, CC BY-SA
Nowadays, setting up a server on hosting is a matter of minutes and a few clicks. However, immediately after launch, it enters a hostile environment because it is exposed to the entire internet like an innocent girl at a rock disco. Scanners quickly locate it and thousands of automated bots scurry through the network searching for vulnerabilities and misconfigurations. There are several steps to take right after launch to ensure basic protection.
Content
Non-root user
First of all, you need to create a non-root user for yourself. The thing is that a user root has absolute privileges in the system, and if you allow remote administration, you essentially do half the work for a hacker by leaving them a valid username.
Therefore, you need to create another user and disable remote administration for root via SSH.
A new user is created with the command useradd:
useradd [options] Then, a password is added for them with the command passwd:
passwd Finally, this user needs to be added to a group that has the right to execute commands with elevated privileges sudo. Depending on the Linux distribution, these may be different groups. For example, in CentOS and Red Hat, a user is added to the group wheel:
usermod -aG wheel In Ubuntu, they are added to the group sudo:
usermod -aG sudo
Keys instead of SSH passwords
Brute forcing or password leaks are standard attack vectors, so SSH password authentication is better turned off, and instead, use key authentication.
There are various programs for implementing the SSH protocol, such as and , but the most popular is OpenSSH. Installing the OpenSSH client on Ubuntu:
sudo apt install openssh-clientInstallation on the server:
sudo apt install openssh-serverStarting the SSH daemon (sshd) on the server under Ubuntu:
sudo systemctl start sshdAutomatically start the daemon at every boot:
sudo systemctl enable sshd It should be noted that the server part of OpenSSH includes the client part. That is, through openssh-server You can connect to other servers. Moreover, from your client machine, you can establish an SSH tunnel from the remote server to a third-party host, and that third-party host will consider the remote server as the source of requests. This is a very convenient feature for masking your system. For more details, see the article .
There is usually no point in installing a full server on the client machine to avoid the possibility of remote connections to the computer (for security reasons).
So, for your new user, you first need to generate SSH keys on the computer from which you will access the server:
ssh-keygen -t rsa The public key is stored in a file .pub and looks like a string of random characters starting with ssh-rsa.
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQ3GIJzTX7J6zsCrywcjAM/7Kq3O9ZIvDw2OFOSXAFVqilSFNkHlefm1iMtPeqsIBp2t9cbGUf55xNDULz/bD/4BCV43yZ5lh0cUYuXALg9NI29ui7PEGReXjSpNwUD6ceN/78YOK41KAcecq+SS0bJ4b4amKZIJG3JWm49NWvoo0hdM71sblF956IXY3cRLcTjPlQ84mChKL1X7+D645c7O4Z1N3KtL7l5nVKSG81ejkeZsGFzJFNqvr5DuHdDL5FAudW23me3BDmrM9ifUmt1a00mWci/1qUlaVFft085yvVq7KZbF2OP2NQACUkwfwh+iSTP username@hostname
Then, as root, create an SSH directory in the user's home directory on the server and add the SSH public key to the file authorized_keys, using a text editor like Vim:
mkdir -p /home/user_name/.ssh && touch /home/user_name/.ssh/authorized_keysvim /home/user_name/.ssh/authorized_keysFinally, set the correct permissions for the file:
chmod 700 /home/user_name/.ssh && chmod 600 /home/user_name/.ssh/authorized_keysand change the ownership to that user:
chown -R username:username /home/username/.sshOn the client side, you need to specify the location of the secret key for authentication:
ssh-add DIR_PATH/keylocationNow you can log in to the server as the user with this key:
ssh [username]@hostnameAfter authentication, you can use the scp command to copy files, or the utility for remotely mounting file systems or directories.
It is advisable to make several backups of the private key because if you disable password authentication and lose it, you will have no way to access your own server.
As mentioned above, in SSH, you need to disable root authentication (this is why we created a new user).
On CentOS/Red Hat, find the line PermitRootLogin yes in the configuration file /etc/ssh/sshd_config and change it to:
PermitRootLogin no On Ubuntu, add the line PermitRootLogin no to the configuration file 10-my-sshd-settings.conf:
sudo echo "PermitRootLogin no" >> /etc/ssh/sshd_config.d/10-my-sshd-settings.confAfter verifying that the new user can authenticate using their key, you can disable password authentication to eliminate the risk of leakage or brute force attacks. Now, to access the server, an attacker would need to obtain the private key.
On CentOS/Red Hat, find the line PasswordAuthentication yes in the configuration file /etc/ssh/sshd_config and modify it as follows:
PasswordAuthentication no On Ubuntu, add the line PasswordAuthentication no in the file 10-my-sshd-settings.conf:
sudo echo "PasswordAuthentication no" >> /etc/ssh/sshd_config.d/10-my-sshd-settings.confFor instructions on setting up two-factor authentication via SSH, see .
Firewall
The firewall ensures that only the traffic to the server on the ports you have explicitly allowed will proceed. This protects against the exploitation of ports that accidentally opened with other services, significantly reducing the attack surface.
Before installing the firewall, ensure that SSH is listed as an exception and will not be blocked. Otherwise, after the firewall is activated, we will not be able to connect to the server.
Ubuntu comes with Uncomplicated Firewall (), while CentOS/Red Hat uses .
Allowing SSH through the firewall on Ubuntu:
sudo ufw allow ssh On CentOS/Red Hat, we use the command firewall-cmd:
sudo firewall-cmd --zone=public --add-service=ssh --permanentAfter this procedure, you can start the firewall.
On CentOS/Red Hat, we start the systemd service for firewalld:
sudo systemctl start firewalld
sudo systemctl enable firewalldOn Ubuntu, we use this command:
sudo ufw enable
Fail2Ban
The service analyzes logs on the server and counts the number of access attempts from each IP address. The settings specify rules for how many access attempts are allowed over a certain interval—after which the IP address is blocked for a specified period of time. For example, we allow 5 unsuccessful SSH authentication attempts within a 2-hour interval, after which the IP address is blocked for 12 hours.
Installing Fail2Ban on CentOS and Red Hat:
sudo yum install fail2banInstalling on Ubuntu and Debian:
sudo apt install fail2banStarting:
systemctl start fail2ban
systemctl enable fail2ban The program has two configuration files: /etc/fail2ban/fail2ban.conf and /etc/fail2ban/jail.conf. The ban limits are specified in the second file.
The jail for SSH is enabled by default with the default settings (5 attempts, interval 10 minutes, ban for 10 minutes).
[DEFAULT] ignorecommand = bantime = 10m findtime = 10m maxretry = 5
In addition to SSH, Fail2Ban can protect other services on the web server nginx or Apache.
Automatic security updates
As is well known, new vulnerabilities are constantly being found in all programs. After information is published, exploits are added to popular exploit packs, which are widely used by hackers and teenagers when scanning all servers in a row. Therefore, it is very important to install security updates as soon as they are released.
On an Ubuntu server, automatic security updates are enabled by default, so no additional actions are required.
On CentOS/Red Hat, you need to install the application and enable the timer:
sudo dnf upgrade
sudo dnf install dnf-automatic -y
sudo systemctl enable --now dnf-automatic.timerCheck the timer:
sudo systemctl status dnf-automatic.timer
Changing default ports
SSH was developed in 1995 to replace telnet (port 23) and ftp (port 21), so the program's author Tatu Ylönen , and it was approved by IANA.
Naturally, all attackers are aware of which port SSH operates on — and they scan it along with other standard ports to determine the software version, check standard root passwords, and so on.
Changing standard ports — obfuscation — significantly reduces the amount of garbage traffic, log size, and server load, while also minimizing the attack surface. Although some The reason is that this technique contradicts fundamental Therefore, for example, the National Institute of Standards and Technology in the indicates the necessity of open server architecture: 'The security of the system should not rely on the obscurity of its components', it states in the document.
Theoretically, changing default ports contradicts the practice of open architecture. But in practice, the amount of malicious traffic is indeed reduced, making it a simple and effective measure.
The port number can be configured by changing the directive Port 22 in the configuration file. It is also specified as a parameter -p downward API support (simultaneously with this in The SSH client and programs also support the parameter -p.
Parameter -p which can be used to specify the port number when connecting with the command ssh in Linux. In and scp the parameter -P (Header P). The command line overrides any values in configuration files.
If there are many servers, almost all of these actions to protect a Linux server can be automated in a script. However, if there is only one server, it is better to manually control the process.
Advertising
Order now and start working immediately! of any configuration and with any operating system within a minute. The maximum configuration will allow you to go all out — 128 CPU cores, 512 GB RAM, 4000 GB NVMe. Epic 🙂
Source: habr.com
