A Basic Guide to Securing a Linux Server

1. Initial Setup:

1. Choose a Strong Password: Always start with a strong password for your root user and any other users. Use a mix of upper-case, lower-case, numbers, and special characters.
2. Disable Root Login: It’s best to disable direct root login to prevent any unauthorized access. Use a non-root user for everyday tasks and elevate privileges when needed.

2. Set Up a Firewall:

1. Install UFW (Uncomplicated Firewall):

sudo apt install ufw

2. Enable UFW:

sudo ufw enable

3. Allow Necessary Ports:

sudo ufw allow 22/tcp # For SSH

(Replace 22 with your SSH port if you’ve changed it.)

---

3. SSH Hardening:

1. Change the Default SSH Port: Update the port number in /etc/ssh/sshd_config.
2. Disable Root SSH Access: In /etc/ssh/sshd_config, set:

PermitRootLogin no

3. Use Key-based Authentication: Disable password authentication and use SSH keys for a more secure method.

PasswordAuthentication no

4. Limit User Access: Allow only specific users to access via SSH by using the AllowUsers directive in the SSH configuration file.
5. Implement Fail2ban: This tool helps prevent brute-force attacks by banning IP addresses that have too many failed login attempts.

4. Update Regularly:

1. Check for Updates:

sudo apt update && sudo apt upgrade

Regularly updating ensures you get the latest security patches.

5. Install a Malware Scanner:

1. ClamAV is a free antivirus tool. Install and run it regularly.

sudo apt install clamav sudo freshclam # Update virus database sudo clamscan -r /home # Scan the home directory

6. Monitor System Activity:

1. Install and Use htop or top: These tools help monitor system resources and processes in real-time.
2. Audit System with auditd: It collects auditing data based on pre-defined rules.
3. Sysstat: Provides performance and usage activity stats.

7. Secure Shared Memory:

1. Add the following line to /etc/fstab:

tmpfs /run/shm tmpfs defaults,noexec,nosuid 0 0

Then, remount shared memory:

sudo mount -o remount /run/shm

8. Disable Unused Services and Protocols:

1. Check Running Services:

systemctl list-unit-files --state=enabled

2. Disable Unwanted Services: For instance, to disable telnet (which you shouldn’t be using anyway due to security concerns):

sudo systemctl disable telnet

9. Implement AppArmor or SELinux:

1. These tools provide Mandatory Access Control (MAC) system which restricts programs’ capabilities.

10. Backup Regularly:

1. Use Tools like rsync or tar: Regular backups ensure that even if there’s a compromise, you can restore your system.

11. Other Recommendations:

1. Use HTTPS: If you’re running a web server, always use HTTPS. Tools like Let’s Encrypt provide free SSL certificates.
2. Limit User Privileges: Don’t give more privileges than necessary to users and applications.
3. Check for Rootkits: Tools like rkhunter or chkrootkit can be used to scan for rootkits.
4. Database Security: If running a database, bind it to localhost (127.0.0.1) if it’s only accessed locally. Always set strong database passwords.
5. Regular Audits: Perform regular security audits to identify and fix vulnerabilities.

Remember, no system can ever be 100% secure, but by following best practices and keeping abreast of the latest threats and solutions, you can significantly reduce your risk.

Always stay informed about the latest security advisories related to the software and services you are running on your server.