Security
Security Hardening
Advanced security hardening guide for your VPS. Learn SSH hardening, firewall configuration, intrusion detection, and security best practices.
Prerequisites
- Root or sudo access to your VPS
- Backup of current system configuration
- SSH key pair for secure access
- Understanding of Linux system administration
- Email server configured for alerts
SSH Security Hardening
SSH is often the primary attack vector for servers. Proper SSH configuration is crucial for server security.
SSH Security Best Practices:
- Disable password authentication
- Use SSH keys only
- Change default SSH port
- Disable root login
- Use fail2ban for brute force protection
# Backup SSH configuration
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup
# Edit SSH configuration
sudo nano /etc/ssh/sshd_config
# Essential security settings:
# Port 2222 # Change from default 22
# PermitRootLogin no
# PasswordAuthentication no
# PubkeyAuthentication yes
# AuthorizedKeysFile .ssh/authorized_keys
# PermitEmptyPasswords no
# MaxAuthTries 3
# MaxStartups 3
# AllowUsers yourusername
# X11Forwarding no
# Test configuration
sudo sshd -t
# Restart SSH service
sudo systemctl restart sshd
# Verify SSH is running
sudo systemctl status sshdFirewall Configuration
A properly configured firewall is your first line of defense against network-based attacks.
Firewall Principles:
- Default deny policy
- Allow only necessary services
- Use stateful inspection
- Regular rule audits
- Log suspicious traffic
# UFW configuration for maximum security
sudo ufw --force reset
sudo ufw default deny incoming
sudo ufw default allow outgoing
# Allow SSH (custom port)
sudo ufw allow 2222/tcp
# Allow web services if needed
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
# Allow specific IP ranges only (if applicable)
# sudo ufw allow from 192.168.1.0/24 to any port 22
# Enable UFW
sudo ufw enable
# Check status
sudo ufw status verbose
# Log suspicious traffic
sudo ufw logging highUser Account Security
Proper user account management prevents unauthorized access and limits damage from compromised accounts.
Account Security Measures:
- Remove unused accounts
- Use strong passwords
- Implement password policies
- Use sudo instead of root
- Monitor user activity
# Check for users with empty passwords
sudo awk -F: '($2 == "") {print}' /etc/shadow
# Lock unused system accounts
sudo passwd -l daemon
sudo passwd -l bin
sudo passwd -l sys
sudo passwd -l games
# Create new user with sudo privileges
sudo useradd -m -s /bin/bash newuser
sudo usermod -aG sudo newuser
sudo passwd newuser
# Configure password policies
sudo nano /etc/login.defs
# Set password aging:
# PASS_MAX_DAYS 90
# PASS_MIN_DAYS 7
# PASS_WARN_AGE 7
# Configure PAM for password complexity
sudo nano /etc/pam.d/common-password
# Add password complexity requirements
# password requisite pam_pwquality.so retry=3 minlen=12
# Check for users with UID 0 (root privileges)
awk -F: '($3 == "0") {print}' /etc/passwdSystem Updates & Patch Management
Regular security updates are critical for protecting against known vulnerabilities.
Update Strategy:
- Enable automatic security updates
- Test updates in staging environment
- Schedule updates during maintenance windows
- Monitor for security advisories
- Keep kernel updated
# Enable automatic security updates
sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure unattended-upgrades
# Configure update behavior
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades
# Enable security updates:
# "${distro_id}:${distro_codename}-security";
# Kernel hardening
sudo apt install linux-image-hardened-amd64 -y
# Check for security updates
sudo apt list --upgradable | grep security
# Monitor security advisories
sudo apt install apticron -y
sudo nano /etc/apticron/apticron.conf
# Configure email notifications
# EMAIL="admin@example.com"Intrusion Detection & Monitoring
Intrusion detection systems help identify and respond to security threats in real-time.
Security Monitoring Tools:
- Fail2Ban for brute force protection
- OSSEC for host-based intrusion detection
- AIDE for file integrity monitoring
- Logwatch for log analysis
- RKHunter for rootkit detection
# Install Fail2Ban
sudo apt install fail2ban -y
sudo systemctl enable fail2ban
sudo systemctl start fail2ban
# Configure custom jails
sudo nano /etc/fail2ban/jail.local
# Example SSH jail:
# [sshd]
# enabled = true
# port = 2222
# filter = sshd
# logpath = /var/log/auth.log
# maxretry = 3
# bantime = 86400
# Install RKHunter for rootkit detection
sudo apt install rkhunter -y
sudo rkhunter --update
sudo rkhunter --propupd
sudo rkhunter --check
# Install AIDE for file integrity
sudo apt install aide -y
sudo aideinit
sudo mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db
# Check file integrity
sudo aide --checkNetwork Security
Network-level security protects against various attacks and unauthorized access attempts.
Network Security Measures:
- Disable unnecessary services
- Configure TCP wrappers
- Implement network segmentation
- Use VPN for remote access
- Monitor network traffic
# Disable unnecessary services
sudo systemctl disable avahi-daemon
sudo systemctl disable cups
sudo systemctl disable bluetooth
# Configure TCP wrappers
sudo nano /etc/hosts.allow
# Allow SSH from specific IPs:
# sshd: 192.168.1.0/24
sudo nano /etc/hosts.deny
# Deny all by default:
# ALL: ALL
# Install and configure OpenVPN
sudo apt install openvpn easy-rsa -y
# Generate certificates
make-cadir ~/openvpn-ca
cd ~/openvpn-ca
./easyrsa init-pki
./easyrsa build-ca
# Monitor network connections
sudo netstat -tlnp
sudo ss -tlnp
# Check for open ports
sudo nmap -sV localhostSecurity Auditing & Compliance
Regular security audits help identify vulnerabilities and ensure compliance with security standards.
Audit Tools:
- Lynis for system auditing
- OpenVAS for vulnerability scanning
- Chkrootkit for rootkit detection
- Log analysis tools
- Compliance checking scripts
# Install Lynis security auditing tool
sudo apt install lynis -y
# Run security audit
sudo lynis audit system
# Install chkrootkit
sudo apt install chkrootkit -y
sudo chkrootkit
# Check system file permissions
sudo find /etc -type f -perm -o+w
sudo find /var -type f -perm -o+w
# Audit sudo usage
sudo cat /var/log/auth.log | grep sudo
# Check for world-writable files
sudo find / -type f -perm -o+w ! -path "/proc/*" 2>/dev/null
# Verify system integrity
sudo debsums -c
sudo rpm -Va # For CentOS/RHEL
# Security audit script
sudo nano /usr/local/bin/security_audit.sh
#!/bin/bash
echo "=== Security Audit Report ==="
echo "Date: $(date)"
echo ""
echo "=== Open Ports ==="
netstat -tlnp
echo ""
echo "=== Failed Login Attempts ==="
grep "Failed password" /var/log/auth.log | wc -l
echo ""
echo "=== Users with Shell Access ==="
awk -F: '/bash|sh/ {print $1}' /etc/passwdContents
Related Docs
Need Help?
Can't find what you're looking for? Our support team is here to help.