Server Hardening + SSH + updates

Adrien

Ability to:

Disable Password login into the server and only allow SSH key.
SSH Key Vault inside Enhance
Ability to add or remove SSH keys from servers
Show a notice on the server list when a server needs an upgrade or a reboot

Thanks for your consideration.

Adam

Adrien Disable Password login into the server and only allow SSH key.

You can do this in /etc/ssh/sshd_config. The setting is called PasswordAuthentication.

We deliberately don't allow manipulation of SSH users and passwords for the host o/s. If someone were able to gain access to your control panel login they could very quickly add SSH keys to all of your servers. We have had feature requests to add this in the past but most customers manage root SSH keys via ansible, puppet, etc.

Show a notice on the server list when a server needs an upgrade or a reboot

We will do this!

ss88us

Adrien SSH Key Vault inside Enhance

This would be a very nice feature. I always have to add my Key to websites. It would be nice for my user to be able to pre-select a key to add from the Vault.

MediaServe

Adrien Here's some bash code you can use to automate reboots overnight with cron:

/usr/bin/needs-restarting -r
RETURN=$?
if [ $RETURN -eq 1 ]; then
        /usr/sbin/reboot
else
        OUTPUT=$(/usr/bin/needs-restarting -s)
        for I in $OUTPUT
        do
                /usr/bin/systemctl restart $I
        done
fi

Should reboot only for kernel updates or service restarts requiring some sort of reboot. Otherwise updated services should be restarted as well.

If needs-restarting not yet installed:

apt install zypper

manu

+100 for this. Much needed.

Adam

ss88us

Oh I see, maybe I misunderstood Adrien's request. We can definitely do this with no impact to security - feature request logged.

Adrien

ss88us From one idea to a better one ;-) Thanks Steven!

@Adam You understood perfectly ;-) I didn't realize the security risks you mentioned. Some do it (like RC), but that's because they host everything and handle security.

Adam, Thanks for your message. I removed the password login successfully. However, even when I restart SSH, it keeps asking the password. sudo systemctl restart ssh.

@MediaServe Thank you very much! Btw I checked your website and what you do. It looks fantastic.

MediaServe

Adrien Thanks for the kind words! We're due for a remake of the website because it's still completely run by WHMCS. We're a small family run host trying to abandon cPanel's crazy price increases, finally looks like we might be able to do that with Enhance! The alternatives IMO are simply not suitable yet.

afterlife1245

Hello, I am a new user. Hello very warmly and I am weak in English 😛

I am writing this post and also it is related to the topic
https://community.enhance.com/d/982-ssh-terminal-in-enhance-panel/

I am in favor of implementing an internal terminal on the customer panel because of:

The ability to restrict to SSH via IP address (dedicated IP or VPN) via port 22 from outside via Firewall, so that there is no attack from outside and only for administrator.
Clients can access the internal terminal from the container at the panel level and not interfere with other container and system environment.
It can be set to manually enable a given client to access the internal terminal by request to support.

There is one server panel that are based applications on advanced containers. The team has introduced an internal terminal that can only access a given container through the panel and it works without a problem and we don't have to have external port 22 open all the time for SSH.

I am the type of administrator that I want to have limited access to SSH via external port 22 for me or those authorized via VPN or through a private network (Host Bastion). This way I had it implemented on servers with an external firewall and no attack and I had login added by key and without password for more security.
I plan to test a Teleport or similar system to make things easier with server management.

I am a new user of your panel and I am very happy with how it works. I am currently in the process of testing, so there are many things I don't know yet how it works.

I have a question, is it possible to connect between clusters to the main panel through a private network? Because I want to completely restrict SSH access from outside port 22. Or introduce the option to automatically enter the server addresses that are used by a person to all the servers of his own in the Firewall function, which is scheduled for March 2024. Seemingly a very strange solution, but this at the same time increases the security of the server.

lefteris

This is a useful guide for ssh hardening
https://www.ssh-audit.com/hardening_guides.html#ubuntu_22_04_lts

larsbnd

In this sense, I wonder if PermitRootLogin without-password can be set without issues to limit root to SSH Keys?

xyzulu

larsbnd I wonder if PermitRootLogin without-password

I'd suggest disabling password authentication via SSH entirely. Enhance does not authenticate with password and neither should anyone else be doing that via SSH.

larsbnd

Thanks for your reply. I would like to leave ssh for customers open and with this option only root would be permitted via password.