5.10 5 Restrict Telnet And Ssh Access

Telnet and SSH (Secure Shell) are protocols used for remote access to computer systems. Restricting access to these services is crucial for maintaining the security of your network and preventing unauthorized entry. A 5.10.5 security control, often referenced in security standards and guidelines, emphasizes the importance of implementing measures to limit Telnet and SSH access. This article provides a comprehensive guide on how to restrict Telnet and SSH access, covering the reasons behind this security measure, practical steps for implementation, and best practices for long-term maintenance.

Understanding the Risks of Unrestricted Telnet and SSH Access

Telnet: Telnet is an older protocol that transmits data, including usernames and passwords, in plaintext. This means that anyone who can intercept the network traffic can easily read the login credentials and gain unauthorized access to the system. Due to its inherent security flaws, Telnet should be avoided whenever possible, especially over insecure networks.

SSH: SSH is a more secure protocol that encrypts all data transmitted between the client and the server, protecting usernames, passwords, and other sensitive information from eavesdropping. While SSH is significantly more secure than Telnet, it is still vulnerable to attacks if not properly configured and managed. Unrestricted SSH access can lead to brute-force attacks, password guessing, and exploitation of software vulnerabilities.

By restricting Telnet and SSH access, organizations can significantly reduce their attack surface and minimize the risk of unauthorized access and data breaches. Implementing a 5.10.5 security control helps ensure that only authorized users can access sensitive systems and data, improving overall security posture.

Practical Steps to Restrict Telnet Access

Since Telnet is inherently insecure, the best practice is to disable it entirely. If disabling Telnet is not possible due to legacy system requirements, you must implement strict access controls and monitoring to mitigate the risks.

1. Disable Telnet Service:

• Linux:

  • Use the following command to stop the Telnet service:

    sudo systemctl stop telnet.socket
    sudo systemctl stop telnet.service
    

  • To prevent the service from starting at boot, disable it:

    sudo systemctl disable telnet.socket
    sudo systemctl disable telnet.service
    

• Windows:

  • Open the Services application (services.msc).
  • Locate the Telnet service.
  • Right-click and select "Properties."
  • In the "General" tab, set the "Startup type" to "Disabled."
  • Click "Apply" and then "OK."
  • Stop the service by right-clicking on it and selecting "Stop."

2. Firewall Rules:

• Ensure that your firewall blocks all incoming and outgoing traffic on port 23 (the default port for Telnet). This will prevent any unauthorized attempts to connect to the Telnet service.

3. Network Segmentation:

• Isolate systems that require Telnet access to a separate network segment with strict access controls. This can help limit the potential impact of a security breach.

4. Monitoring and Logging:

• If Telnet cannot be disabled, implement robust monitoring and logging to detect and respond to suspicious activity. Monitor login attempts, failed authentication attempts, and any unusual network traffic.

5. Upgrade to SSH:

• Whenever possible, migrate from Telnet to SSH. SSH provides strong encryption and authentication mechanisms, significantly improving the security of remote access.

Practical Steps to Restrict SSH Access

SSH is more secure than Telnet, but it still requires careful configuration to prevent unauthorized access. Here are steps you can take to restrict SSH access:

1. Change the Default SSH Port:

• The default SSH port is 22. Changing this port to a non-standard port can help reduce the number of automated attacks.
  • Edit the SSH configuration file (/etc/ssh/sshd_config on Linux, typically located in C:\ProgramData\ssh\sshd_config on Windows):

    sudo nano /etc/ssh/sshd_config
    

  • Find the line #Port 22 and uncomment it (remove the #). Change the port number to a value between 1024 and 65535:

    Port 2222
    

  • Save the file and restart the SSH service:

    sudo systemctl restart sshd
    

  • On Windows, restart the sshd service via the Services application.
• Note: Changing the port number does not make your system invulnerable, but it reduces noise from automated attacks that target the default port.

2. Disable Root Login:

• Disabling root login prevents attackers from directly logging in as the root user. Instead, users should log in with their own accounts and then use sudo to gain root privileges.
  • In the SSH configuration file (/etc/ssh/sshd_config):

    sudo nano /etc/ssh/sshd_config
    

  • Find the line PermitRootLogin yes and change it to PermitRootLogin no:

    PermitRootLogin no
    

  • Save the file and restart the SSH service:

    sudo systemctl restart sshd
    

3. Use SSH Keys for Authentication:

• SSH keys provide a more secure way to authenticate users than passwords. They use public-key cryptography to verify the identity of the client.
  • Generating SSH Keys:
    • On the client machine, use the ssh-keygen command to generate a new key pair:

      ssh-keygen -t rsa -b 4096
      

    • Follow the prompts to specify a file name and passphrase for the key.
  • Copying the Public Key to the Server:
    • Use the ssh-copy-id command to copy the public key to the server:

      ssh-copy-id user@server_ip
      

    • Alternatively, you can manually copy the contents of the public key file (~/.ssh/id_rsa.pub) to the ~/.ssh/authorized_keys file on the server.
  • Disable Password Authentication:
    • Once SSH key authentication is configured, disable password authentication to prevent brute-force attacks.
    • In the SSH configuration file (/etc/ssh/sshd_config):

      sudo nano /etc/ssh/sshd_config
      

    • Find the line PasswordAuthentication yes and change it to PasswordAuthentication no:

      PasswordAuthentication no
      

    • Save the file and restart the SSH service:

      sudo systemctl restart sshd
      

4. Implement Two-Factor Authentication (2FA):

• Adding a second factor of authentication, such as a one-time password (OTP) generated by an app on your phone, can significantly increase the security of SSH access.
  • Using Google Authenticator:
    • Install the Google Authenticator PAM module:

      sudo apt-get install libpam-google-authenticator
      

    • Configure SSH to use PAM authentication:
      • Edit the PAM configuration file for SSH (/etc/pam.d/sshd):

        sudo nano /etc/pam.d/sshd
        

      • Add the following line at the top of the file:

        auth required pam_google_authenticator.so
        

    • Enable ChallengeResponseAuthentication in the SSH configuration file (/etc/ssh/sshd_config):

      sudo nano /etc/ssh/sshd_config
      

      • Change ChallengeResponseAuthentication no to ChallengeResponseAuthentication yes.
    • Run the google-authenticator command as the user you want to enable 2FA for:

      google-authenticator
      

    • Follow the prompts to configure the Google Authenticator app on your phone.
    • Save the file and restart the SSH service:

      sudo systemctl restart sshd
      

5. Use Allow and Deny Lists:

• You can restrict SSH access to specific users or IP addresses using Allow and Deny lists.
  • AllowUsers:
    • Allows only specified users to log in via SSH.
    • In the SSH configuration file (/etc/ssh/sshd_config):

      AllowUsers user1 user2 user3
      

  • DenyUsers:
    • Denies specified users from logging in via SSH.
    • In the SSH configuration file (/etc/ssh/sshd_config):

      DenyUsers user4 user5
      

  • AllowGroups:
    • Allows only users belonging to specified groups to log in via SSH.
    • In the SSH configuration file (/etc/ssh/sshd_config):

      AllowGroups group1 group2
      

  • DenyGroups:
    • Denies users belonging to specified groups from logging in via SSH.
    • In the SSH configuration file (/etc/ssh/sshd_config):

      DenyGroups group3 group4
      

  • AllowHosts and DenyHosts:
    • While deprecated, these options allowed restricting access based on hostnames or IP addresses. It's recommended to use firewall rules instead.
  • TCP Wrappers (hosts.allow and hosts.deny):
    • TCP Wrappers can provide an additional layer of access control based on IP addresses.
    • Edit the /etc/hosts.allow and /etc/hosts.deny files to configure access rules.
    • For example, to allow SSH access only from a specific IP address:

      # /etc/hosts.allow
      sshd: 192.168.1.100
      
      # /etc/hosts.deny
      sshd: ALL
      

6. Configure Idle Timeout:

• Configure an idle timeout to automatically disconnect inactive SSH sessions. This can help prevent unauthorized access if a user leaves their session unattended.
  • In the SSH configuration file (/etc/ssh/sshd_config):

    ClientAliveInterval 300
    ClientAliveCountMax 0
    

    • ClientAliveInterval specifies the interval in seconds at which the server sends a keep-alive message to the client.
    • ClientAliveCountMax specifies the number of keep-alive messages that can be missed before the server disconnects the client. Setting it to 0 means the connection will be closed as soon as ClientAliveInterval seconds of inactivity is reached.

7. Keep SSH Software Updated:

• Regularly update your SSH server software to patch security vulnerabilities. Use your system's package manager to install updates:
  • Linux (Debian/Ubuntu):

    sudo apt-get update
    sudo apt-get upgrade
    

  • Linux (CentOS/RHEL):

    sudo yum update
    

  • Windows:
    • Ensure you have the latest version of OpenSSH installed. Check for updates via the settings or package manager you used to install OpenSSH.

8. Use a Firewall:

• A firewall provides an essential layer of security by controlling network traffic. Configure your firewall to allow SSH access only from trusted IP addresses or networks.
  • Using iptables (Linux):

    sudo iptables -A INPUT -p tcp --dport 2222 -s 192.168.1.0/24 -j ACCEPT
    sudo iptables -A INPUT -p tcp --dport 2222 -j DROP
    sudo iptables -A OUTPUT -p tcp --sport 2222 -j ACCEPT
    sudo iptables -A OUTPUT -p tcp --sport 2222 -j DROP
    

  • Using firewalld (Linux):

    sudo firewall-cmd --permanent --add-port=2222/tcp
    sudo firewall-cmd --permanent --add-source=192.168.1.0/24 --add-port=2222/tcp
    sudo firewall-cmd --reload
    

  • Windows Firewall:
    • Open "Windows Defender Firewall with Advanced Security."
    • Create an inbound rule to allow traffic on the SSH port (e.g., 2222) only from trusted IP addresses.
    • Create an outbound rule to allow traffic from the SSH port.

9. Monitor SSH Logs:

• Regularly monitor SSH logs for suspicious activity, such as failed login attempts, unusual connection patterns, and unauthorized access attempts. Use tools like fail2ban to automatically block IP addresses that exhibit malicious behavior.
  • Using fail2ban:
    • Install fail2ban:

      sudo apt-get install fail2ban
      

    • Configure fail2ban to monitor SSH logs:
      • Create a new jail configuration file for SSH (/etc/fail2ban/jail.d/sshd.conf):

        [sshd]
        enabled = true
        port = 2222
        filter = sshd
        logpath = /var/log/auth.log
        maxretry = 3
        bantime = 3600
        

    • Restart fail2ban:

      sudo systemctl restart fail2ban
      

10. Implement Intrusion Detection and Prevention Systems (IDS/IPS):

• IDS/IPS solutions can detect and prevent unauthorized access attempts to your SSH server. These systems analyze network traffic and system logs for malicious activity and can automatically block or mitigate threats.

Maintaining SSH Security

Restricting SSH access is not a one-time task. It requires ongoing maintenance and monitoring to ensure that your systems remain secure.

• Regularly Review Access Controls: Periodically review your SSH access controls to ensure that they are still appropriate. Remove any unnecessary access and update the lists of allowed users and IP addresses.
• Monitor SSH Logs: Regularly monitor SSH logs for suspicious activity. Use automated tools to analyze logs and generate alerts for potential security incidents.
• Keep Software Updated: Stay up-to-date with the latest security patches and updates for your SSH server software.
• Perform Security Audits: Conduct regular security audits to identify vulnerabilities and weaknesses in your SSH configuration.
• Educate Users: Train users on SSH security best practices, such as using strong passwords, protecting their private keys, and reporting suspicious activity.

Conclusion

Restricting Telnet and SSH access is essential for protecting your systems from unauthorized access and data breaches. By following the steps outlined in this article, you can significantly reduce your attack surface and improve your overall security posture. Remember to disable Telnet entirely if possible, and implement strong access controls, authentication mechanisms, and monitoring for SSH. Regularly maintain and update your security measures to stay ahead of emerging threats and ensure the long-term security of your systems. Implementing these steps will help you comply with security standards and guidelines, such as the 5.10.5 security control, and protect your organization from cyberattacks.