A Free Trial That Lets You Build Big!
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
Undoubtedly, for the system administrator, improving the security of the server is one of the most important things. As a result, there are many articles, blogs and forum posts for this topic.
A server is made up of a large number of functionally diverse components, making it difficult to provide tailored solutions to everyone's needs. This article covers, as far as possible, some helpful tips to help administrators keep servers and users safe.
There are some common sense that every system administrator should know by heart, so the following points will not be mentioned in this article:
Here are some more interesting things:
Change SSH default port
The first thing to do when you build a new server is to change the default port for SSH. This small change will allow your server to avoid thousands of violent attacks (LCTT does not change the default port) The hacker knows your home number so they need a single test key to unlock your home.
To change the default SSH port, open the Sshd_config file first:
Find the following line:
The "#" number indicates that the line is a comment. First delete the # number and then change the port number to the destination. The port number cannot exceed 65535, making sure that the port number you want to specify is not occupied by the system or other services. It is recommended to view a list of common port numbers on [Wikipedia]. In this article, use this port number:
Then save and close the file and wait for the change to take effect.
The next step is:
Authentication using SSH key
When accessing a server through SSH, it is particularly important to authenticate with the SSH key. This adds extra protection to the server, ensuring that only those who have the key can access the server.
Run the following command on the local machine to generate the SSH key:
You will see the output below, ask which file you want to write the key to, and set a password:
Generating public/private RSA key pair. Enter file in which to save the key (/root/.ssh/id_rsa): My_key Enter passphrase (empty for no passphrase): Enter Same passphrase again: Your identification has been saved in My_key. Your public key has been saved in my_key.pub. The key fingerprint is: sha256:mqd/pzztrscjzb6mpfjyrr5v1pjlbcgprr5tjnoi20a
When you're done, you get two files:
Next, copy the My_key.pub to the ~/.ssh/authorized_key.
CP My_key.pub ~/.ssh/authorized_keys
Then upload the key to the server using the following command:
scp-p16543 Authorized_keys user@yourserver-ip:/home/user/.ssh/
At this point, you can access the server without a password from this local machine.
Turn off password authentication for SSH
Now that you have an SSH key, it's safer to turn off SSH's password authentication. Open and edit Sshd_config again, as set:
Challengeresponseauthentication no passwordauthentication no usepam No
Turn off Root Login
The following key step is to turn off direct access for root users and use sudo or Su to perform administrator tasks. First you need to add a new user with root permissions, so edit the sudoers file under this path:
It is recommended that you edit the file using a command such as Visudo because it checks for any possible syntax errors before closing the file. This is useful when you have an error editing the file.
Next, give a user root permission. In this article, you use the user sysadmin. Make sure that the user you are using after editing this file is a user that is already on the system. Find the following line:
Root all= (All)
Copy the line, paste it on the next line, and then change root to SysAdmin, as follows:
Root all= (All) all the sysadmin all= (all)
Now explain the meaning of each option in this line:
(1) root (2) all= (3) (All) (4) All
(1) Specify the user
(2) Specify users to use sudo terminal
(3) Specify user roles that the user can assume
(4) The command that this user can use
LCTT: So the above configuration means that the root user can act as any user at any terminal and execute any command. ）
Use this configuration to give users access to some system tools.
At this point, you can safely save the file.
To turn off direct access to root via ssh, you need to open Sshd_configagain and locate the following line:
Then save the file and restart the sshd daemon for the changes to take effect. Execute the following command:
Setting up Firewalls
Firewalls Help filter access ports and prevent logon attempts to use brute force laws. I prefer to use the SCF (Config Server Firewall) This powerful firewall. It uses iptables, is easy to manage, and provides a web interface for users who are not good at entering commands.
To install CSF, log on to the server first and switch to this directory:
Then execute the following command with root permissions:
wget https://download.configserver.com/csf.tgz tar-xzf csf.tgz cd CSF sh install.sh
Just wait for setup to complete, and then edit the CSF configuration file:
By default, CSF runs in test mode. Switch to product mode by setting the value of "testing" to 0.
testing = "0"
The following settings are the ports allowed on the server. In csf.conf, navigate to the following section and modify the port as needed:
# Allow inbound TCP port tcp_in = "20,21,25,53,80,110,143,443,465,587,993,995,16543" # Allow outbound TCP port tcp_out = " 20,21,22,25,53,80,110,113,443,587,993,995,16543 " # Allow inbound UDP port udp_in =" 20,21,53 " # Allow outbound UDP ports # To allow traceroute requests to be made, add 33,434:33,523 ports to the list udp_out = "20,21,53,113,123"
If you want to set it up as needed, it is recommended that you use only those ports that you need to avoid setting a wide range of ports. Also, avoid unsafe ports that use unsafe services. For example, only port 465 and 587来 are allowed to send e-mail, instead of the default SMTP port 25. (LCTT: If your mail server supports SMTPS)
Important : Never forget to allow custom SSH ports.
It is important to allow your IP address to pass through the firewall and not be blocked. The IP address is defined in the following file:
The blocked IP address appears in this file:
Once the change is complete, use this command to reboot the CSF:
The following is part of the Csf.deny file on a server to illustrate that CSF is useful:
220.127.116.11 # Lfd: (sshd) Failed SSH login from 18.104.22.168 (Kr/korea, Republic of/-): 5 at the last 3600 Secs-fri Mar 6 00:30:35 2015 22.214.171.124 # LFD: (sshd) Failed SSH login from 126.96.36.199 (Hk/hong kong/-): 5 in the last 3 SECS-FRI Mar 6 01:06:46 2015 188.8.131.52 # LFD: (sshd) Failed SSH login from 184.108.40.206 (Hk/hong kong/-): 5 In the last 3600 SECS-FRI Mar 6 01:59:04 2015 220.127.116.11 # LFD: (sshd) Failed SSH login from 18.104.22.168 (hk/h Ong kong/-): 5 in the last 3600 SECS-FRI Mar 6 02:48:26 2015 22.214.171.124 # LFD: (sshd) Failed SSH login from 109.1 69.74.58 (gb/united kingdom/mail2.algeos.com): 5 in the last 3600 SECS-FRI Mar 6 03:49:03 2015
You can see that the attempt to login through the violence of the IP address is blocked, it is not the eyes of the heart not annoying Ah!
If an account is not used for a long time, it can be locked to prevent other people from accessing it. Use the following command:
Of course, this account can still be used by the root user (LCTT to switch to this account).
Understanding services on the server
The essence of a server is to provide access to a variety of services. Make the server run only the required services, and turn off services that are not in use. This will not only release some system resources, but also make the server more secure. For example, if you just run a simple server, you obviously don't need an X display or a desktop environment. If you do not need the Windows Network Sharing feature, you can safely close samba.
Use the following command to view services that are started with system startup:
Chkconfig--list | grep "3:on"
If the system is running systemd, execute this command:
Systemctl List-unit-files--type=service | grep enabled
Then, use the following command to turn off the service:
Chkconfig service off or systemctl disable service
In the example above, replace "service" with the name of the services that you really want to stop. Examples are as follows:
Chkconfig httpd off or systemctl disable httpd
The purpose of this article is to cover some common security steps to help you protect your server. You can do more to enhance the protection of the server. Keep in mind that it's your responsibility to keep your server safe, and make the right choices when it comes to maintaining server security, although there's no easy way to do it, and building "perfect" security takes a lot of time and testing until you reach the desired results.
Author: Marin Todorow Translator: Kayguowhu proofreading: Wxy
This article by LCTT original translation, Linux China honor launch
Start building with 50+ products and up to 12 months usage for Elastic Compute Service