Skip to main content

Part 3 - Settings & Security

In part three, we will update various settings to improve security.

Step 1 - Configure SSH Server

In this step, the SSH server will be configured. The following keywords will be set:

  • ChallengeResponseAuthentication no - disables keyboard authentication
  • PasswordAuthentication no - disables password authentication
  • PermitRootLogin prohibit-password - disables password and keyboard-interactive authentication for root
  • PermitEmptyPasswords no - When password authentication is allowed, it specifies whether the server allows login to accounts with empty password strings. The default is no.

1.1 - open the configuration file:

Establish an SSH connection to your node machine and run the following command.

sudo nano /etc/ssh/sshd_config

1.2 - configure the settings

Copy the code block below and paste the keywords to the top of the file.

ChallengeResponseAuthentication no
PasswordAuthentication no
PermitRootLogin prohibit-password
PermitEmptyPasswords no

Save and exit

1.3 - validate SSH configuration

Check that the ssdh_config file is valid. If this command results in errors, go back to the last step and double check the changes you made.

sudo sshd -t

1.4 - restart ssh service

sudo systemctl restart sshd

Close the ssh session


1.5 - test connection

Reconnect to your node machine to verify the settings have not caused any connectivity issues.

Step 2 - System Update

It is very important to keep your machine updated. In this step we will run a manual update and the configure the machine to automatically update.

2.1 - manually update the system

sudo apt-get update -y
sudo apt dist-upgrade -y
sudo apt-get autoremove
sudo apt-get autoclean

2.2 - configure auto-update

sudo apt-get install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

Step 3 - Disable Root Access

A root access should not be used. Instead, a user should be using sudo to perform privileged operations on a system.

sudo passwd -l root

Step 4 - Block Unauthorized Access

Install Fail2ban to block IP addresses that are attempting to access our node. Fail2ban blocks addresses after a certain number of failed attempts.

4.1 - install fail2ban

sudo apt-get install fail2ban -y

4.2 - configure fail2ban

Create a config file to monitor ssh logins

sudo nano /etc/fail2ban/jail.local

Paste the code below into the text editor. Replace <ssh-port> to match your ssh port number.


Save changes and close the editor

4.3 - restart the service

sudo systemctl restart fail2ban

Step 5 - Improve SSH Connection

This step is only required for Ubuntu Desktop installations. If you installed Ubuntu Server, you may skip this step.

WiFi power management may slow down SSH connections. Modifying the config file will disable it.

5.1 - open the configuration file

sudo nano /etc/NetworkManager/conf.d/default-wifi-powersave-on.conf

5.2 - modify power setting

Find the wifi.power setting and change to to match the following:

wifi.powersave = 2

Save changes and close the editor.

5.3 - restart the service:

sudo systemctl restart NetworkManager