Simple security settings After purchasing a Linux VPS server

After we have purchased a VPS or server for a Linux system, the general merchant will give you a root account, and the default password will not be too long, which is not safe. Often customers because of weak password and hacked password caused the VPS server was invaded and used to do bad things.
Therefore, after the launch of the Linux system VPS or server, we need to do some basic security settings.

First, close the SSH password login
First of all, you need to have your own SSH Key, if you use Windows system, you can use Putty under the
PUTTYGEN. Exe
Generate a private key and a public key.
The first step is to run
PUTTYGEN. Exe
In general, we choose the default RSA encryption, the default 1024-bit encryption is sufficient, if you want to secure points, you can choose 2048 or 4,096-bit encryption, red circle:

The second step, click Generate, then the mouse to move around in the blank space
When the progress bar is full, create your SSH Key:

If you want to be more secure, you can set
Key Passphrase
, that is, the password, this password and root password is different, once someone has acquired your key, without the password he can not load your key.
Step three, click
Save Public Key
Save your public key, the entire file as follows

----BEGIN SSH2 public KEY----"showfom-rsa-key-20130701"  Aaaab3nzac1yc2eaaaabjqaaaqeana/  D52FTZ1YNJXNWAJAUHXRDPCWAR8ZFWLDWHEMT64ZQTXRZ65KRXESHFRVND8XN1GKTUQIQMU/d5ffheajfbjosw/n+  MZ58IRZUXDBE34Y/nxy1/iwc6ajz6lx6wt7nndcvoqx8be8j/8sjs7cmfarn3iy+0bsqnon3681+  Hefm7mpoyyqrcvbparfiiezb8tnkfzrkjfrciz87yakkncpedcibykjujy2hcik+y+iptldomj5kqksxstjfquffg+  S3fqj9istu4c7bf3zafd4meupa7p90rrujlj95muw/p/ebwgsmvbnxz/xmq3ol/touo85umbsn44dmsb3neq==----END SSH2 public KEY----

One of the middle so long a string, is your public key, you can put in the server
~/.ssh/authorized_keys
, we should take the following format:

SSH-RSA Aaaab3nzac1yc2eaaaabjqaaaqeana/ d52ftz1ynjxnwajauhxrdpcwar8zfwldwhemt64zqtxrz65krxeshfrvnd8xn1gktuqiqmu/d5ffheajfbjosw/N+  MZ58IRZUXDBE34Y/nxy1/iwc6ajz6lx6wt7nndcvoqx8be8j/8sjs7cmfarn3iy+0bsqnon3681+ hefm7mpoyyqrcvbparfiiezb8tnkfzrkjfrciz87yakkncpedcibykjujy2hcik+y+iptldomj5kqksxstjfquffg+  S3fqj9istu4c7bf3zafd4meupa7p90rrujlj95muw/p/ebwgsmvbnxz/xmq3ol/touo85umbsn44dmsb3neq= = showfom-rsa-key-20130701

Where Ssh-rsa is the type of encryption, showfom-rsa-key-20130701 is a description and can be any text, such as Showfom-notebook
Fourth Step, click
Save Private Key
Generate a private key for Putty, where we Save As
Showfom.ppk
, the entire file is as follows

putty-user-key-file-2:SSH-RsaEncryption:noneComment:ShowfomPublic-lines:4Aaaab3nzac1yc2eaaaabjqaaaibtill54roaeekv95vkr6iez9y0d1ipnnqeyk+Eyhptc7jvtmfl0oiho9s2uqquangmlmzljhxrj3cpz1vzinpfqvtgwykwpepgckgi7/itpnuuz6tkguei5ryaetfgkwf13qc5s8dwlk2fgv7dy5gbsozmhztc+ZTL9JPNNCA5NW==Private-lines:8Aaaagewly9tssiciztupywe/eegd+kh/pbpsunug6mnoaen8ocd5ctsz2ki9lukwgspx0j8f+kmuzu62eikhalgzz+Nvyklche7qfo2aymcuniuym0mgdn5gjxubfduvvtjiaywd282yo0xtjpwn0djf3jmmsrw6pwmwaa6r6palkantaaaaqqclyrycu3eu0gcgw9g2mvlizoh OKYPL2E6HJFPQHVSZE6AKUZPTF/dgmkbfy6dh//0zsohue2jngnsalqygbvt/AAAAQQCARGNL76EXHTR28TRY2PONG8IJ3YN9MCZYG3SDSV8FEGAKRYZ8T5B6XZUF9UYVZ1LIA10I7ULZ63S2HVCZUXTHAAAAQD+Auxn8fuaylroh8ztm14fyy7grwdn7y7+etz8nuvdlvzp9svpd4v5ti9lpqjtiucp0eelcd5i7zxyv2oheu78=Private-mac:ce0968aff198e2c2550704625b23ba7575e6b260

This one
Showfom.ppk
You need to pass the Putty directory
Pageant. Exe
Import so you can log in to your VPS without having to enter the root password.

SSH keys for PS:WINSCP and Putty are generic and only need to be imported once.

But Putty Private Key is not standard, can only be used for Putty or WinSCP, if you use Xshell 4, you need to convert to RSA file, you can
PUTTYGEN. Exe
In the menu above
Conversions
>
Export OpenSSH Key
Mode conversion.
Fifth step, import your Linux VPS or server

If you are local to a Linux desktop environment, it can be done with a simple command:

Ssh-copy-id-i ~/.ssh/id_rsa.pub [email protected]

But most of the users are still Windows users, so I suggest two more simple ways

1. Put your own public key on the https://launchpad.net/website and get an address like Https://launchpad.net/~showfom/+sshkeys, then import your key via the following command

Curl https://launchpad.net/~showfom/+sshkeys > ~/.ssh/authorized_keys

If you do not have an. SSH directory, you can create a new

mkdir . SSH

2, can also write directly to the Authorized_keys file

Cat >>/root/. ssh/authorized_keys<< EOFssh-RSA Aaaab3nzac1yc2eaaaabjqaaaqeana/ d52ftz1ynjxnwajauhxrdpcwar8zfwldwhemt64zqtxrz65krxeshfrvnd8xn1gktuqiqmu/d5ffheajfbjosw/N+  MZ58IRZUXDBE34Y/nxy1/iwc6ajz6lx6wt7nndcvoqx8be8j/8sjs7cmfarn3iy+0bsqnon3681+ hefm7mpoyyqrcvbparfiiezb8tnkfzrkjfrciz87yakkncpedcibykjujy2hcik+y+iptldomj5kqksxstjfquffg+  S3fqj9istu4c7bf3zafd4meupa7p90rrujlj95muw/p/ebwgsmvbnxz/xmq3ol/touo85umbsn44dmsb3neq= = showfom-rsa-key-20130701EOF

In some service providers of the CentOS system, due to the open SELinux, the default is to prohibit the. SSH directory permissions, you can use the following command to remove the limit:

Restorecon-r-v/root/. SSH

If you encounter

Authorized_keys

Permissions issues, you can use the following command to resolve:

chattr -I. Authorized_keys

You can then reboot to open an SSH window and test if you don't need to enter a password to log in with Root.
Sixth step, close SSH password login

To edit an SSH configuration file:

vim/etc/ssh/sshd_config

Found it
#PasswordAuthentication Yes
And instead
Passwordauthentication No
Save, exit, restart SSH service

Under Ubuntu:

/etc/init.d/ssh restart

Under CentOS:

Service sshd Restart

OK, so prohibit SSH password landing is done, this step refused 90% of the intrusion risk, of course, your own private key must be preserved, otherwise stolen but do not need a password to be able to enter your server OH.

Second, install the CSF Firewall shield attempt to invade the server's IP

The CSF firewall is simple to install, with a few commands to handle:

RM -FV csf.tgzwget http://www.configserver.com/free/csf.tgztar -xzf csf.tgzcd CSFshinstall. SH

And then run

Perl /usr/local/csf/bin/csftest.pl

Detect if the installation was successful

To prevent the system from mistakenly masking the local IP, you can modify the/etc/csf/csf.allow and/etc/csf/csf.ignore
The file is added to the whitelist IP you need, and then you can restart the read configuration file with the Csf-r command.

Third, use iptables only to open the regular port
Generally we only need to open 22, 53, 80, 443 these three common open ports, you can use the following command
Empty iptables Default Rule

Iptables-f

Allow 22 ports to enter and return

 $- m State--state established-j ACCEPT

Allow 53 ports, typically used as DNS service

 - -j ACCEPT

Allow native access to native

127.0. 0.1 127.0. 0.1 -127.0. 0.1 127.0. 0.1 -j ACCEPT

Allows all IP access to 80 and 443 ports, typically for HTTP and HTTPS purposes

0/0 - M State--state established-0/0 443 -443 -M state--state Established-j ACCEPT

Save Configuration

Iptables-save >/etc/sysconfig/iptables

Reload Iptables

Iptables-l

Four, install Fail2ban mask and report IP scanning SSH port

There are a lot of energetic guys who will scan ssh password all day long, of course, directly close SSH password landing can be prevented, but in order to give them a lesson, Can install Fail2ban, shielding, but also can automatically write a report to the IP ISP.

Installation under CentOS:
Import Epel Source:

6  +  -UVH http://download.fedoraproject.org/pub/epel/6/i386/epel-release-6-8.noarch.rpm 6  -  -UVH http://download.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm #安装 Fail2ban Yum Install Fail2ban CP /etc/fail2ban/jail.conf/etc/fail2ban/jail.localservice fail2ban start

Ubuntu/debian under Installation:

Install fail2ban-y

By viewing
/var/log/fail2ban.log
File to know which of the excess-energy guys are scanning your SSH all day.

Postscript
Because a lot of recent customers VPS or server was hacked, the reason is to use a very simple root password, so consider selling rogue VPS, directly to do a shielded password system, users buy the time to submit their own SSH key, or the system assigned you an SSH key, so it will be more secure 。 The foreign Amazon EC2, Digitalocean, and hpcloud all have the means to import their SSH Key and shield the password by default, which greatly increases the security.

Reprint Please specify: Tsutenkaku tower? Simple security settings After purchasing a Linux VPS server

Simple security settings After purchasing a Linux VPS server