Skip to content

Instantly share code, notes, and snippets.

@ruyadorno

ruyadorno/Secure Linux Server.md

Last active July 23, 2023 00:16
Show Gist options
  • Save ruyadorno/104c96957939db57587e20f544b75707 to your computer and use it in GitHub Desktop.
Save ruyadorno/104c96957939db57587e20f544b75707 to your computer and use it in GitHub Desktop.
Download ZIP
Tips on how to secure a linux server
Raw
Secure Linux Server.md

SSH:

  • Disable root login
  • Disable password authentication
  • Use sudo-based privilege separation
  • Use public key authentication (ECDSA, Ed25519, etc...)
  • (Optional) Store key on smartcard
  • (Optional) Use a two-factor system such as Duo
  • (Optional) Change port of SSH to non-default (this is security by obscurity, but it deters most automated attacks, although this shouldn't matter if you're using key-based auth).

Firewall:

  • Enable appropriate firewall rules (i.e. if you don't expect traffic from a specific country, deny it)
  • Same with output rules.
  • DO NOT BLOCK ICMP (especially if you're using IPv6)
  • Use rate-limiting rules or use software such as Fail2Ban to limit authentication attempts
  • (Optional) If you don't plan on connecting over the Internet, restrict SSH (or any other services you only plan on using locally) to your intranet.

Physical:

  • Secure your server physically. If it is compromised physically, all bets are off (If it's a VPS in DO, you don't really have a say in that...).
  • Automatic Updates
  • Have all software automatically update on a set schedule
  • (Optional) Test updates in a test environment to see if they cause any issues. Approve/deny updates as necessary.

Other Important Things:

  • Backups. Run them. Test them. Test them again. And...test them again. Automate it.
  • Only allow access to the server to those who need it.
  • Same with sudo/root access (concept of least privilege)
  • Manually provisioning a server isn't something you want to do often, especially if you have 1000 servers on hand. Learn a configuration management tool such as Puppet or Chef or Ansible.

MAC (Mandatory Access Control)

  • In most cases, SELinux will be the MAC system for your distro (AppArmor for Debian).
  • Some articles will tell you to disable it. DON'T DO IT!
  • Learn how to use it properly. It takes about 15 minutes of your time, but it adds considerable security to your systems. For example, MAC can prevent a web server process from reading your home directory files, even if you went crazy one day and decided to chmod 777 your home directory (it can also prevent writes).

ref: https://www.reddit.com/r/sysadmin/comments/5wm7v7/linux_sever_security_checklist/deb774j/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment