Skip to content

Debian/Ubuntu SSH hardening: sftp path, ssh/sshd units, UFW port #16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
artschekoff wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Debian/Ubuntu SSH hardening: sftp path, ssh/sshd units, UFW port #16

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1bc9fee
Improve SSH hardening for Debian/Ubuntu paths and service names
artschekoff Apr 4, 2026
abefad5
Merge origin/main (e3a64f0) into main
artschekoff Apr 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 40 additions & 9 deletions fortress_improved.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -948,6 +948,28 @@ module_ssh_hardening() {

# Configure SSH hardening
if [[ "${DRY_RUN}" == "false" ]]; then
# Debian/Ubuntu: default /usr/lib/openssh/sftp-server; match fortress_improved.debian_fix.sh fallbacks
local sftp_server=""
if [[ -x /usr/lib/openssh/sftp-server ]]; then
sftp_server="/usr/lib/openssh/sftp-server"
else
local cand
cand="$(command -v sftp-server 2>/dev/null || true)"
if [[ -n "$cand" && -x "$cand" ]]; then
sftp_server="$cand"
elif command -v dpkg &>/dev/null; then
cand="$(dpkg -L openssh-server 2>/dev/null | grep -E '/sftp-server$' | head -1)"
if [[ -n "$cand" && -x "$cand" ]]; then
sftp_server="$cand"
fi
fi
fi
if [[ -z "$sftp_server" ]]; then
log ERROR "SSH hardening: cannot find executable sftp-server (Debian/Ubuntu: apt-get install -y openssh-server)"
return 1
fi
log INFO "Subsystem sftp -> ${sftp_server}"

sudo tee "${ssh_config}" > /dev/null << EOF
# FORTRESS.SH SSH Configuration v5.1
# Strong security, key-based authentication only
Expand Down Expand Up @@ -985,9 +1007,11 @@ AllowAgentForwarding no
AllowTcpForwarding no
PermitTunnel no
PrintMotd no
AcceptEnv LANG LC_*
PrintLastLog yes
TCPKeepAlive yes
Compression delayed
Subsystem sftp ${sftp_server}
EOF

# Add allowed users if configured
Expand All @@ -996,10 +1020,16 @@ EOF
log INFO "SSH restricted to users: ${SSH_ALLOWED_USERS}"
fi

execute_command "Restarting SSH service" \
"sudo systemctl restart sshd 2>/dev/null || sudo systemctl restart ssh"

log SUCCESS "SSH hardening applied"
# Validate configuration
if sudo sshd -t; then
execute_command "Restarting SSH service" \
"sudo systemctl restart ssh 2>/dev/null || sudo systemctl restart sshd"
log SUCCESS "SSH hardened - password authentication disabled"
else
log ERROR "SSH configuration validation failed"
sudo cp "${BACKUP_DIR}${ssh_config}" "${ssh_config}"
return 1
fi
else
log INFO "[DRY RUN] Would harden SSH configuration"
fi
Expand Down Expand Up @@ -1275,11 +1305,12 @@ module_firewall() {
sudo ufw default "${ufw_outgoing}" outgoing
sudo ufw default deny routed

# Allow SSH (with rate limiting)
if systemctl is-active --quiet sshd 2>/dev/null || systemctl is-active --quiet ssh 2>/dev/null; then
local ssh_port="${SSH_PORT:-22}"
sudo ufw limit "${ssh_port}/tcp" comment 'SSH with rate limiting'
log INFO "SSH access allowed on port ${ssh_port} with rate limiting"
# Allow SSH (with rate limiting); Ubuntu uses unit "ssh", many others "sshd"
local ufw_ssh_port="${SSH_PORT:-22}"
if systemctl is-active --quiet ssh 2>/dev/null || \
systemctl is-active --quiet sshd 2>/dev/null; then
sudo ufw limit "${ufw_ssh_port}/tcp" comment 'SSH with rate limiting'
log INFO "SSH access allowed on port ${ufw_ssh_port} with rate limiting"
fi

# Allow common services if running
Expand Down