Securing your Linux web server

gmemstr wrote: post #2

No mention of restricting access to keypairs and removing access via password login? This is the #1 thing I do with all servers I deploy.

At the top of the article it's mentioned that the blog post is an excerpt from a book.

Re: Securing your Linux web server

#5

Post by entelechy0 » Tue, Feb 20, 2018, 4:07 PM UTC

My go to:

http://www.codelitt.com/blog/my-first-10-minutes-on-a-server...

Re: Securing your Linux web server

#6

Post by rodolphoarruda » Tue, Feb 20, 2018, 4:20 PM UTC

Sir_Cmpwn wrote: post #3

I have a little checklist I use to cover the basics: https://drewdevault.com/new-server.html

I'm a generalist project manager.

When you say "Disable password login via ssh", what is going to be the login method from this point onwards? Via a personal certificate? Tks

Re: Securing your Linux web server

#7

Post by newbear » Tue, Feb 20, 2018, 4:22 PM UTC

Sir_Cmpwn wrote: post #3

I have a little checklist I use to cover the basics: https://drewdevault.com/new-server.html

The general advice I've seen is to not host your own server. But I think it would be a great learning experience. If you cover the basics, is your server still extremely vulnerable?

Re: Securing your Linux web server

#8

Post by Sir_Cmpwn » Tue, Feb 20, 2018, 4:25 PM UTC

newbear wrote: post #7

Sir_Cmpwn wrote: post #3

I have a little checklist I use to cover the basics: https://drewdevault.com/new-server.html

The general advice I've seen is to not host your own server. But I think it would be a great learning experience. If you cover the basics, is your server still extremely vulnerable?

No, not really. I host plenty of servers, someone's gotta do it.

Re: Securing your Linux web server

#9

Post by Sir_Cmpwn » Tue, Feb 20, 2018, 4:26 PM UTC

rodolphoarruda wrote: post #6

Sir_Cmpwn wrote: post #3

I have a little checklist I use to cover the basics: https://drewdevault.com/new-server.html

I'm a generalist project manager. When you say "Disable password login via ssh", what is going to be the login method from this point onwards? Via a personal certificate? Tks

~/.ssh/authorized_keys, which is basically personal certificates.

Re: Securing your Linux web server

#10

Post by brobinson » Tue, Feb 20, 2018, 4:26 PM UTC

rodolphoarruda wrote: post #6

Sir_Cmpwn wrote: post #3

I have a little checklist I use to cover the basics: https://drewdevault.com/new-server.html

I'm a generalist project manager. When you say "Disable password login via ssh", what is going to be the login method from this point onwards? Via a personal certificate? Tks

You should be using public key authentication: https://www.digitalocean.com/community/tutorials/how-to-set-...

If you insist on using passwords, make sure you at least install something like fail2ban or denyhosts to block the compromised machines which are hammering your server trying to guess passwords. Clients can see which authentication methods are allowed so they know which machines to attack (i.e., yours, if you allow passwords).