devops-school

AWS Security Group Configuration Options for DDoS Prevention

1. Restrict SSH Access to Specific IP Addresses

Instead of allowing SSH (port 22) from anywhere (0.0.0.0/0), specify only trusted IP addresses or IP ranges.

This limits access to only authorized users, preventing random connection attempts.

Inbound Rule:

• Type: SSH
• Protocol: TCP
• Port Range: 22
• Source:

devops-school

Open SSH configuration file

sudo nano /etc/ssh/sshd_config

Recommended Options to Harden SSH Configuration

1. Limit the Number of Concurrent Sessions (per connection)

MaxSessions 2

Controls the maximum number of sessions per network connection. Lowering this reduces exposure to excessive simultaneous sessions.

2. Limit Unauthenticated Connection Attempts

devops-school

UFW (Uncomplicated Firewall) Commands --

1. Check UFW Status and Rules

sudo ufw status verbose # View current firewall status and rules sudo ufw status # Check if UFW is enabled

2. Allow SSH on Port 22

sudo ufw allow 22/tcp # Allow SSH (port 22) from any IP sudo ufw allow from x.x.x.x to any port 22 # Allow SSH from specific IP (replace x.x.x.x with IP)

devops-school

devops-school

devops-school

devops-school

devops-school

devops-school

devops-school