Small measures to improve Linux server security

Disable Root Login

As the default system admin account root is the most vulnerable target. It is absolutely necessary to disable Telnet via SSH.

Method:

Edit/etc/ssh/sshd_config

Permitrootlogin No

Also, create a personal account for the administrator and assign it to the Sudoers user group (default is%admin)

-G admin Example_user

Modifying the sshd default port

The default port 22 for the remote service sshd is also the focus of the port scan, and modifying it to a different port (usually more than 1024) avoids most attacks. Method: Edit/etc/ssh/sshd_config

8822 #default

Using SCP instead of FTP

Although FTP is convenient, security has been criticized.

Background file management, the use of an encrypted SCP to better solve the problem.

SCP leverages sshd services, so you do not need to configure the server in addition, directly adjust account permissions.

You can use software WINSCP to connect to a server under Windows.

Official website: http://winscp.net

Installing DenyHosts

Denyhost can help you automatically analyze the security log, directly prohibit the suspected host brute force cracking.

Debian users can install directly using apt

$ sudo apt-get Install denyhosts

Official website: http://denyhosts.sourceforge.net/

Careful control of directory and file permissions, flexible use of user groups

For example, if the monitor program Munin needs to access the Web site log, do not modify the log file permission settings, but instead add Munin to the Www-data user group

$ sudo usermod-a-G www-data munin

Use a dedicated account for system programs

Try to use a dedicated account for every system program and avoid using root

such as MySQL, munin, etc., flexible use of sudo-u example_user and other commands to switch execution users and user groups

Download putty from the official website

Putty is a very popular Windows platform Remote tool, but do not covet the convenience of free download.

Such important and free software, please download from the official website, and it is best to check the integrity.

Official website: http://www.chiark.greenend.org.uk/~sgtatham/putty/

Small measures to improve Linux server security