Search for a command to run...
A Comprehensive Guide to Multi-Key Authentication, Fail2ban Defense, and Best Practices in Server Security
I am a student studying in Mumbai University, learning DevOps, looking for opportunities to learn more things by gaining experience at prestigious institutions
No comments yet. Be the first to comment.
I built all the DevOps projects featured on roadmap.sh, and now I'm breaking them down on Hashnode from first principles. In this series, you'll see each project deconstructed to its core fundamentals—explaining every concept from the ground up.
A Deep Dive into the Fundamentals of IT Infrastructure and Performance Metrics
A Dev Journey Through Hackathons, Childhood Games, and Pokémon Cards
A Deep Dive into CI/CD, Workflow Architecture, and Secure Automation for Modern Software Development
A comprehensive guide to creating a robust, scalable CI/CD pipeline for a multi-tier Java application using AWS, Kubernetes, Terraform &GitHub Actions
A technical deep dive into how we built a cloud-native system that transforms handwritten prescriptions into structured medication information
A First Principles Approach to Decoding Server Activity and Transforming Data into Actionable Intelligence
In the world of server administration and cloud computing, secure remote access is of paramount importance. This blog post guides you through the entire process of setting up secure SSH (Secure Shell) access to a remote Linux server on AWS, using multiple SSH key pairs for authentication, and implementing additional security measures like fail2ban to protect against brute force attacks.
By the end of this guide, you'll have a comprehensive understanding of SSH key management, server configuration, and security best practices that you can apply to your own projects.
SSH (Secure Shell) is a cryptographic network protocol that enables secure communication between two computers over an unsecured network. Unlike its predecessors like Telnet, SSH encrypts all traffic, protecting against eavesdropping and man-in-the-middle attacks.
SSH security is built on public-key cryptography. This system uses a pair of keys:
These keys work together through asymmetric encryption:
This creates a secure system where:
Let's implement these concepts by setting up a remote Linux server on AWS with secure SSH access using two separate SSH key pairs. This approach demonstrates how you can manage different authentication credentials for the same server.
The first step is to create your virtual server in the AWS cloud. EC2 (Elastic Compute Cloud) provides scalable computing capacity in the AWS cloud.
Launch a new instance with the following specifications:
Connect to your instance using the AWS-provided key:
ssh -i ~/.ssh/aws_key.pem ec2-user@your-instance-ip
💡 Why Amazon Linux? Amazon Linux is optimized for AWS, includes AWS tools by default, and receives regular security updates directly from Amazon. This makes it an excellent choice for AWS-hosted servers.
SSH key pairs are the cryptographic credentials that allow secure authentication without passwords. Let's generate two separate key pairs for our server:
The ssh-keygen utility creates a mathematical key pair using public key cryptography algorithms. When generating keys, consider:
# Generate first key pair
ssh-keygen -t rsa -b 4096 -f ~/.ssh/my_first_key -C "first-key"
# Generate second key pair
ssh-keygen -t rsa -b 4096 -f ~/.ssh/my_second_key -C "second-key"
Each command creates:
my_first_key or my_second_key).pub extension⚠️ Security Alert: Your private key files should NEVER be shared with anyone or committed to repositories. They should have permissions set to 600 (readable only by your user).
Now we'll configure our remote server to accept both SSH key pairs for authentication.
The authorized_keys file contains a list of public keys that are allowed to authenticate. When an SSH client tries to connect:
authorized_keysDisplay your public keys on your local machine:
cat ~/.ssh/my_first_key.pub
cat ~/.ssh/my_second_key.pub
Add to authorized_keys on the server:
# On your remote server
nano ~/.ssh/authorized_keys
# Paste both public keys, each on its own line
# Save and exit (Ctrl+X, Y, Enter in nano)
Set proper permissions:
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
💡 Why these permissions? The SSH daemon is highly security-conscious and will refuse to use keys if the permissions are too open. These permission settings ensure only the owner can read or modify the keys.
To simplify connections, we'll create an SSH config file that specifies connection details and key locations.
The SSH config file allows you to:
# On your local machine
nano ~/.ssh/config
Add these lines:
Host roadmapsh-test-server
HostName your-instance-ip
User ec2-user
IdentityFile ~/.ssh/my_first_key
IdentityFile ~/.ssh/my_second_key
Save and exit. Now you can connect with:
ssh roadmapsh-test-server
SSH will automatically try each key in order until one works.
💡 Pro Tip: You can include additional options like
ServerAliveInterval 60to keep connections alive orCompression yesto speed up connections over slow networks.
fail2ban is a security tool that monitors log files and automatically blocks IP addresses that show malicious signs, such as multiple failed login attempts.
fail2ban:
/var/log/secureInstall fail2ban:
sudo yum update -y
sudo yum install fail2ban -y
Create a custom configuration:
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local
Configure the SSH jail by ensuring these settings:
[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/secure
maxretry = 3
bantime = 3600 # 1 hour in seconds
Start and enable fail2ban:
sudo systemctl start fail2ban
sudo systemctl enable fail2ban
Verify it's working:
sudo fail2ban-client status sshd
💡 Understanding fail2ban jails: Each "jail" is a separate configuration for a specific service (like SSH). You can have different settings for different services, allowing fine-grained control over security policies.
Let's verify that our setup works correctly:
Connect with the first key:
ssh -i ~/.ssh/my_first_key ec2-user@your-instance-ip
Connect with the second key:
ssh -i ~/.ssh/my_second_key ec2-user@your-instance-ip
Connect with the alias:
ssh roadmapsh-test-server
Test fail2ban (optional, and with caution): On a different machine, attempt to connect with incorrect credentials multiple times. Then check if your IP is banned:
sudo fail2ban-client status sshd
Throughout this tutorial, we've implemented several security best practices. Here's a summary:
Disable password authentication in /etc/ssh/sshd_config:
PasswordAuthentication no
Limit user access by specifying allowed users:
AllowUsers ec2-user
Change the default SSH port to reduce automated attacks:
Port 2222 # Example alternative port
Use security groups/firewalls to restrict IP ranges that can access SSH
Keep your system updated with regular security patches:
sudo yum update -y
You've now set up a secure remote server access system using multiple SSH keys and enhanced protection with fail2ban. This approach provides:
This knowledge forms the foundation of secure server administration and can be applied to any Linux-based server, not just AWS EC2 instances.
Github repo [https://github.com/kaalpanikh/ssh-remote-server-setup]
Have you set up remote SSH access before? What other security measures do you implement on your servers? Share your experience in the comments below!