--- updatedAt: 2022-12-07T21:46:14.158Z layout: post title: Linux VPS Hardening subheading: Initializing a secure environment slug: linux-vps-hardening date: 2022-05-24 author: Charles author_image: /uploads/c_avatar_30ba895a14.webp banner_image: /uploads/linux_admin_0def8999f2.webp banner_image_description: The back of a black hoodie hacking at software category: Devops tags: Linux, VPS, SSL, Security, ---
Administration of a virtual private Linux server (VPS) without a GUI cpanel is the only way to go. Going through any graphical user interface (GUI) to run critical services for your company is like playing the telephone game. Securing our environment begins at the terminal & from terminal experience we create a deeper learning experience for ourselves and build confidence along the way.
This article will extrapolate on initializing a Ubuntu Linux VPS for the first time and how we secure our environment through the terminal. No Windows or MacOS pancakes here; only Linux. When beginning a new server or garden, the soil is most important; we create an environment to protect and maximize growth potential. The VPS provider may give you an OS they installed, but I always create a fresh install myself.
Before you are able to login with SSH, you will most likely have to generate and add a RSA public key.
ssh-keygen -t rsa -b 4096
After key is generated, we display the public key and add it to VPS account. Optionally, you may have to add the key with ssh-copy-id user@ip_address.
cat ~/.ssh/id_rsa.pub
ssh-rsa AAAEXAMPLECAQDBn0Z88lqrtya0Nd7yYtP/1o90vwVxjvCm/txb+SW85JRRnrI616d2iWwtVCSiUX0s59FfIPxUJl6vPqmxY40DIrX9KZijVpaq/TzWXh2ktCTjT6uBNMBRz/2lxP3w2AZov65dygjW5eQT9K9YB13dr1B4RkQMmUW5xiFbdHM0WzBYM2CMtE+lnmebn7m+B3DcvNkuGdT9Qw1/J24dTuNJSzJXVxzTOTlnVKOVSp1NWzu0USFI6dkrz8YImSgP9hQX970zTnzQ1Ctei4xlR/IiCpVGG6zWeV4oT3sLf4E9mk9eYF/wU0AdA3mQ68yZvv+Bhlc75e9kmUFe+JbctKR4YaKGY6K6K/F1tHrKYkASEkfQQ0KJU/ez/wtSf21A6Z2bM/Gg28f/6owfIMPWnYuB9VOLqkdIHFUot40uMi9CBvkdwH69zAQfz4jFvmu588klE0usBclGAFs78KM6YWaXHYjHdWVRIUrAqdZw1IP0uYS3uSBUPsbBG/Aq0V+22dg8U5DSu5XmwLB5jT+3c4ScqH3kY5tomRLe+2Dx4K+mAHpgtf10xL6Ayx2y0GFZCf+LB1Va3Trk3ChcaKRF5KvyayFQNSY4AfA47B90asdv== user@hostname
Next, we login to our VPS and specify -i what key to use. The -i is only needed if you have more than one key. The -v displays verbose or details of what the command is doing in the terminal.
ssh -i ~/.ssh/id_rsa root@123.123.123.123
Success! Now, we are able to update and upgrade our packages.
apt-get update && apt-get upgrade
In Ubuntu, sudo has a timeout built in for ease of use. I personally remove this timeout; without knowing you are using sudo will create all kinds of headaches in the future. When you make use of root privileges, we must explicitly type sudo each command.
sudo visudo
edit and add the following line to the config file
Defaults env_reset, timestamp_timeout=00
After we have logged in via SSH for root user account. I recommend installing a powerful firewall called: ufw
apt-get install ufw
ufw allow ssh
Display the status of the firewall and determine if ssh has been allowed. If nomenclature ssh doesn't add the ports, we do this manually with ufw allow 22/udp & ufw all 22/tcp. Port 22 is the common port SSH server makes use of; we are able to change this port for extra hardening, but for the sake of this tutorial, we will use port 22.
ufw status
To Action From
-- ------ ----
22/tcp ALLOW Anywhere
22/udp ALLOW Anywhere
Now, we enable the firewall after we allow port 22. The SSH connection should remain open. If it closes, SSH back into your VPS.
ufw enable
Once telnet is ran, ssh information should populate
telnet 123.123.123.123 22
Trying 123.123.123.123...
Connected to 123.123.123.123.
Escape character is '^]'.
SSH-X.0-OpenSSH_X.2p1 Ubuntu-Xubuntu0.2
Invalid SSH identification string.
Connection closed by foreign host.
To further expand on the garden, we must define a secure space for each plant or service we are running. To manage each service, like dns, mail, gitea, etc... we create a new user for each of these environments. This separation is important for operational security (OPSEC).
adduser username
Note: If we want to use Dockerfile or auto script without prompts, we make use of the useradd command.
Adding user `username' ...
Adding new group `username' (1003) ...
Adding new user `username' (1002) with group `username' ...
Creating home directory `/home/username' ...
Copying files from `/etc/skel' ...
New password:
Next, if the user should have sudo permission, we do the following.
usermod -a -G sudo username
cat /etc/passwd
...
username:x:1001:1002:User Name,,,:/home/username:/bin/bash
...
su username
sudo nano /etc/ssh/sshd_config
Add sudo to the AllowGroups like so:
AllowGroups wheel root sudo
Next, we disable root login since we will only have root privileges when using sudo.
PermitRootLogin no
For New Username Creating new user access to SSH login. When you connect to new username@ip, the vps user needs the public key for verification of authorized user. Authorized users with correct private key will be able to login to vps via ssh protocol.
mkdir ~/.ssh` `nano ~/.ssh/authorized_keys
Paste your public key we created earlier into the authorized_keys file.
chmod 700 ~/.ssh` `chmod 600 ~/.ssh/authorized_keys
sudo service ssh restart
exit
In conclusion, we are now able to login via SSH with new user and have also disabled root user logins. This process will have to be done for each user that is created.
After all our hard work and focus, we should backup our VPS and create scheduled routines. Depending on your use case, I would recommend at least weekly backups. The following command is quite complex, but, essentially we are discarding folders we don't need, backing up the entire VPS to our local machine and preserving all permissions and file integrity from the VPS.
sudo rsync -aAXv --rsh="ssh -i /home/user/.ssh/id_rsa" --recursive --progress --exclude={"/dev/*","/proc/*","/sys/*","/tmp/*","/run/*","/mnt/*","/media/*","/lost+found","/backups/*"} user@123.123.123.123:/ /home/user/VPS/Backups/