The most basic security policy for Linux servers

1. Linux SSH Security Policy 1: Shut down the majority of hosts attacked on the unrelated port network, which are targeted by hackers who use scanning tools for a wide range of scanning. Therefore, in order to avoid being scanned, all ports, such as Web, FTP, and SSH, should be disabled. It is worth mentioning that I strongly recommend that you disable icmp ports and set rules to discard icmp packets. In this way, if someone else cannot Ping your server, the threat will be reduced by half. To discard an icmp packet, add the following to iptables:-a input-p icmp-j DROP2 and Linux SSH Security Policy 2: Change the default SSH port of the SSH port to 22. We strongly recommend that you change it to 10000 or above. In this way, the chances of other users scanning ports are also greatly reduced. Modification Method: # edit/etc/ssh/ssh_configvi/etc/ssh/ssh_config # Add a new Port value under Host. Take 18439 as an example (the same below): Port 22 Port 18439 # edit/etc/ssh/sshd_configvi/etc/ssh/sshd_config # Add a new Port value Port 22 Port 18439 # Save, restart the SSH service: service sshd restart I have set two ports here, mainly to prevent modification errors from causing SSH login failure again. Change the connection Port of your SSH client (such as Putty) and test the connection. If the new Port can be connected successfully, edit the above two files and delete the configuration of Port 22. If the connection fails, use Port 22 to connect and then reconfigure it. After the port is successfully set, note that port 22 should be deleted from iptables, port 18439 of the new configuration should be added, and iptables should be restarted. If the SSH logon password is weak, you should set a complicated password. On the Google Blog, I wrote an article emphasizing password security: Does your password pass the test? 3. Linux SSH Security Policy 3: Restrict IP address logon if you can connect to your server using a fixed IP address, you can set to allow only a specific IP address to log on to the server. For example, I log on to the server through my own VPN. Set as follows: # edit/etc/hosts. allowvi/etc/hosts. allow # For example, allow only 123.45.67.89 to log on to sshd: 123.45.67.894. Linux SSH Security Policy 4: using certificates to log on to SSH is more secure than using passwords to log on to SSH. Tap water coffee has written a detailed tutorial, with the consent of its Reprinted as follows: Configure an SSH certificate for CentOS login verification help the company's network management Remote Detection of the mail server, a CentOS 5.1, use OpenSSH for remote management. When checking the security log, we found that there were a bunch of IP addresses every day to guess the password over the past few days. It seems that it is better to change the logon authentication method to certificate authentication. In case of protection, a VNC is enabled temporarily, so that sshd cannot be restarted without configuration. (Later I found it redundant, as long as a putty is enabled first, don't close it.) The following is a simple procedure: 1) Add a maintenance account: msa2) and then su-msa3) ssh-keygen-t rsa specifies the Key Path and password, that is, in/home/msa /. generate the public key and private key in ssh/: id_rsa id_rsa.pub4) cat id_rsa.pub> authorized_keys: Why is this file generated? This is what is written in sshd_config. Then chmod 400 authorized_keys will be slightly protected. 5) Use psftp to pull id_rsa back to the local machine, and then remove id_rsa and id_rsa.pub on the server. 6) Configure/etc/ssh/sshd_configProtocol 2 ServerKeyBits 1024 PermitRootLogin no # disable root login, it has nothing to do with this article, plus security # There is nothing to change in the following three lines, the default # comment is removed on the line RSAAuthentication yesPubkeyAuthentication yesAuthorizedKeysFile. ssh/authorized_keysPasswordAuthentication noPermitEmptyPasswords no7) Restart sshd/sbin/service sshd restart8) convert the Certificate Format, migrate putty to run puttygen, convert id_rsa to putty ppk Certificate file 9) Configure putty login in In connection -- SSH -- Auth, Click Browse and select the certificate you just converted. Then fill in the auto login username in connection-Data. For example, if you are happy, you can save the Server IP address in the session of the msa. 10) When you do this, it is very likely that there will be an empty joy. At this time, I am eager to log on. Maybe I cannot log on: No supported authentication methods available. Now I can modify sshd_config and temporarily change PasswordAuthentication no: passwordAuthentication yes and Restart sshd. you can log on successfully. After logging out, change the value of PasswordAuthentication to no and Restart sshd. After you log on, you will be asked about the password of your key file, and you will be able to log in happily. For the psftp command, add the-I parameter and specify the Certificate file path. If you modify the preceding configuration on a remote server, be sure to exercise caution in each step and avoid errors. If the configuration is incorrect and the SSH connection fails, the problem may be solved. Basically, after the above four points are configured, SSH access in Linux is safer. Of course, security and insecurity are relative. You should regularly check the server log to detect and eliminate potential risks in time.