The Domain Name System (DNS) is a fundamental component of the Internet, responsible for translating human-readable domain names into IP addresses. This translation allows users to effortlessly navigate the Internet or their own private networks by using easily memorable domain names instead of complex numerical IP addresses.

This article is part of Rackset’s Server guides — browse the rest of the category for more in-depth tutorials on this topic.

Understanding DNS

DNS functions as the Internet’s directory service. When you enter a domain name like www.example.com in your web browser, DNS servers resolve this name into an IP address, such as 192.0.2.1, directing your request to the appropriate server. This process is crucial because while domain names are easy for humans to remember, computers and network devices rely on IP addresses to locate and connect with each other.

The Importance of DNS in Network Management

DNS is not only vital for public Internet navigation but also plays a critical role in private network environments. By using DNS, devices within a private network can communicate using hostnames rather than IP addresses, simplifying network management and configuration. This is particularly beneficial in dynamic environments where IP addresses may change frequently.

Benefits of Implementing DNS

• Ease of Use: Users can access websites and services using memorable names rather than numerical IP addresses.
• Network Efficiency: DNS allows for more efficient management of network resources by enabling the use of fully qualified domain names (FQDNs) for devices and services.
• Scalability: DNS supports the growth of networks by allowing new devices and services to be added without needing to memorize new IP addresses.
• Reliability: DNS provides redundancy and load balancing through multiple DNS servers and records, ensuring high availability and performance.

DNS in Server Management

Proper DNS setup is crucial for managing servers and their infrastructure. It allows administrators to quickly resolve network interfaces and IP addresses using simple names, streamlining the configuration and maintenance of applications and services. For instance, when managing a Linux VPS hosting environment, configuring DNS on Ubuntu 22.04 ensures seamless integration and operation of network services.

Prerequisites for DNS Server Installation

Before installing and configuring a DNS server on Ubuntu 22.04, ensure that you have met the following prerequisites. These steps will help streamline the installation process and prevent potential issues.

1. System Requirements

• Operating System: Ubuntu 22.04 LTS (Jammy Jellyfish) or a compatible version.
• Processor: A 64-bit processor is recommended for optimal performance.
• Memory: At least 512 MB of RAM; 1 GB or more is recommended for better performance.
• Disk Space: A minimum of 2 GB of free disk space is required to install and run the DNS server.

2. Network Configuration

• Ensure that your server has a static IP address. DNS servers require a static IP to ensure consistent availability and reliability.
• Configure your network settings appropriately. You can check your current IP configuration using the following command:

ip addr show

3. Administrative Access

• Have root access or a user account with sudo privileges. This is necessary to install and configure system-level services like DNS.
• You can verify if your user has sudo privileges by running:

sudo -l

4. Updated System Packages

• Ensure that your system packages are up-to-date. This helps avoid compatibility issues during installation. Update your system by running:

sudo apt update && sudo apt upgrade -y

5. Domain Name

• If you are setting up a DNS server for a specific domain, ensure that you have registered the domain and have access to its DNS settings.
• For private networks, decide on a naming convention for your domain names.

By meeting these prerequisites, you will be well-prepared to proceed with the installation and configuration of a DNS server on your Ubuntu 22.04 system. This setup will facilitate efficient management of your network by allowing devices to communicate using human-readable domain names instead of IP addresses.

Installing BIND on Ubuntu 22.04

BIND (Berkeley Internet Name Domain) is one of the most widely used DNS server software solutions on the Internet. It is open-source and provides a robust and flexible solution for DNS management. In this section, we will guide you through the steps to install BIND on Ubuntu 22.04.

Step 1: Update Your System

Before installing any new software, it’s a good practice to update your system’s package list to ensure you have the latest versions. Open your terminal and run the following command:

sudo apt update && sudo apt upgrade -y

This command will update the package list and upgrade installed packages to their latest versions.

Step 2: Install BIND9

BIND9 is the latest version of the BIND DNS server software. To install BIND9, execute the following command:

sudo apt install bind9 bind9utils bind9-doc -y

This command will install BIND9 along with its utilities and documentation. The -y option automatically confirms the installation.

Step 3: Verify the Installation

Once the installation is complete, you can verify that BIND9 is installed and running by checking the status of the service:

sudo systemctl status bind9

You should see an output indicating that the BIND9 service is active (running). If it is not running, you can start it using:

sudo systemctl start bind9

To enable BIND9 to start on boot, use the following command:

sudo systemctl enable bind9

Step 4: Configure the Firewall

If you have a firewall enabled, ensure that it allows DNS traffic. Use the following commands to allow DNS service through the firewall:

sudo ufw allow 53/tcp
sudo ufw allow 53/udp

After updating the firewall rules, you can check the status of the firewall to ensure the rules are applied:

Read more: Installing ChatGPT on Your Server

If you need this service, Rackset’s team provides professional Linux VPS with full support so you can rely on the quality and get set up quickly.

sudo ufw status

With these steps, BIND9 should now be installed and configured to start automatically on your Ubuntu 22.04 server. You can proceed to configure BIND for your specific DNS needs.

Understanding DNS Configuration Files

Configuring a DNS server on Ubuntu 22.04 involves understanding and managing several key configuration files. These files are essential for defining how your DNS server operates, which domains it serves, and how it interacts with other DNS servers. Here’s a breakdown of the primary DNS configuration files you will encounter.

/etc/bind/named.conf

The /etc/bind/named.conf file is the main configuration file for the BIND DNS server. It includes directives that control the overall behavior of the DNS server. This file typically includes references to other configuration files that define specific zones and options.

Key Sections in named.conf

• options: This section specifies global server options, such as directory paths, query logging, and access control.
• zone: Each zone statement defines a domain for which the server is authoritative. It includes information about the zone file location and its type (e.g., master, slave).
• include: This directive allows the inclusion of additional configuration files, helping to organize complex configurations.

/etc/bind/named.conf.options

The /etc/bind/named.conf.options file is used to define global server options that apply to all zones. This is where you configure options such as DNS forwarding and recursion.

/etc/bind/named.conf.local

This file is used to define local zone configurations. You specify the zones your server will be authoritative for in this file. It’s a good practice to keep local configurations separate from global options for easier management.

Example Zone Configuration

zone "example.com" {
    type master;
    file "/etc/bind/db.example.com";
};

Zone Files

Zone files, like /etc/bind/db.example.com, store DNS records for a specific domain. These records map domain names to IP addresses and include details such as mail server information and name server entries.

Common DNS Records

Understanding these configuration files is essential for efficiently managing your DNS server on Ubuntu 22.04. Properly configuring these files will ensure your network operates smoothly, with human-readable domain names seamlessly translating to IP addresses.

Configuring Forward and Reverse DNS Zones

Once you have installed the DNS server on Ubuntu 22.04, the next step is to configure the forward and reverse DNS zones. These zones are essential for resolving domain names to IP addresses and vice versa, enabling seamless communication within your network.

Forward DNS Zone Configuration

The forward DNS zone is responsible for mapping domain names to IP addresses. To configure it, follow these steps:

1. Create a zone file for your domain. This file will contain all the DNS records for your domain.
2. Navigate to the /etc/bind/ directory where the DNS configuration files are located.
3. Create a new file named db.example.com (replace example.com with your domain name).
4. Edit the db.example.com file with the following content:

$TTL 86400
@   IN  SOA ns1.example.com. admin.example.com. (
        2023101001 ; Serial
        3600       ; Refresh
        1800       ; Retry
        604800     ; Expire
        86400 )    ; Negative Cache TTL
;
@   IN  NS  ns1.example.com.
@   IN  A   192.168.1.10
www IN  A   192.168.1.10

In this configuration:

• @ represents the root domain.
• NS records define the name servers for the domain.
• A records map domain names to IP addresses.

Reverse DNS Zone Configuration

The reverse DNS zone is used to map IP addresses back to domain names. Here’s how to configure it:

1. Create a reverse zone file. This is typically named based on the IP address range, such as db.1.168.192 for the 192.168.1.0/24 range.
2. Edit the db.1.168.192 file with the following content:

$TTL 86400
@   IN  SOA ns1.example.com. admin.example.com. (
        2023101001 ; Serial
        3600       ; Refresh
        1800       ; Retry
        604800     ; Expire
        86400 )    ; Negative Cache TTL
;
@   IN  NS  ns1.example.com.
10  IN  PTR example.com.

In this configuration:

• PTR records map IP addresses to domain names.
• The 10 in the PTR record corresponds to the last octet of the IP address 192.168.1.10.

After configuring both the forward and reverse DNS zones, restart the BIND service to apply the changes:

sudo systemctl restart bind9

With these configurations, your DNS server on Ubuntu 22.04 is set up to resolve both forward and reverse DNS queries effectively.

Testing and Verifying DNS Server Configuration

Once you have installed and configured your DNS server on Ubuntu 22.04, it is crucial to test and verify that it is functioning correctly. Testing ensures that your DNS server resolves domain names to IP addresses accurately and efficiently. Follow these steps to verify your DNS server configuration:

Read more: Installing Apache Web Server on Windows Server 2022

Step 1: Verify DNS Server Status

First, ensure that the DNS server service is active and running. Use the following command to check the status of the named service:

Choosing and registering the right domain is your online identity. Through Rackset’s domain names you can search your ideal name and register it instantly with full support.

sudo systemctl status named

Look for the line that indicates the service is “active (running).” If the service is not running, you can start it using:

sudo systemctl start named

Step 2: Test DNS Resolution Locally

To test if your DNS server can resolve domain names, use the dig command. This command queries the DNS server and returns the IP address associated with a domain name. Replace example.com with a domain name you wish to test:

dig @localhost example.com

Check the ANSWER SECTION in the output for the correct IP address of the domain. If the IP address is correct, your DNS server is resolving names properly.

Step 3: Test DNS Resolution from a Client Machine

To ensure that other devices on your network can use your DNS server, configure a client machine to use your DNS server’s IP address. Then, perform a DNS lookup from the client using the dig or nslookup command:

dig @your-dns-server-ip example.com

or

nslookup example.com your-dns-server-ip

If the client machine receives the correct IP address, your DNS server is correctly configured for network use.

Step 4: Check DNS Logs

Review the DNS server logs to ensure there are no errors or warnings. The logs are typically located at /var/log/named/named.log. Use the following command to view the logs:

sudo tail -f /var/log/named/named.log

Look for any error messages or unusual activity that may indicate a configuration issue.

By following these steps, you can confirm that your DNS server on Ubuntu 22.04 is properly configured and operational, ensuring seamless network communication and efficient domain name resolution.

Securing Your DNS Server

Securing your DNS server is a vital step in protecting your network from various cyber threats. A well-secured DNS server prevents unauthorized access and mitigates risks such as DNS spoofing, cache poisoning, and denial-of-service attacks. Here are practical steps to secure your DNS server on Ubuntu 22.04:

1. Use Secure DNS Software

Ensure that you are using up-to-date and secure DNS software. BIND is a popular choice, but alternatives such as Unbound or PowerDNS may offer additional security features. Regularly update your DNS software to the latest version to patch known vulnerabilities.

2. Configure Access Controls

Restrict who can query your DNS server by configuring access controls. This helps prevent unauthorized users from exploiting your DNS server.

acl "trusted" {
    192.168.1.0/24;
    localhost;
    localnets;
};

options {
    allow-query { trusted; };
};

3. Implement DNSSEC

DNS Security Extensions (DNSSEC) add a layer of security by allowing DNS responses to be verified for authenticity. Enable DNSSEC on your DNS server to protect against DNS spoofing and ensure data integrity.

dnssec-enable yes;
dnssec-validation auto;

4. Use Rate Limiting

Implement rate limiting to prevent denial-of-service attacks. This limits the number of queries a single client can make in a given time frame.

Read more: Installing Apache on Ubuntu 22.04: A Step-by-Step Guide

rate-limit {
    responses-per-second 5;
    window 5;
};

5. Monitor and Log DNS Traffic

Regularly monitor and log DNS traffic to detect any unusual activity. Use tools like dnstop or dnsquerylog to analyze logs and identify potential threats.

For projects that need guaranteed resources and full root control, a VPS is the right step up from shared hosting. With VPS hosting you get dedicated CPU/RAM, NVMe storage, a dedicated IP and high uptime, deployed in minutes.

6. Restrict Zone Transfers

Limit zone transfers to authorized secondary DNS servers only. This prevents attackers from gaining access to your DNS zone data.

zone "example.com" {
    type master;
    file "/etc/bind/db.example.com";
    allow-transfer { 192.168.1.2; };
};

Additional Security Tips

• Disable recursion if not needed: Recursion allows your DNS server to query other DNS servers on behalf of a client. Disable it if your server is not intended to serve as a recursive resolver.
• Regularly audit your DNS server configuration and logs for any signs of compromise.
• Implement firewall rules to restrict access to your DNS server on port 53.

By following these steps, you can significantly enhance the security of your DNS server and protect your network infrastructure.

Troubleshooting Common DNS Issues

Even with a well-configured DNS server on Ubuntu 22.04, issues can arise. Troubleshooting these problems effectively ensures smooth network operations. Here are some common DNS issues and their solutions:

1. DNS Name Resolution Failure

If domain names are not resolving to IP addresses, verify the DNS server configuration:

• Ensure the DNS service is running. Use the following command to check the status:

sudo systemctl status bind9

• Check the configuration files for errors. Use the following command to test the configuration:

sudo named-checkconf

• Verify zone files using:

sudo named-checkzone example.com /etc/bind/db.example.com

Replace example.com with your domain name and ensure there are no syntax errors.

2. Incorrect DNS Records

Incorrect DNS records can lead to resolution issues. Ensure that:

• All A, CNAME, MX, and other records are correctly defined in the zone files.
• The TTL (Time To Live) values are appropriate for your network needs.

After making changes, restart the DNS service:

sudo systemctl restart bind9

3. Network Connectivity Issues

Sometimes, DNS issues are due to network connectivity problems:

• Check if the server can reach external DNS servers:

ping 8.8.8.8

• Ensure there are no firewall rules blocking DNS traffic on port 53.

4. Caching Problems

DNS cache can cause outdated information to be used. Clear the DNS cache on your server:

sudo systemd-resolve --flush-caches

For client machines, restart the network service or clear the local DNS cache, depending on the operating system.

5. Permission Issues

Ensure that the DNS server has the necessary permissions to read the configuration and zone files. Verify ownership and permissions:

sudo chown bind:bind /etc/bind/db.example.com
sudo chmod 644 /etc/bind/db.example.com

Replace db.example.com with your actual zone file.

By following these troubleshooting steps, you can resolve common DNS issues and maintain a robust network environment.

Conclusion

Setting up a DNS server on Ubuntu 22.04 can significantly enhance your network management capabilities, offering you greater control over domain name resolution within your infrastructure. By following the steps outlined in this guide, you can install and configure a DNS server that is both robust and scalable, ensuring efficient domain name translation and improved network performance. Regular maintenance and monitoring are crucial to keeping your DNS server secure and running smoothly, so make sure to periodically check for updates and apply security patches.

As you continue to develop your network infrastructure, consider exploring additional features and configurations that can further optimize your DNS server’s performance. Rackset offers a range of hosting solutions that can complement your DNS setup, providing reliable and scalable options for your growing needs. Visit our website to learn more about our services and how they can support your technical requirements.

Frequently Asked Questions

What is the purpose of a DNS server?

A DNS server translates human-readable domain names into IP addresses, allowing users to access websites using easy-to-remember names instead of numerical IP addresses.

How do I install a DNS server on Ubuntu 22.04?

You can install a DNS server on Ubuntu 22.04 by using BIND9. Execute the command `sudo apt update && sudo apt install bind9 bind9utils bind9-doc` to install the necessary packages.

What are the basic configuration steps for BIND9 on Ubuntu 22.04?

After installing BIND9, configure it by editing the `/etc/bind/named.conf.options` file to set your DNS options, such as forwarders. Then, define your zones in `/etc/bind/named.conf.local` and create zone files in `/etc/bind/zones/`.

How can I check the status of my DNS server?

To check the status of your DNS server, use the command `sudo systemctl status bind9`. This will show you whether the BIND9 service is active and running.

How do I troubleshoot DNS issues on Ubuntu 22.04?

For DNS troubleshooting, use tools like `dig` and `nslookup` to query DNS records. Check the BIND9 logs located in `/var/log/syslog` for error messages and ensure your configuration files are correctly set up and free of syntax errors.

Secure Shell (SSH) is a cryptographic network protocol used to operate network services securely over an unsecured network. Its primary purpose is to provide secure access to a remote system, allowing users to perform operations as if they were physically present at the terminal. SSH is widely used for managing servers, transferring files, and executing commands securely.

This article is part of Rackset’s Server guides — browse the rest of the category for more in-depth tutorials on this topic.

Why Is SSH Important?

SSH is crucial for several reasons:

• Security: SSH encrypts the data exchanged between the client and server, protecting it from eavesdropping, man-in-the-middle attacks, and other forms of cyber threats.
• Authentication: It supports various authentication mechanisms, including password-based and public key authentication, enhancing the security of server access.
• Data Integrity: SSH ensures that the data sent over the network is not altered during transit, maintaining its integrity.
• Port Forwarding: It allows secure tunneling of other protocols, providing a secure way to access network services.

Default SSH Port and Security Implications

The default port for SSH communication is port 22. This is widely known, making it a common target for automated attacks and port scanning tools such as Netcat, Nmap, and Telnet. These tools can easily identify open ports and the services running on them, posing a security risk if appropriate measures are not taken.

Although social engineering is increasingly used for sophisticated cyberattacks, many attacks still rely on automated scripts that exploit common configuration errors and insecure default settings. Leaving the SSH port at its default setting is one such vulnerability.

Benefits of Changing the Default SSH Port

Changing the default SSH port on your Linux VPS can offer several advantages:

1. Reduced Visibility: By using a non-standard port, you make it less likely for automated scripts to discover your SSH service, reducing exposure to basic attacks.
2. Additional Layer of Security: While not foolproof, altering the default port adds an extra hurdle for attackers, complementing other security measures.

In the subsequent sections of this guide, we will walk you through the process of changing the SSH port on your Linux VPS to enhance your server’s security.

Default SSH Port and Its Vulnerabilities

The Secure Shell (SSH) protocol is a critical component for managing and accessing your Linux VPS remotely. By default, SSH listens on port 22, which is well-known and universally recognized. This default setting, while convenient, poses certain security risks primarily due to its predictability.

Understanding the Default SSH Port

SSH communication typically occurs over port 22. This port is designated for SSH traffic, allowing users to securely log into remote systems and execute commands. However, its default nature makes it a common target for attackers.

Vulnerabilities of Using Port 22

• Port Scanning: Have you ever attempted basic port scanning services using tools like Netcat, Nmap, and Telnet on your local network or server? These tools make it simple to discover open ports, including port 22, and the services running on them. Attackers frequently use these tools to identify potential targets.
• Automated Attacks: Many cyber-attacks are automated, leveraging scripts that scan for systems with default configurations. Port 22 is often targeted by these scripts because it is the default SSH port.
• Brute Force Attacks: Once port 22 is identified as open, attackers may attempt brute force attacks to gain unauthorized access. These attacks involve systematically guessing passwords to break into the system.

Why Change the Default SSH Port?

Changing the default SSH port to a non-standard port can significantly reduce the risk of these automated attacks. By doing so, you shield your server from less sophisticated attacks that primarily target systems with default settings. While this is not a foolproof security measure, it adds an additional layer of obscurity that can deter automated scripts.

Additional Security Measures

Alongside changing the SSH port, consider implementing other security measures such as:

1. Using SSH keys: These provide a more secure authentication method than passwords.
2. Implementing a firewall: Restrict access to the SSH port using firewall rules.
3. Intrusion Detection Systems: Deploy systems to monitor and alert you of any suspicious activity.

By understanding the vulnerabilities associated with the default SSH port and taking proactive steps to mitigate these risks, you can enhance the security of your Linux VPS.

Benefits of Changing the SSH Port

Changing the SSH port from its default setting of 22 to a custom port number can provide several security advantages. While it is not a comprehensive security measure on its own, it serves as an essential component of a broader security strategy for your Linux VPS. Below are some key benefits of changing the SSH port:

Reduce Exposure to Automated Attacks

Many automated scripts and malware are designed to target systems with default configurations, including SSH running on port 22. By changing the SSH port to a non-standard number, you significantly reduce the risk of these automated attacks succeeding. This simple step can act as a deterrent, forcing attackers to exert more effort to find your SSH service.

Minimize Port Scanning Visibility

Port scanning tools like Netcat, Nmap, and Telnet are commonly used to identify open ports and associated services on a network. By moving SSH to a non-standard port, you make it less likely for casual port scans to detect your SSH service. This reduces the chances of your server being targeted by opportunistic attackers.

Decrease the Likelihood of Brute Force Attacks

Brute force attacks often focus on services running on default ports. By changing the SSH port, you can decrease the likelihood of such attacks. While this doesn’t eliminate the possibility of brute force attempts, it adds an additional layer of obscurity, making it harder for attackers to find and target your service.

Read more: How to Change Passwords in Linux VPS Server

If you need this service, Rackset’s team provides professional Linux VPS with full support so you can rely on the quality and get set up quickly.

Improved Security Through Obscurity

While security through obscurity should not be the sole defense mechanism, it does add an extra hurdle for attackers. Changing the SSH port number contributes to a layered security approach, making it more challenging for attackers to gain unauthorized access to your server.

Custom Configuration Flexibility

Changing your SSH port allows for greater flexibility in configuring your server’s network settings. You can choose a port that aligns with your organization’s security policies or network architecture, providing a more tailored security solution.

Summary

Incorporating a custom SSH port into your security strategy can enhance your server’s defenses against common, unsophisticated attacks. While it is not a standalone solution, it complements other security measures, such as firewalls and intrusion detection systems, to create a more secure environment.

Preparing Your Linux VPS for SSH Port Change

Before changing the SSH port on your Linux VPS, it’s crucial to prepare your server to ensure a smooth transition and avoid potential lockouts. This preparation involves several key steps that safeguard your server’s accessibility and security.

1. Verify Root Access

Ensure you have root or superuser access to your Linux VPS. Without this level of access, you won’t be able to modify the SSH configuration file, which is necessary for changing the port.

2. Update Your System

Before making any changes, update your system to ensure all software packages are current. This can help prevent compatibility issues and improve security.

sudo apt update && sudo apt upgrade -y

3. Backup Configuration Files

Always back up your current SSH configuration file before making any changes. This allows you to restore the original settings if needed.

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

4. Configure Firewall Rules

Adjust your firewall settings to allow traffic on the new SSH port. This step is crucial to prevent being locked out of your server after the port change.

Using UFW (Uncomplicated Firewall)

# Replace 'NEW_PORT' with your desired port number
sudo ufw allow NEW_PORT/tcp

Using iptables

# Replace 'NEW_PORT' with your desired port number
sudo iptables -A INPUT -p tcp --dport NEW_PORT -j ACCEPT

5. Test Current SSH Configuration

Before making changes, test your current SSH setup to ensure it is functioning correctly. This helps identify any existing issues that could complicate the port change process.

ssh -p 22 your_username@your_server_ip

6. Plan for a Rollback

Have a rollback plan in place. This includes knowing how to access your server via an alternative method, such as a web-based console provided by your hosting provider, in case the SSH connection fails after the port change.

By following these preparatory steps, you can minimize the risk of connectivity issues and ensure a successful SSH port change on your Linux VPS.

Steps to Change the SSH Port on Linux VPS

Changing the SSH port on your Linux VPS can help protect your server from automated attacks targeting the default SSH port (22). Here’s a step-by-step guide to help you change the SSH port safely:

Step 1: Backup the SSH Configuration File

Before making any changes, it’s crucial to back up your current SSH configuration file. This ensures you can revert if something goes wrong.

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

Step 2: Choose a New Port Number

Select a new port number between 1024 and 65535, as ports below 1024 are reserved for well-known services. Avoid using ports commonly used by other services.

Read more: Accessing Linux Servers from macOS via SSH

For projects that need guaranteed resources and full root control, a VPS is the right step up from shared hosting. With VPS hosting you get dedicated CPU/RAM, NVMe storage, a dedicated IP and high uptime, deployed in minutes.

Step 3: Edit the SSH Configuration File

Open the SSH configuration file using your preferred text editor. Here, we use nano:

sudo nano /etc/ssh/sshd_config

Find the line that specifies the port. It usually looks like:

#Port 22

Uncomment the line by removing the # and change 22 to your new port number:

Port 2222

Step 4: Update Firewall Rules

Adjust your firewall settings to allow traffic on the new SSH port. If you’re using ufw, you can update the rules as follows:

sudo ufw allow 2222/tcp
sudo ufw delete allow 22/tcp

Step 5: Restart the SSH Service

After saving your changes, restart the SSH service to apply the new settings:

sudo systemctl restart sshd

Step 6: Test the New SSH Port

Open a new terminal session and attempt to connect to your server using the new port:

ssh -p 2222 username@your-server-ip

If you can connect successfully, the port change was successful. If not, check your settings and firewall rules for any mistakes.

Step 7: Update Any Automation Scripts

If you use scripts or applications that connect to your server via SSH, ensure they are updated to use the new port number.

By following these steps, you can change the SSH port on your Linux VPS, enhancing its security against automated attacks targeting default configurations.

Testing the New SSH Port Configuration

After changing the SSH port on your Linux VPS, it’s crucial to test the new configuration to ensure that you can still connect to your server and that the changes have been correctly applied. Follow these steps to verify your new SSH port setup:

Verify SSH Daemon Status

Before testing the connection, ensure that the SSH service is running smoothly. You can check the status of the SSH daemon using the following command:

sudo systemctl status sshd

If the service is active, you should see output indicating that the SSH daemon is running. If not, you may need to restart the service:

sudo systemctl restart sshd

Connect Using the New SSH Port

To test the new SSH port, attempt to connect to your server using an SSH client. Replace new_port_number with the port number you configured:

Read more: How to Change Remote Desktop Port

ssh username@your_server_ip -p new_port_number

If the connection is successful, it confirms that the SSH daemon is accepting connections on the new port.

Test with Port Scanning Tools

Utilize port scanning tools such as Netcat, Nmap, or Telnet to ensure that the new SSH port is open and accessible:

For heavy workloads and maximum performance, a dedicated bare-metal server gives you an entire physical machine. Rackset’s dedicated server deliver full hardware, root access and configurable port speeds for the most demanding sites and apps.

Using Nmap

nmap -p new_port_number your_server_ip

The output should indicate that the new port is open. If it shows as closed or filtered, verify your firewall settings.

Using Netcat

nc -zv your_server_ip new_port_number

A successful connection message confirms that the port is open.

Using Telnet

telnet your_server_ip new_port_number

If connected, you’ll see a message indicating a successful connection. If the connection fails, double-check your configurations.

Update Firewall Rules

Ensure that your firewall settings allow traffic on the new SSH port. For example, if you’re using UFW, execute:

sudo ufw allow new_port_number/tcp

Then, reload the firewall to apply the changes:

sudo ufw reload

After confirming the new port configuration and updating your firewall rules, your server should be more secure against basic automated attacks targeting the default SSH port.

Additional Security Measures After Changing SSH Port

Changing the SSH port on your Linux VPS is a significant step in enhancing your server’s security. However, it should not be the only measure you take. Here are additional security practices to implement after changing your SSH port:

1. Use Strong Authentication Methods

• Disable Password Authentication: Opt for SSH key-based authentication, which is more secure than using passwords. Generate a key pair with the following command:

  ssh-keygen -t rsa -b 4096

  Copy the public key to your server:

  ssh-copy-id user@your-server-ip

• Enable Two-Factor Authentication (2FA): Add an extra layer of security by using 2FA. Tools like Google Authenticator can be integrated with SSH to require a time-based one-time password (TOTP).

2. Configure a Firewall

Implement a firewall to allow only necessary traffic to your server. For example, using ufw (Uncomplicated Firewall) on Ubuntu, you can allow the new SSH port and deny others:

sudo ufw allow 1234/tcp  # Replace 1234 with your new SSH port
sudo ufw enable

3. Implement Intrusion Detection Systems

• Fail2ban: This tool monitors log files and bans IPs that show malicious signs, such as too many password failures. Install and configure it with:

  
  sudo apt-get install fail2ban
  sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
          

  Edit the jail.local file to protect your SSH service:

  
  [sshd]
  enabled = true
  port = 1234  # Replace 1234 with your new SSH port
          

4. Regularly Update Your System

Keep your server’s software and packages up to date to protect against vulnerabilities. Use the following commands to update your system:

sudo apt-get update
sudo apt-get upgrade

5. Monitor and Log Access

Regularly review your SSH logs to monitor for unauthorized access attempts. Use the following command to view the SSH log:

sudo cat /var/log/auth.log | grep "sshd"

By implementing these additional security measures, you can significantly reduce the risk of unauthorized access to your Linux VPS.

Conclusion

Changing the default SSH port on your Linux VPS is a straightforward yet effective way to enhance the security of your server. By following the steps outlined in this guide, you can reduce the risk of automated attacks and unauthorized access attempts. Remember to choose a port number that is not commonly used by other services, and ensure that your firewall settings are updated accordingly to allow connections on the new port.

As you continue to manage and secure your server, consider exploring other security measures such as implementing SSH key authentication and regularly updating your software packages. If you’re ready to take your server management to the next level, Rackset offers a range of hosting solutions and expert support to help you achieve your goals. Visit our website today to learn more about our services and how we can assist you in maintaining a secure and efficient server environment.

Frequently Asked Questions

Why should I change the default SSH port on my Linux VPS?

Changing the default SSH port from 22 to another number can help reduce the risk of automated attacks and unauthorized access attempts. It adds an extra layer of security by making it less obvious for attackers to locate your SSH service.

How do I change the SSH port on my Linux VPS?

Edit the SSH configuration file located at /etc/ssh/sshd_config. Locate the line that starts with ‘Port’ and change the number to your desired port. Save the file and restart the SSH service using ‘systemctl restart sshd’ or ‘service sshd restart’.

What should I do if I accidentally lock myself out after changing the SSH port?

If you lock yourself out, you can try accessing your VPS through a web-based console provided by your hosting provider. This allows you to revert the changes or correct the configuration file to regain access.

Are there any ports I should avoid when changing the SSH port?

Yes, avoid using ports that are commonly used by other services, such as 80, 443, and 3306. It’s best to choose a port number between 1024 and 65535 that is not already in use.

Is changing the SSH port alone enough to secure my Linux VPS?

No, changing the SSH port is just one part of securing your VPS. You should also implement other security measures such as using strong passwords, enabling firewalls, and configuring fail2ban to protect against brute-force attacks.