While working with SSH, you might be interested in tweaking SSH server options a little bit.
So you do that in ETC SSH, SSH D underscore config.
For instance, by default, your SSH server lists on port 22.
If you want to hide your SSH server a little bit, you might want to change it.
But do realize that on an SELinux-enabled system, you will also need to change SELinux
settings to match.
Permit root login, by default, is disabled.
If you really want a user to log in directly, you could enable it.
Bad idea.
Public key authentication defines whether you want to log in using public keys.
Or password authentication is what you can use to allow or deny password authentication.
X11 forwarding denies or allows forwarding of graphical applications.
And another interesting option is allow users.
Now the thing with SSH is that you can restrict it by only allowing certain users to log in.
So if I would use allow user student, for instance, that means that only user student
can log in and nobody else.
And that's a pretty decent security feature.
Let me show you.
So let me edit the etc SSH SSH D underscore config.
Not to be confused with SSH underscore config, which is for client options.
And in this configuration file, let me see if there is an allow users.
And oh, we don't have allow users yet.
That's right.
Allow users is not a default option.
So if you want to use it, you need to enter it yourself.
So I'm going to put it anywhere.
Let me put it right here.
Allow users.
And I make that student.
Okay.
So this is a server-like option, right?
So we need to make sure that we do it the right way.
But as a simple test, I can test on localhost.
Do remind that I just changed the configuration.
And on Linux, if you change the configuration of something, often you need to reload something.
So systemctl restart sshd allows the SSH server to pick up the new option.
And let me use ssh linda at localhost.
We have a user, Linda.
And there we can see what?
Well, this is about host key.
And I'm using yes.
And then I'm entering Linda user password.
And what do we get?
Well, we don't seem to be getting anything.
And why is that?
Well, that is because of the allow users option that I just used.
So Linda can try for as long as she wants.
It's not going to work.
The only user that should be allowed is the student user.
So let's try it again.
And as you can see, that is working.
So particularly, this allow users option is the fine option that enhances the security of your SSH server a little bit more.