How to enable SSH service on Fedora Linux? By default, it seems ssh is not enabled.
Fedora may not have sshd service installed/enabled by default. You will need to install and configure it by yourself. The following instructions is for Fedora 22 as an example.
First, install the sshd server by
# dnf install openssh-server
Then, start the sshd service and make it automatically start next time you boot by
# systemctl start sshd.service
# systemctl enable sshd.service
Last, enable external connection to the port 22 (the default one) by configuring the firewall you are using.
Note: you may not need additional configurations if 22 is already opened.
If you are using firwalld, you may use the firewall-config
tool (install it by dnf install firwall-config
if you haven’t it).
Some further readings that you may find useful:
How to enable iptables on Fedora 20 https://www.systutorials.com/241222/how-to-enable-iptables-on-centos-7-fedora-20/
Basic iptables configuration for Linux https://www.systutorials.com/241412/basic-iptables-configuration-for-linux/
How to use iptables to limit rates new SSH incoming connections from each IP on Linux https://www.systutorials.com/241409/how-to-use-iptables-to-limit-rates-new-ssh-incoming-connections-from-each-ip-on-linux/
How to log connections hitting certain rules in iptables on Linux https://www.systutorials.com/241413/how-to-log-connections-hitting-certain-rules-in-iptables-on-linux/
A simple destop firewall:
http://www.cyberciti.biz/faq/linux-detect-port-scan-attacks/
copy paste from #! until the end (including exit 0) and put it in a file ending on sh (bash script).Make it executable.Don’t forget to check the name of your network interface with ifconfig.
#!/bin/bash
IPT="/sbin/iptables"
echo "Starting IPv4 Wall..."
$IPT -F
$IPT -X
$IPT -t nat -F
$IPT -t nat -X
$IPT -t mangle -F
$IPT -t mangle -X
modprobe ip_conntrack
BADIPS=$(egrep -v -E "^#|^$" /root/scripts/blocked.fw)
PUB_IF="eth0"
#unlimited
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT
# DROP all incomming traffic
$IPT -P INPUT DROP
$IPT -P OUTPUT DROP
$IPT -P FORWARD DROP
# block all bad ips
for ip in $BADIPS
do
$IPT -A INPUT -s $ip -j DROP
$IPT -A OUTPUT -d $ip -j DROP
done
# sync
$IPT -A INPUT -i ${PUB_IF} -p tcp ! --syn -m state --state NEW -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "Drop Syn"
$IPT -A INPUT -i ${PUB_IF} -p tcp ! --syn -m state --state NEW -j DROP
# Fragments
$IPT -A INPUT -i ${PUB_IF} -f -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "Fragments Packets"
$IPT -A INPUT -i ${PUB_IF} -f -j DROP
# block bad stuff
$IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
$IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL ALL -j DROP
$IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "NULL Packets"
$IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL NONE -j DROP # NULL packets
$IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
$IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "XMAS Packets"
$IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP #XMAS
$IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "Fin Packets Scan"
$IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags FIN,ACK FIN -j DROP # FIN packet scans
$IPT -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
# Allow full outgoing connection but no incomming stuff
$IPT -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT -o eth0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
# allow ssh only
$IPT -A INPUT -p tcp --destination-port 22 -j ACCEPT
$IPT -A OUTPUT -p tcp --sport 22 -j ACCEPT
# allow incoming ICMP ping pong stuff
$IPT -A INPUT -p icmp --icmp-type 8 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT -p icmp --icmp-type 0 -m state --state ESTABLISHED,RELATED -j ACCEPT
# No smb/windows sharing packets - too much logging
$IPT -A INPUT -p tcp -i eth0 --dport 137:139 -j REJECT
$IPT -A INPUT -p udp -i eth0 --dport 137:139 -j REJECT
# Log everything else
# *** Required for psad ****
$IPT -A INPUT -j LOG
$IPT -A FORWARD -j LOG
$IPT -A INPUT -j DROP
# Start ipv6 firewall
# echo "Starting IPv6 Wall..."
#/root/scripts/start6.fw
exit 0