CSEC_PUBLIC/How-To-Secure-A-Linux-Server
1
0
Fork 0
mirror of https://github.com/imthenachoman/How-To-Secure-A-Linux-Server.git synced 2026-08-19 14:22:26 +02:00
Code Issues Packages Projects Releases Wiki Activity
273 Commits 1 Branch 0 Tags
21492c25073b8784d784e7ebfa18c40529a5b641
Commit Graph
223 Commits
Author SHA1 Message Date
ShiroKSH d89ad8ba55 docs: fix hardening guide commands 2026-07-09 18:04:39 +03:00
Arthur McLain f570b110cf Fix a broken link to fail2ban 2026-07-01 23:33:10 +02:00
moltenbit 5abb8c77cf Update SSH client alive settings in README 
Fix SSH ClientAlive settings and add TCPKeepAlive justification 

- Change ClientAliveCountMax example from 0 to 3 (OpenSSH default and CIS benchmark recommended). A value of 0 disables connection termination entirely, allowing   dead sessions to persist indefinitely (resource exhaustion risk). 

- Change ClientAliveInterval example from 300 to 15. With CountMax 3, unresponsive clients now disconnect after ~45s. (CIS benchmark recommended) 

- Add comment explaining why TCPKeepAlive is set to no (spoofable, runs outside the encrypted channel unlike ClientAlive). 

- Update sshd -T example output to reflect new values. 

Closes #103
 2026-03-05 14:25:15 +01:00
moltenbit 7f575e6284 Revise Lynis installation commands for Debian 
Updated installation instructions for Lynis on Debian systems to use GPG keyrings.
 2026-03-05 13:18:51 +01:00
moltenbit 57f7c8c437 Remove Protocol 2 line in ssh config 
Fixes #118 
Protocol option does not exist anymore, throws errors and suggests that a Protocol 1 still exists, which it doesn't.
 2026-03-05 12:41:43 +01:00
moltenbit 75e4db1d00 Remove tls_force_sslv3 and tls_min_dh_prime_bits 
#85 
Removed deprecated TLS configuration options.
 2026-03-05 12:25:33 +01:00
moltenbit 522b606c4e Add note about ntp in Debian 13+ 
Update instructions for NTP client configuration on Debian 13+.
 2026-03-05 11:02:09 +01:00
moltenbit bfa59bdb01 Add systemd-timesyncd setup instructions for Debian 13 
Added instructions for using systemd-timesyncd on Debian 13 and later, including enabling NTP synchronization, configuring trusted NTP servers, and checking synchronization status.
 2026-03-05 10:56:55 +01:00
moltenbit d22bb50c64 Fix typo in README regarding iptables logs 2026-03-05 08:40:35 +01:00
moltenbit ff39dc4edc Merge pull request #126 from Triveri/fix/broken-link-psad-iptables-logs 
Fix broken link in PSAD section
 2026-03-05 08:39:15 +01:00
moltenbit 3ddb700f90 Make RSA key size requirement optional 
Make RSA key size requirement optional and added explanation.
 2026-03-05 08:28:05 +01:00
DennisNikolay 20393606b6 Added RequiredRSASize to sshd_config (#123) 
Enforces a minimum RSA key size of 3072, as recommended by various standards bodies, as detailed here:

https://www.keylength.com/en/compare/
 2026-03-05 08:18:55 +01:00
Miquel TA a01b455d04 Added a brief explanation about ufw limit 2026-03-04 18:28:30 +01:00
Miquel TA e0f0e874f9 Update SSH connections explanation in README 
Clarify the explanation for allowing SSH connections.
 2026-03-04 18:25:09 +01:00
Triveri Samuele 1bf40ead23 fix: fixed broken link in PSAD section 2025-02-23 01:24:24 +01:00
Laurence 356a69ae58 enhance: Spell check 2024-10-16 13:32:23 +01:00
Laurence bf8691c29c enhance: Try to fix tip 2024-10-16 13:28:02 +01:00
Laurence 8f8d99ee6f enhance: Try to fix tip 2024-10-16 13:27:10 +01:00
Laurence 59d947c4f2 enhance: Try to fix tip 2024-10-16 13:25:29 +01:00
Laurence b6be7dcbc8 enhance: Try to fix tip 2024-10-16 13:24:19 +01:00
Laurence b962cdd0f0 enhance: Try to fix tip 2024-10-16 13:23:05 +01:00
Laurence 7f26deb683 enhance: Try to fix tip 2024-10-16 13:21:53 +01:00
Laurence b834836045 enhance: fix tips 2024-10-15 22:11:29 +01:00
Laurence 928eb2de88 enhance: fix tips 2024-10-15 22:09:41 +01:00
Laurence 0b1f1cbf6b enhance: Add crowdsec section 2024-10-15 22:08:06 +01:00
Kevin Wang c836cbce79 Update README.md 
Updated the full path for ntp.conf file.
 2024-06-28 12:04:05 -04:00
IMTheNachoMan 81ae738ffd Merge pull request #114 from jxdv/readme-fix 
README improvements
 2024-04-11 21:57:35 -04:00
IMTheNachoMan f34170e867 Update README.md 
https://github.com/imthenachoman/How-To-Secure-A-Linux-Server/issues/115
 2024-02-24 09:03:02 -05:00
jxdv c2f8f2e42d README improvements 2024-01-08 17:43:44 +01:00
IMTheNachoMan 437b59c515 Merge pull request #102 from hellresistor/AddDoublePasswordSec 
Add panic/secondary password security
 2023-12-04 17:39:07 -05:00
mbit 74f1c2db8a updated references to my changed username 2023-12-04 20:31:19 +01:00
sysadt 3f20de98ba Merge branch 'imthenachoman:master' into master 2023-11-08 22:09:16 +01:00
IMTheNachoMan fe62dc3a11 Update README.md 
https://github.com/imthenachoman/How-To-Secure-A-Linux-Server/issues/106
 2023-10-01 22:06:26 -04:00
hellresistor 2a30412a28 Update README.md 2023-06-27 21:01:18 +01:00
sysadt 6832a167ec correction of link in TOC 2023-06-27 21:57:58 +02:00
sysadt d440add836 added section for Ansible playbooks 2023-06-27 21:56:59 +02:00
hellresistor c80f0c664f Update README.md 
Add PAnic/Secondary password
 2023-06-27 20:55:25 +01:00
sysadt cb61987ffb Added references to Ansible playbooks 2023-06-27 21:39:17 +02:00
Nicolas Hedger dc647d7ee1 Fix typo 2023-05-21 09:10:04 +02:00
IMTheNachoMan cc74e3e5a6 Update README.md 2023-04-29 13:30:04 -04:00
IMTheNachoMan 957ac09544 Merge pull request #94 from sysadt/master 
Changes to ufw
 2023-03-23 22:28:11 -04:00
IMTheNachoMan cf7b5681ed Merge pull request #96 from Bojan023/patch-1 
Add cli command to check current sudoers on debian
 2023-03-23 22:27:07 -04:00
IMTheNachoMan 87391f5eab clarified CIS recommendation 
https://github.com/imthenachoman/How-To-Secure-A-Linux-Server/issues/97
 2023-03-23 22:25:58 -04:00
Bojan Bogojevic 17bc162d48 Add cli command to check current sudoers 2023-03-22 12:12:49 +01:00
sysadt 6ec89c07c8 wording to "deleting ufw rule" 
title
 2023-02-22 22:20:07 +01:00
sysadt 0df0fdbe28 Changes to ufw 
1. added section about deleting ufw rules
2. changed wording in the ufw comments from "allow traffic out on port" to "allow traffic out to port". IMO the "on" sounds like opening source ports
3. added mail to common use-cases with ports 25 and 587
 2023-02-22 22:16:02 +01:00
IMTheNachoMan 8f78e027e9 Merge pull request #91 from SuperLanceur/patch-1 
Changed the order of settings in #iptables-intrusion-detection-and-pr…
 2023-02-04 22:56:07 -05:00
Jack A 3a61bffc21 Fix a really small typo of prerequisite 
Loving the guide man
 2023-02-04 16:15:59 -05:00
SuperLanceur db3625ab21 Changed the order of settings in #iptables-intrusion-detection-and-prevention-with-psad 
When looking for these settings, EXPECT_TCP_OPTIONS was between HOSTNAME and ENABLE_PSADWATCHD in the file, but this guide put it at the end of the list. Changing that so that it's more consistent
 2022-12-27 05:51:09 +01:00
IMTheNachoMan 1c11d729ca Update README.md 2022-08-14 00:17:56 -04:00