Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Secure a Linux Server

github.com

Post reply on HN
Print view View original

61–70 of 108 posts

Re: How to Secure a Linux Server

#61

Post by zlynx »

ozim wrote: post #57

Securing ssh, 2FA for ssh, using key authentication... Yes but first and foremost you don't expose ssh to all internet, it should be allowed only from known IP addresses and you should VPN to have connect to that known addresses. Section about firewall config just tells to open ssh...

It might help protect against an OpenSSH zero-day but those are pretty rare.

I've been running my home server with an completely open SSH port since 2012 and haven't been hacked yet. And I know since I check occasionally with Tripwire and/or RPM verification from a clean boot.

The only downside to an open SSH port is the thousands and thousands of log spams from connection attempts. The upside is that I can log in from anywhere using my phone directly or as a hotspot for the laptop.

Oh yeah, and VPN just pushes the problem back one level. For me SSH is the VPN. Requiring VPN access first to get to SSH is just pushing any security problems back into the VPN server. Because now IT is the one with the open port to the internet.

Re: How to Secure a Linux Server

#62

Post by zegl »

symisc_devel wrote: post #59
ozim wrote: post #57

Securing ssh, 2FA for ssh, using key authentication... Yes but first and foremost you don't expose ssh to all internet, it should be allowed only from known IP addresses and you should VPN to have connect to that known addresses. Section about firewall config just tells to open ssh...

Do you have any resources on how to allow ssh access from certain IP ranges? I can't find anything useful on this topic.

iptables, ufw, Security Groups (if you’re on AWS). There is a lot of ways to it.

Re: How to Secure a Linux Server

#63

Post by noinsight »

dfed-mpls wrote: post #48
noinsight wrote: post #20

Earlier quoted context omitted.

> RedHat's FreeOTP It's abandonware these days and hasn't been updated for years. The iOS app doesn't work anymore and can't use the camera for reading codes.

I use it on ios, and so does most of Red Hat employees (they state it is a preferred version of tfa over the google app.) It's not broken for the 15 or so accounts I use it for.

Try the "scan code" button which should activate the camera and the app will crash. I just tested it with my iPhone and verified. The iOS App Store application was last updated 4 years ago. There's also comments there saying it doesn't work anymore.

Reading / using existing codes might work properly, or manually inputting them.

Re: How to Secure a Linux Server

#64

Post by joobus »

Does anyone have experience with deborphan? Not previously aware of it, I installed it, and it reported 2 programs which I use very frequently (conky and cryptsetup) as being orphans. I dare not run the uninstall script in the linked guide.

Re: How to Secure a Linux Server

#65

Post by Avamander »

zlynx wrote: post #61
ozim wrote: post #57

Securing ssh, 2FA for ssh, using key authentication... Yes but first and foremost you don't expose ssh to all internet, it should be allowed only from known IP addresses and you should VPN to have connect to that known addresses. Section about firewall config just tells to open ssh...

It might help protect against an OpenSSH zero-day but those are pretty rare. I've been running my home server with an completely open SSH port since 2012 and haven't been hacked yet. And I know since I check occasionally with Tripwire and/or RPM verification from a clean boot. The only downside to an open SSH port is the thousands and thousands of log spams from connection attempts. The upside is that I can log in fr…

If you use an UDP VPN on an non-standard port it's quite a bit harder to find than SSH on a TCP port.

Re: How to Secure a Linux Server

#66

Post by Avamander »

noinsight wrote: post #20
Fnoord wrote: post #12

Earlier quoted context omitted.

You don't have to use a closed source TOTP client such as Google's. There's RedHat's FreeOTP and there's another open source one called antOTP. You can find them on F-Droid as well. There have been TOTP PAM modules for ages (these work on a Linux client and Linux server via e.g. SSH). You can even add YubiKey to PAM. Same for BSD Auth and macOS.

> RedHat's FreeOTP It's abandonware these days and hasn't been updated for years. The iOS app doesn't work anymore and can't use the camera for reading codes.

TOTP/HOTP hasn't changed for years. The app works perfectly for me and needs no updates.

Re: How to Secure a Linux Server

#67

Post by laumars »

Avamander wrote: post #65
zlynx wrote: post #61

Earlier quoted context omitted.

It might help protect against an OpenSSH zero-day but those are pretty rare. I've been running my home server with an completely open SSH port since 2012 and haven't been hacked yet. And I know since I check occasionally with Tripwire and/or RPM verification from a clean boot. The only downside to an open SSH port is the thousands and thousands of log spams from connection attempts. The upside is that I can log in fr…

If you use an UDP VPN on an non-standard port it's quite a bit harder to find than SSH on a TCP port.

if your primary goal just is to hide SSH then you could have it on a none-standard port and enable port-knocking. Then you’re reducing your visibility to network traces.

Ultimately though, many would argue that’s just security through obscurity so you’d still want something like fail2ban or denyhosts running - namely a tool that monitors your log files for failed log in attempts (or other suspicious activity) and then auto blacklist that IP in your filewall. I’d personally recommend fail2ban over denyhosts for a variety of reasons but ultimately either is better than none.

What I also like to do is have the public SSH box a bastion server with its own unique credentials so you effectively have the same multi-tiered authentication as you would for VPN.

You can also add MFA for SSH too if you wanted. In fact there are a few PAM modules you can use; from captchya’s (to reduce bot effectiveness) to Google Authenticator.

Even enhanced SSH tools like the file server protocol (SFTP / scp / etc) and port forwarding can be enabled or disabled for specific logins / groups or everybody if you wanted.

So it’s entirely possible to harden SSH in the same way you would VPN.

Re: How to Secure a Linux Server

#68

Post by bpye »

koolba wrote: post #9

Here’s a bonus one: If you install Docker don’t add your non-admin to the docker group as it’s effectively passwordless sudo.

Does Docker allow you to enforce user namespaces for all comtainers? I think that avoids the issue.

Re: How to Secure a Linux Server

#69

Post by laumars »

zegl wrote: post #62
symisc_devel wrote: post #59

Earlier quoted context omitted.

Do you have any resources on how to allow ssh access from certain IP ranges? I can't find anything useful on this topic.

iptables, ufw, Security Groups (if you’re on AWS). There is a lot of ways to it.

There isn’t lots of ways to do it; there’s just the one: firewall rules. There just happens to be lots of different types of filewalls.

If you want to get clever then you can enable port knocking but my personal preference is just good old fashioned whitelist of IPs with fail2ban running ready to auto-blacklist any of those IPs that have too many failed login attempts in a given period of time.

Re: How to Secure a Linux Server

#70

Post by bpye »

pettycashstash2 wrote: post #2

I didn’t know you could add google Authenticator to your server. Thank you for this write up.

If you have an NFC YubiKey and an Android phone with NFC then the Yubico Authenticator is pretty awesome. You can store your OTP tokens on your YubiKey. Also open source.

https://github.com/Yubico/yubioath-android

Post reply on HN