Server Hardening + SSH + updates

Adrien

Ability to:

Disable Password login into the server and only allow SSH key.
SSH Key Vault inside Enhance
Ability to add or remove SSH keys from servers
Show a notice on the server list when a server needs an upgrade or a reboot

Thanks for your consideration.

Adam

Adrien Disable Password login into the server and only allow SSH key.

You can do this in /etc/ssh/sshd_config. The setting is called PasswordAuthentication.

We deliberately don't allow manipulation of SSH users and passwords for the host o/s. If someone were able to gain access to your control panel login they could very quickly add SSH keys to all of your servers. We have had feature requests to add this in the past but most customers manage root SSH keys via ansible, puppet, etc.

Show a notice on the server list when a server needs an upgrade or a reboot

We will do this!

ss88us

Adrien SSH Key Vault inside Enhance

This would be a very nice feature. I always have to add my Key to websites. It would be nice for my user to be able to pre-select a key to add from the Vault.

MediaServe

Adrien Here's some bash code you can use to automate reboots overnight with cron:

/usr/bin/needs-restarting -r
RETURN=$?
if [ $RETURN -eq 1 ]; then
        /usr/sbin/reboot
else
        OUTPUT=$(/usr/bin/needs-restarting -s)
        for I in $OUTPUT
        do
                /usr/bin/systemctl restart $I
        done
fi

Should reboot only for kernel updates or service restarts requiring some sort of reboot. Otherwise updated services should be restarted as well.

If needs-restarting not yet installed:

apt install zypper

manu

+100 for this. Much needed.

Adam

ss88us

Oh I see, maybe I misunderstood Adrien's request. We can definitely do this with no impact to security - feature request logged.

Adrien

ss88us From one idea to a better one ;-) Thanks Steven!

@Adam You understood perfectly ;-) I didn't realize the security risks you mentioned. Some do it (like RC), but that's because they host everything and handle security.

Adam, Thanks for your message. I removed the password login successfully. However, even when I restart SSH, it keeps asking the password. sudo systemctl restart ssh.

@MediaServe Thank you very much! Btw I checked your website and what you do. It looks fantastic.

MediaServe

Adrien Thanks for the kind words! We're due for a remake of the website because it's still completely run by WHMCS. We're a small family run host trying to abandon cPanel's crazy price increases, finally looks like we might be able to do that with Enhance! The alternatives IMO are simply not suitable yet.