CSEC_PUBLIC/How-To-Secure-A-Linux-Server
1
0
Fork 0
mirror of https://github.com/imthenachoman/How-To-Secure-A-Linux-Server.git synced 2025-12-06 17:22:53 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source 
#38 #37 #36
This commit is contained in:
IMTheNachoMan
2020-12-14 18:23:05 -05:00
parent 1747d09f2c
commit 313adbf770
1 changed files with 19 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
README.md
View File

@@ -455,7 +455,7 @@ SSH is a door into your server. This is especially true if you are opening ports
1. Edit `/etc/ssh/sshd_config` then find and edit or add these settings that should be applied regardless of your configuration/setup: 1. Edit `/etc/ssh/sshd_config` then find and edit or add these settings that should be applied regardless of your configuration/setup:
**Note**: SSH does not like duplicate contradicting settings. For example, if you have `ChallengeResponseAuthentication no` and then `ChallengeResponseAuthentication yes`, SSH will respect the first one and ignore the second. Your `/etc/ssh/sshd_config` file may already have some of the settings/lines below. To avoid issues you will need to manually go through your `/etc/ssh/sshd_config` file and address any duplicate contradicting settings. (If anyone knows a way to programatically do this I would [love to hear how](#contacting-me).) **Note**: SSH does not like duplicate contradicting settings. For example, if you have `ChallengeResponseAuthentication no` and then `ChallengeResponseAuthentication yes`, SSH will respect the first one and ignore the second. Your `/etc/ssh/sshd_config` file may already have some of the settings/lines below. To avoid issues you will need to manually go through your `/etc/ssh/sshd_config` file and address any duplicate contradicting settings.
``` ```
######################################################################################################## ########################################################################################################
@@ -539,6 +539,12 @@ SSH is a door into your server. This is especially true if you are opening ports
Check `man sshd_config` for more details what these settings mean. Check `man sshd_config` for more details what these settings mean.
1. Make sure there are no duplicate settings that contradict each other. The below command should not have any output.
```bash
awk 'NF && $1!~/^(#|HostKey)/{print $1}' /etc/ssh/sshd_config | sort | uniq -c | grep -v ' 1 '
```
1. Restart ssh: 1. Restart ssh:
``` bash ``` bash
@@ -941,6 +947,8 @@ To quote https://linux-audit.com/linux-system-hardening-adding-hidepid-to-proc/:
> When looking in `/proc` you will discover a lot of files and directories. Many of them are just numbers, which represent the information about a particular process ID (PID). By default, Linux systems are deployed to allow all local users to see this all information. This includes process information from other users. This could include sensitive details that you may not want to share with other users. By applying some filesystem configuration tweaks, we can change this behavior and improve the security of the system. > When looking in `/proc` you will discover a lot of files and directories. Many of them are just numbers, which represent the information about a particular process ID (PID). By default, Linux systems are deployed to allow all local users to see this all information. This includes process information from other users. This could include sensitive details that you may not want to share with other users. By applying some filesystem configuration tweaks, we can change this behavior and improve the security of the system.
**Note**: This may break on some `systemd` systems. Please see [https://github.com/imthenachoman/How-To-Secure-A-Linux-Server/issues/37](https://github.com/imthenachoman/How-To-Secure-A-Linux-Server/issues/37) for more information.
#### Goals #### Goals
- `/proc` mounted with `hidepid=2` so users can only see information about their processes - `/proc` mounted with `hidepid=2` so users can only see information about their processes
@@ -1752,12 +1760,12 @@ Fail2ban monitors the logs of your applications (like SSH and Apache) to detect
1. In the above we tell fail2ban to use the ufw as the `banaction`. Fail2ban ships with an action configuration file for ufw. You can see it in `/etc/fail2ban/action.d/ufw.conf` 1. In the above we tell fail2ban to use the ufw as the `banaction`. Fail2ban ships with an action configuration file for ufw. You can see it in `/etc/fail2ban/action.d/ufw.conf`
1. Enable fail2ban and the jail for SSH: 1. Enable fail2ban:
``` bash ``` bash
sudo fail2ban-client start sudo fail2ban-client start
sudo fail2ban-client reload sudo fail2ban-client reload
sudo fail2ban-client add sshd sudo fail2ban-client add sshd # This may fail on some systems if the sshd jail was added by default
``` ```
1. To check the status: 1. To check the status: