the traffic on your network and the activity on your server to find any strange patterns or behaviours that could mean there’s an attack happening.

  There are two main types of IDS: network-based (NIDS) and host-based (HIDS). NIDS keeps an eye on the network for anything suspicious, while HIDS pays attention to the system itself, like log files and how applications behave.

  To set up an IDS, you need to install software or hardware that keeps scanning for any signs of unauthorized access or malicious activity. When it detects something unusual, it sends an alert to the administrator so they can quickly respond to potential threats.

  Using an IDS helps you spot and respond to security issues right away. This can stop hackers from getting into your SSH server and stealing or damaging your data.

Conclusion

It’s really important to make sure your Windows SSH server is secure so that your data and systems are safe from unauthorized access. By following the best practices and advanced security measures in this guide, you can lower the risk of cyber-attacks. Keep an eye out, keep your systems updated, and make sure your security practices are current to protect your digital assets and keep your servers safe.