Managing secure FTP (SFTP) and SSH access

When managing a server, it is essential to ensure that remote access and file transfers are secure. Secure FTP (SFTP) and Secure Shell (SSH) are two critical tools used to manage files and access servers securely. While SFTP provides a secure means of transferring files over a network, SSH is widely used for securely accessing servers and performing system administration tasks. This article discusses best practices for managing both SFTP and SSH access, ensuring they remain secure against unauthorized access.

Managing Secure FTP (SFTP)

SFTP is a secure version of FTP (File Transfer Protocol), using SSH to encrypt the connection between the client and server. Unlike FTP, which transmits data in plaintext, SFTP ensures that both data and credentials are protected during transmission.

1. Configure SFTP Server

To use SFTP, ensure that the SSH server is installed and configured on your server. Most Linux-based systems have OpenSSH installed by default. Once OpenSSH is installed, configure the SSH service to allow SFTP connections:

• Edit the SSH configuration file (/etc/ssh/sshd_config) to enable the SFTP subsystem:

  Subsystem sftp /usr/lib/openssh/sftp-server

• Restart the SSH service to apply the changes:

  sudo systemctl restart sshd

2. Limit User Access to SFTP

To enhance security, limit user access to SFTP and prevent them from accessing the server via SSH for shell access. This can be done by configuring the SSH settings:

• Edit the SSH configuration file and restrict users to SFTP only by adding the following lines:

  Match User sftpuser
    ForceCommand internal-sftp
    PasswordAuthentication yes
    ChrootDirectory /home/sftpuser

  This configuration forces sftpuser to use only SFTP for file transfers and restricts them to their home directory (/home/sftpuser), preventing shell access.

3. Use Strong Authentication

Ensure that your SFTP server uses strong authentication methods. The most secure method is to use SSH keys instead of passwords. To enable SSH key authentication:

• Generate a key pair on the client machine:

  ssh-keygen -t rsa -b 4096

• Copy the public key to the server:

  ssh-copy-id user@yourserver

• Disable password authentication in the SSH configuration:

  PasswordAuthentication no

4. Encrypt Files for Extra Security

For sensitive files, consider using additional encryption tools to protect the files even after they are transferred. This can be done using GPG or other encryption tools before sending files over SFTP.

Managing SSH Access

SSH provides secure access to a server's command-line interface, allowing administrators to manage servers remotely. It is crucial to configure SSH securely to prevent unauthorized access.

1. Disable Root Login

By default, SSH allows the root user to log in remotely. This can pose a significant security risk, as attackers can target the root account for elevated privileges. To disable root login, edit the SSH configuration file:

PermitRootLogin no

This will prevent direct root login, forcing users to log in with a regular account and then escalate privileges using sudo when necessary.

2. Use SSH Key Authentication

As with SFTP, using SSH keys for authentication is far more secure than passwords. SSH keys are much harder to crack, and they provide an extra layer of protection. To enable SSH key authentication:

• Generate a key pair on your client machine (as shown above).

• Copy the public key to the server:

  ssh-copy-id user@yourserver

• Disable password-based authentication in the SSH configuration:

  PasswordAuthentication no

3. Limit SSH Access by IP

To reduce the attack surface, limit SSH access to specific trusted IP addresses. You can do this using firewall rules (e.g., UFW or iptables) or by configuring the AllowUsers directive in the SSH configuration:

AllowUsers user@192.168.1.*

This ensures that only users connecting from the specified IP range can access the server via SSH.

4. Configure SSH to Use Non-Standard Port

SSH typically listens on port 22, making it a common target for brute-force attacks. To increase security, consider changing the default port to a non-standard one. Modify the SSH configuration file (/etc/ssh/sshd_config) to use a different port:

Port 2222

After changing the port, remember to update your firewall rules to allow traffic on the new port.

5. Implement Multi-Factor Authentication (MFA)

For an additional layer of security, enable multi-factor authentication (MFA) for SSH access. Tools like pam_google_authenticator can provide time-based one-time passwords (TOTP) in addition to SSH keys, significantly improving security.

Monitoring and Auditing SSH and SFTP Access

Regularly monitoring SSH and SFTP access is crucial for detecting unauthorized attempts and maintaining the integrity of your server.

1. Use Fail2Ban for Brute-Force Protection

Fail2Ban is a tool that scans log files for failed login attempts and bans IP addresses that show malicious activity. You can configure Fail2Ban to monitor SSH and SFTP login attempts:

• Install Fail2Ban:

  sudo apt install fail2ban

• Configure Fail2Ban by editing /etc/fail2ban/jail.local to include SSH protection:

  [sshd]
  enabled = true
  port = ssh
  logpath = /var/log/auth.log
  maxretry = 3
  bantime = 3600

2. Regularly Review Logs

Regularly review your SSH and SFTP logs to identify any unusual access attempts or failed login attempts. The logs are typically located in /var/log/auth.log (for Linux-based systems). Use tools like logwatch or logrotate to automate the review and archiving of logs.

Managing secure FTP (SFTP) and SSH access is essential for safeguarding your server from unauthorized access and data breaches. By configuring strong authentication methods, limiting access to trusted IP addresses, disabling root login, and regularly monitoring server access, you can greatly reduce the risk of security incidents. Additionally, using tools like Fail2Ban and enabling multi-factor authentication further strengthens your server's defenses, ensuring a robust security posture.