Learn Alpine Linux - SSH, Time Sync & Logging

#Introduction

These three services may seem trivial, but they're the operational backbone of any server: SSH for remote access, time synchronization so logs and certificates stay consistent, and logging to record what happens. Episode 9 configures all three the Alpine way.

In episode 3, the setup-alpine wizard already offered OpenSSH and NTP. This episode goes deeper: securing sshd_config, using chrony as a modern NTP, and setting up log rotation so the disk doesn't fill up.

#OpenSSH and setup-sshd

#Installation and Activation

OpenSSH is available in the main repository and is usually already installed. If not, install and enable it:

apk add openssh
setup-sshd openssh
rc-service sshd start
rc-update add sshd default

setup-sshd openssh configures the SSH server, and rc-update add sshd default makes sure it runs at boot. Check the status and listener port:

rc-service sshd status
ss -tlnp | grep sshd

The ss -tlnp | grep sshd output shows the sshd service listening on port 22.

#Hardening sshd_config

#Securing Remote Access

The main configuration file lives at /etc/ssh/sshd_config. Apply the following basic hardening:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
LoginGraceTime 20
AllowUsers arman

Explanation:

• PermitRootLogin no forbids logging in directly as root.
• PasswordAuthentication no only allows SSH keys.
• MaxAuthTries 3 limits password attempts.
• AllowUsers arman restricts which users may log in.

After editing the file, validate the configuration then restart:

sshd -t
rc-service sshd restart

sshd -t checks the configuration syntax before it's applied. Don't forget to prepare an SSH key on the client:

ssh-keygen -t ed25519
ssh-copy-id -i ~/.ssh/id_ed25519.pub arman@server

Before closing your current session, open a new one and test logging in with the key — don't lock yourself out.

#Time Synchronization with chrony

#Installing and Enabling chronyd

Alpine uses chrony as a modern NTP client-server. Install and enable it:

apk add chrony
rc-service chronyd start
rc-update add chronyd default

Check time synchronization:

chronyc tracking
chronyc sources
date

The chronyc tracking output shows the synchronization status, and chronyc sources shows the NTP servers in use. The NTP server configuration lives in /etc/chrony/chrony.conf:

pool 3.id.pool.ntp.org iburst
makestep 1 3

makestep 1 3 allows time to step during the first three cycles, useful on a freshly booted VM.

#Logging with syslog and logrotate

#BusyBox syslog and logrotate

Alpine uses syslog from BusyBox by default, writing to /var/log/messages. For better log management, add logrotate:

apk add logrotate
rc-service syslog start
rc-update add syslog default

Log rotation configuration lives in /etc/logrotate.conf:

/var/log/messages {
    weekly
    rotate 4
    compress
    missingok
}

Run logrotate manually to test:

logrotate -d /etc/logrotate.conf
logrotate -f /etc/logrotate.conf

logrotate -d /etc/logrotate.conf runs a dry-run, while -f forces rotation. To read logs in real time:

tail -f /var/log/messages

In episode 13, this log-checking habit becomes part of the security hardening routine.

#Closing

Episode 9 configured three essential operational services: OpenSSH with sshd_config hardening, chrony for time synchronization, and BusyBox syslog with logrotate for log management.

Key takeaways:

• setup-sshd openssh installs and configures the SSH server.
• sshd -t validates the configuration before a restart.
• Disable PasswordAuthentication and PermitRootLogin for secure access.
• chrony replaces classic NTP; enable chronyd in the default runlevel.
• BusyBox syslog writes logs to /var/log/messages.
• logrotate keeps log sizes under control.

In the next episode, episode 10, we'll cover firewalls with iptables and nftables — using setup-firewall, writing nft rules with input, forward, and output chains, and building NAT and IP forwarding for a router or gateway.