Securing your Linux web server • Hacker News Board

Re: Securing your Linux web server

#11

Post by AFNobody » Tue, Feb 20, 2018, 4:26 PM UTC

Sir_Cmpwn wrote: post #3

I have a little checklist I use to cover the basics: https://drewdevault.com/new-server.html

My list is similar but I do a UFW setup and move SSH to a non-standard port that is easy to remember (i.e. 12345) to reduce noise in my log files.

Is there any particular reason you left firewall setup off?

Re: Securing your Linux web server

#12

Post by AFNobody » Tue, Feb 20, 2018, 4:29 PM UTC

rodolphoarruda wrote: post #6

Sir_Cmpwn wrote: post #3

I have a little checklist I use to cover the basics: https://drewdevault.com/new-server.html

I'm a generalist project manager. When you say "Disable password login via ssh", what is going to be the login method from this point onwards? Via a personal certificate? Tks

I suggest you setup an account on Github and then create a SSH key with a passphrase:

https://help.github.com/articles/generating-a-new-ssh-key-an...

https://help.github.com/articles/testing-your-ssh-connection...

SSH Keys are substantially more secure than passwords.

Re: Securing your Linux web server

#13

Post by Sir_Cmpwn » Tue, Feb 20, 2018, 4:31 PM UTC

AFNobody wrote: post #12

rodolphoarruda wrote: post #6

Earlier quoted context omitted.

I'm a generalist project manager. When you say "Disable password login via ssh", what is going to be the login method from this point onwards? Via a personal certificate? Tks

I suggest you setup an account on Github and then create a SSH key with a passphrase: https://help.github.com/articles/generating-a-new-ssh-key-an... https://help.github.com/articles/testing-your-ssh-connection... SSH Keys are substantially more secure than passwords.

What does GitHub have to do with it?

Re: Securing your Linux web server

#14

Post by Eupolemos » Tue, Feb 20, 2018, 4:31 PM UTC

rodolphoarruda wrote: post #6

Sir_Cmpwn wrote: post #3

I have a little checklist I use to cover the basics: https://drewdevault.com/new-server.html

I'm a generalist project manager. When you say "Disable password login via ssh", what is going to be the login method from this point onwards? Via a personal certificate? Tks

SSH with keys.

I used this ancient video to get going: https://www.youtube.com/watch?v=Fatbs4eTdJE

Re: Securing your Linux web server

#15

Post by moftz » Tue, Feb 20, 2018, 4:35 PM UTC

newbear wrote: post #7

Sir_Cmpwn wrote: post #3

I have a little checklist I use to cover the basics: https://drewdevault.com/new-server.html

The general advice I've seen is to not host your own server. But I think it would be a great learning experience. If you cover the basics, is your server still extremely vulnerable?

Not host your own hardware or not get a dedicated server? Whether you host your own hardware in your home or rent a dedicated server, you are still responsible for proper security. Renting a VPS is a different story, you are relying on the hosting company to properly setup security for the guests. At least when you can run on bare metal, you can audit yourself. If I need to be able to quickly scale and do other "cloud computing" things, running EC2 or similar instances is pretty much the only way but if I need some real security, hosting on my own is the best option.

Re: Securing your Linux web server

#16

Post by Sir_Cmpwn » Tue, Feb 20, 2018, 4:35 PM UTC

AFNobody wrote: post #11

Sir_Cmpwn wrote: post #3

I have a little checklist I use to cover the basics: https://drewdevault.com/new-server.html

My list is similar but I do a UFW setup and move SSH to a non-standard port that is easy to remember (i.e. 12345) to reduce noise in my log files. Is there any particular reason you left firewall setup off?

I don't think firewall is terribly important. I know it's kind of against the grain, probably best to do it if you don't understand the consequences.

Re: Securing your Linux web server

#17

Post by jlgaddis » Tue, Feb 20, 2018, 4:45 PM UTC

Is that the entire chapter? Seems a little... "thin", I suppose.

Re: Securing your Linux web server

#18

Post by [deleted] » Tue, Feb 20, 2018, 4:55 PM UTC

rodolphoarruda wrote: post #6

Sir_Cmpwn wrote: post #3

I have a little checklist I use to cover the basics: https://drewdevault.com/new-server.html

I'm a generalist project manager. When you say "Disable password login via ssh", what is going to be the login method from this point onwards? Via a personal certificate? Tks

[deleted]

Re: Securing your Linux web server

#19

Post by MertsA » Tue, Feb 20, 2018, 5:01 PM UTC

brobinson wrote: post #10

rodolphoarruda wrote: post #6

Earlier quoted context omitted.

I'm a generalist project manager. When you say "Disable password login via ssh", what is going to be the login method from this point onwards? Via a personal certificate? Tks

You should be using public key authentication: https://www.digitalocean.com/community/tutorials/how-to-set-... If you insist on using passwords, make sure you at least install something like fail2ban or denyhosts to block the compromised machines which are hammering your server trying to guess passwords. Clients can see which authentication methods are allowed so they know which machines to attack (i.e., yours, if yo…

Or for something even cleaner than a program trying to parse plaintext logs you can use a PAM module. https://wiki.archlinux.org/index.php/Pam_abl

Re: Securing your Linux web server

#20

Post by madez » Tue, Feb 20, 2018, 5:14 PM UTC

newbear wrote: post #7

Sir_Cmpwn wrote: post #3

I have a little checklist I use to cover the basics: https://drewdevault.com/new-server.html

The general advice I've seen is to not host your own server. But I think it would be a great learning experience. If you cover the basics, is your server still extremely vulnerable?

Who is giving the advice to not host your own server?

My advice is to do host your own server.