Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Secure a Linux Server

github.com

Post reply on HN
Print view View original

81–90 of 108 posts

Re: How to Secure a Linux Server

#81

Post by imthenachoman »

joobus wrote: post #64

Does anyone have experience with deborphan? Not previously aware of it, I installed it, and it reported 2 programs which I use very frequently (conky and cryptsetup) as being orphans. I dare not run the uninstall script in the linked guide.

Would you mind pasting the output of `deborphan` showing those two or creating a new issue on my GitHub page? I want to show it to the author of `deborphan` to see if he knows why its happening.

https://github.com/imthenachoman/How-To-Secure-A-Linux-Serve...

Re: How to Secure a Linux Server

#82

Post by imthenachoman »

z3t4 wrote: post #15

Dont forget about namespaces which lets you isolate apps. and Apparmor to restrict file and network access. And also chroot and setuid to drop privileges and change the root path. And unix sockets / named pipes. Instead of letting your daemons access the whole network have them listen on a unix socket. And scan your own network, both from the outside and inside.

I am not familiar with namespaces in this context? Can you please point me in the right direction? I have added AppArmor to my to-do list. I know what chroot and setuid are, not sure what to mention about them in the guide? And I will look into unix sockets.

Can you recommend any good network scanning tools? I've been on the hunt for a good one.

Re: How to Secure a Linux Server

#83

Post by imthenachoman »

ozim wrote: post #57

Securing ssh, 2FA for ssh, using key authentication... Yes but first and foremost you don't expose ssh to all internet, it should be allowed only from known IP addresses and you should VPN to have connect to that known addresses. Section about firewall config just tells to open ssh...

I have a need to be able to SSH to my server from unknown sources, like my friends house or something. And VPN just moves changes the open port so no real benefit there. I agree on the firewall...

Re: How to Secure a Linux Server

#84

Post by imthenachoman »

zlynx wrote: post #61
ozim wrote: post #57

Securing ssh, 2FA for ssh, using key authentication... Yes but first and foremost you don't expose ssh to all internet, it should be allowed only from known IP addresses and you should VPN to have connect to that known addresses. Section about firewall config just tells to open ssh...

It might help protect against an OpenSSH zero-day but those are pretty rare. I've been running my home server with an completely open SSH port since 2012 and haven't been hacked yet. And I know since I check occasionally with Tripwire and/or RPM verification from a clean boot. The only downside to an open SSH port is the thousands and thousands of log spams from connection attempts. The upside is that I can log in fr…

Can you use Tripwire for free for home/consumer stuff? And what does RPM verification do? Just make sure all the packages you have installed are legit?

Re: How to Secure a Linux Server

#85

Post by imthenachoman »

ozim wrote: post #73
zlynx wrote: post #61

Earlier quoted context omitted.

It might help protect against an OpenSSH zero-day but those are pretty rare. I've been running my home server with an completely open SSH port since 2012 and haven't been hacked yet. And I know since I check occasionally with Tripwire and/or RPM verification from a clean boot. The only downside to an open SSH port is the thousands and thousands of log spams from connection attempts. The upside is that I can log in fr…

That is the thing, if we are talking about my personal linux server I am good with key auth + fail2ban and ssh on high port to have less spam in logs. For work related stuff if I have to deal with multiple people accessing multiple servers then it is different story. Strictly forbidding ssh to have people connect from one IP is a lot more control. Then also key auth but I don't have to setup some google auth.

Agreed. The guide is intended for a home server. Anything more and you'd need a more robust network with dedicated firewalls and a DMZ, etc....

Re: How to Secure a Linux Server

#86

Post by imthenachoman »

laumars wrote: post #67
Avamander wrote: post #65

Earlier quoted context omitted.

If you use an UDP VPN on an non-standard port it's quite a bit harder to find than SSH on a TCP port.

if your primary goal just is to hide SSH then you could have it on a none-standard port and enable port-knocking. Then you’re reducing your visibility to network traces. Ultimately though, many would argue that’s just security through obscurity so you’d still want something like fail2ban or denyhosts running - namely a tool that monitors your log files for failed log in attempts (or other suspicious activity) and the…

Thanks for the idea on port knocking. I always forget about it. Will look into it more...

Re: How to Secure a Linux Server

#87

Post by imthenachoman »

symisc_devel wrote: post #59
ozim wrote: post #57

Securing ssh, 2FA for ssh, using key authentication... Yes but first and foremost you don't expose ssh to all internet, it should be allowed only from known IP addresses and you should VPN to have connect to that known addresses. Section about firewall config just tells to open ssh...

Do you have any resources on how to allow ssh access from certain IP ranges? I can't find anything useful on this topic.

LAN IPs or WAN IPs?

If you're using public/private keys you can use the "from" option for the keys. But it's not fool proof.

Re: How to Secure a Linux Server

#89

Post by wodny »

imthenachoman wrote: post #74

Hey folks! I am the author of this guide. I did not know this was here or I would have commented sooner. This is my first time putting a guide like this together. I see a lot of really great feedback and I will be incorporating them into future updates. I don't have time today but I will reply individually to all the comments that I can. I appreciate any/all feedback/advice. If possible, could future issues be submit…

It has been mentioned in one of the pull request that this guide was being discussed on HN right after it got here: https://github.com/imthenachoman/How-To-Secure-A-Linux-Serve....

There are two fresh threads on Reddit:

https://www.reddit.com/r/linuxadmin/comments/arx7xo/howtosec...

https://www.reddit.com/r/linux/comments/arx7st/howtosecureal...

Re: How to Secure a Linux Server

#90

Post by imthenachoman »

mgbmtl wrote: post #42
dev_dull wrote: post #36

> 2FA for ssh Correct me if I'm wrong, but isn't this what password-protected private key encryption is?

The author probably meant "two-step" (out of band verification) rather than two-factor.

A pass phrase on a certificate is two step. Password + TOTP is two factor.
Post reply on HN