Secure you Debian Server - Revision history

Admin: /* Harden the SSH Daemon */

2017-03-03T16:54:05Z

Harden the SSH Daemon

← Older revision		Revision as of 18:54, 3 March 2017
Line 377:		Line 377:
	# Use these options to restrict which interfaces/protocols sshd will bind to		# Use these options to restrict which interfaces/protocols sshd will bind to
	#ListenAddress ::		#ListenAddress ::
	#ListenAddress 0.0.0.0		ListenAddress 0.0.0.0
	Protocol 2		Protocol 2
	# HostKeys for protocol version 2		# HostKeys for protocol version 2
Line 457:		Line 457:
	# and ChallengeResponseAuthentication to 'no'.		# and ChallengeResponseAuthentication to 'no'.
	UsePAM yes		UsePAM yes

	~~# Listen only to the IPv4 protocol for connections by uncommenting this~~
	~~AddressFamily inet~~
	</syntaxhighlight>		</syntaxhighlight>
	</div>		</div>

2017-03-01T11:57:50Z

Create and use a non-root user account

← Older revision		Revision as of 13:57, 1 March 2017
Line 349:		Line 349:
	</div>		</div>
	</blockquote>		</blockquote>

	~~==== Disable account login without disabling the account ====~~

	~~<syntaxhighlight lang="xml" line>usermod --expiredate 1 [LOGIN]</syntaxhighlight>~~

	~~Will let sudoers login to the account linke this:~~
	~~<syntaxhighlight lang="xml" line>sudo su - [LOGIN]</syntaxhighlight>~~

	=== Make SSH Access more secure ===		=== Make SSH Access more secure ===

2017-03-01T11:56:53Z

Create and use a non-root user account

← Older revision		Revision as of 13:56, 1 March 2017
Line 349:		Line 349:
	</div>		</div>
	</blockquote>		</blockquote>

			==== Disable account login without disabling the account ====

			<syntaxhighlight lang="xml" line>usermod --expiredate 1 [LOGIN]</syntaxhighlight>

			Will let sudoers login to the account linke this:
			<syntaxhighlight lang="xml" line>sudo su - [LOGIN]</syntaxhighlight>

	=== Make SSH Access more secure ===		=== Make SSH Access more secure ===

2017-02-22T11:19:45Z

Brute force SSH Login Protection

← Older revision		Revision as of 13:19, 22 February 2017
Line 506:		Line 506:
	</div>		</div>
	</blockquote>		</blockquote>
			Configure it to your needs: http://www.fail2ban.org/wiki/index.php/Main_Page

	Inspiration was found at http://www.linode.com/docs/security/securing-your-server/		Inspiration was found at http://www.linode.com/docs/security/securing-your-server/

2017-02-22T11:00:59Z

Brute force SSH Login Protection

@@ Line 468: / Line 468: @@
 ==== Brute force SSH Login Protection ====
 <blockquote>
 <div class="toccolours mw-collapsible mw-collapsed">
 <div class="mw-collapsible-content">
-<syntaxhighlight lang="xml" line>
+<syntaxhighlight lang="xml" line>new_user@pulspc:~$ sudo apt-get -y install fail2ban
+Reading package lists... Done
 </syntaxhighlight>
 </div>

2017-02-22T10:56:10Z

Make SSH Access more secure

← Older revision		Revision as of 12:56, 22 February 2017
Line 464:		Line 464:
	</div>		</div>
	</blockquote>		</blockquote>
	~~Restart~~ the SSH daemon ''sudo systemctl restart sshd''		Remember to restart the SSH daemon: ''sudo systemctl restart sshd''

	==== Brute force SSH Login Protection ====		==== Brute force SSH Login Protection ====

2017-02-22T10:55:25Z

Harden the SSH Daemon

@@ Line 361: / Line 361: @@
 ==== Harden the SSH Daemon ====
 <blockquote>
 <div class="toccolours mw-collapsible mw-collapsed">
 <div class="mw-collapsible-content">
-<syntaxhighlight lang="xml" line>
+<syntaxhighlight lang="xml" line># Package generated configuration file
 </syntaxhighlight>
 </div>
 </div>
 </blockquote>
 ==== Brute force SSH Login Protection ====

2017-02-22T10:38:46Z

Install authentication key-pair

← Older revision		Revision as of 12:38, 22 February 2017
Line 354:		Line 354:
	==== Install authentication key-pair ====		==== Install authentication key-pair ====

	~~<blockquote>~~		The crypto key-pairs is created on your local workstation.
	~~<div class="toccolours mw~~-~~collapsible mw-collapsed">~~
	~~<div class="mw-collapsible-content">~~
	~~<syntaxhighlight lang="xml" line>~~

	</~~syntaxhighlight>~~		Follow the guide that fit your workstation:
	</~~div>~~		* Linux / OS X : https://www.linode.com/docs/security/securing-your-server/#create-an-authentication-key-pair
	</~~div>~~		* Windows : https://www.linode.com/docs/security/use-public-key-authentication-with-ssh#windows-operating-system
	</~~blockquote>~~

	==== Harden the SSH Daemon ====		==== Harden the SSH Daemon ====

2017-02-22T10:14:34Z

Create and use a non-root user account

← Older revision		Revision as of 12:14, 22 February 2017
Line 192:		Line 192:
	* It is not a good idea to use the ''root'' account all the time. It is so powerful that even the smallest mistake can have devastating results if executed as ''root''. Logging in as ''root'' directly is also considered bad practice so we will fix that now.		* It is not a good idea to use the ''root'' account all the time. It is so powerful that even the smallest mistake can have devastating results if executed as ''root''. Logging in as ''root'' directly is also considered bad practice so we will fix that now.

			<blockquote>
	<div class="toccolours mw-collapsible mw-collapsed">		<div class="toccolours mw-collapsible mw-collapsed">
	The 7 steps:		The 7 steps:
Line 347:		Line 348:
	</div>		</div>
	</div>		</div>
			</blockquote>

	=== Make SSH Access more secure ===		=== Make SSH Access more secure ===

2017-02-22T10:13:51Z

Create and use a non-root user account

← Older revision		Revision as of 12:13, 22 February 2017
Line 192:		Line 192:
	* It is not a good idea to use the ''root'' account all the time. It is so powerful that even the smallest mistake can have devastating results if executed as ''root''. Logging in as ''root'' directly is also considered bad practice so we will fix that now.		* It is not a good idea to use the ''root'' account all the time. It is so powerful that even the smallest mistake can have devastating results if executed as ''root''. Logging in as ''root'' directly is also considered bad practice so we will fix that now.

			<div class="toccolours mw-collapsible mw-collapsed">
			The 7 steps:
			<div class="mw-collapsible-content">
	1. The ''sudo'' feature is not installed by default on Debian so we will do this first, since we rely heavily on this command when logging in as a "normal" user that needs to do stuff that requires root privileges.		1. The ''sudo'' feature is not installed by default on Debian so we will do this first, since we rely heavily on this command when logging in as a "normal" user that needs to do stuff that requires root privileges.
	<blockquote>		<blockquote>
Line 342:		Line 345:
	</div>		</div>
	</blockquote>		</blockquote>
			</div>
			</div>

	=== Make SSH Access more secure ===		=== Make SSH Access more secure ===