1–10 of 25 posts
What do you use? What wouldn't you ever use again? Any absolute rules that you force yourself to follow before even bringing your server online?
Thanks!
In /etc/ssh/sshd_config, disable root logins:
PermitRootLogin no
Even if you think your password ist strong. This will stop a majority of the brute-force password-guessing attacks. For extra credit, install denyhosts as well. It has stopped a _lot_ of bad guys trying to brute-force my servers.
2. Lock them down as much as possible in configuration and access (for example: use iptables to restrict acces to only your home/office where possible).
3. Apply vendor security updates as quickly as possible (subscribe to mailing lists).
4. Remotely backup your data.
5. Hope for the best.
1. Disable root logins via ssh (as noted above by bbb).
2. Move ssh port from port 22 to something nonstandard. According to my logs, the number of idiots who try brute-force attacks on my machines dropped from 4/day to 0.
3. Put an iptables script into /etc/init.d and make sure it runs on startup at the normal multiuser run levels (on Debian, the command is something like /sbin/update-rc.d, but I don't remember exactly). I looked into more sophisticated firewall packages which generate iptables rules, but found them rather complicated, and probably overkill (YMMV). I essentially blocked all incoming traffic except on the nonstandard ssh port and ports 80 and 443.
Services which use ports other than 80, 443, and ssh should run on a privately routed network, or, at minimum, on a separate network interface with draconian access rules. iptables is pretty easy to use once for this stuff you get the hang of it.
2) Only run the minimum amount of services.
3) Don't give anyone else access to the system. (root exploits) Also be cautious if you are running some freely available software (such as phpbb). When a security hole is found, an attacker could deploy code on your machine resulting in a denial of service attack against other internet users, or in worst case, compromising your machine with a root exploit.
4) If a security exploit is found , update! If your server got compromised, make a fresh install.
I like the Slicehost guides to getting a server up and running relatively safely. The link has some good basic server hardening tips to start you off.
One absolute rule for any *nix-based server: In /etc/ssh/sshd_config, disable root logins: PermitRootLogin no Even if you think your password ist strong. This will stop a majority of the brute-force password-guessing attacks. For extra credit, install denyhosts as well. It has stopped a _lot_ of bad guys trying to brute-force my servers.
AllowUsers user1 user2...
And it's probably best to disable password logins and use keys instead (http://www.google.com./search?hl=en&q=ssh+authorized_key...).