I, recently, started running a Lemmy instance. I am, also, new to Linux servers.

At the advisement of some tech acquaintances, I’ve installed UnnattendedUpgrades and Fail2ban.

What would you recommend?

gofoss.net
link
fedilink
108M

Below a couple of ideas, some building on what has already been stated. It’s all detailed here:

Feedback really welcomed, as there’s always something to be learned in server security :)

General hardening:

  • set up a firewall (ufw)
  • make sure your system time is correct (ntp)
  • enable unattended upgrades
  • limit privileged access (sudo)
  • hide process information (/proc)
  • enforce strict password policy (pam, login.defs)
  • enforce stricter permissions (umask)
  • close all unused ports (check with nmap)
  • install a malware scanner (lmd)
  • install an antivirus (clamav)
  • disable core dumps
  • disable unused kernel modules
  • add legal banner

SSH:

  • change the port
  • limit the nb of login attempts
  • limit access to admin users
  • enable access logs
  • forbid remote access to root
  • use auth keys with instead of password auth
  • disconnect after inactivity period
  • remove short encryption keys

MySQL (if applicable):

  • run a hardening script
  • disable remote access
  • prevent unauthorised access to local files
  • create separate users with limited privileges for each app

Apache (if applicable):

  • enable security modules
  • hide http headers
  • set up modsecurity, a web app firewall

PHP (if applicable):

  • hide php version in headers
  • disable remote code execution
  • disable potentially harmful functions
  • limit script runtime & memory allocation

Network security (sysctl):

  • ip spoofing protection
  • ignore icmp broadcasts & redirects
  • disable source paket routing
  • block syn attacks
  • log martians
  • ignore pings
@suspended
creator
link
fedilink
48M

Fantastic answer! Thanks so much :)

Is all of this really necessary?

krolden
link
fedilink
6
edit-2
8M

Not really. Especially the antivirus. Its pretty easy to avoid such things by not installing any untrusted aoftware. Not to mentionitf youd likely be ransomwared before you detectedanhthing.

But hosting publicly facing services is always a risk.

The linux upskill challenge guides users through setting up a server from the beginning and shows you how to set up a firewall with ufw as well as disabling root login via ssh.

@suspended
creator
link
fedilink
38M

Thank you. I will look into this.

Don’t allow root ssh access, you could also change the ssh port to one that’s not 22. Also you could disallow ssh password login and allow key-based authentication only.

krolden
link
fedilink
48M

Also try to set it up without installing sudo , which will eliminate a lot of privilege escalationvulnerabilities.

i personally don’t recommend fail2ban: it’s a good way to lock yourself out of your own server but will probably not protect you from any attacks.

for protection unattended upgrades (like you have) and disabling SSH password auth (PasswordAuthentication no in /etc/ssh/sshd_config) is the best you can do.

also i’ve never run a lemmy instance but make sure the database isn’t reachable from the internet, only from localhost :)

krolden
link
fedilink
6
edit-2
8M

If you get locked out by your own fail2ban rules then you’ve probably forgotten your password.

Not to mentionyoull probably be able to get control back using your hosts console.

sure sure it’s just fail2ban doesn’t just apply to SSH and can get your IP banned if you typo on your password on some web service… and from there you can’t SSH into the server to fix the problem ;) ;)

krolden
link
fedilink
28M

Yeah if you dont configure it properly. Ive never actually know anyone get locked out by fail2ban

Oh i’m pretty good at making stupid mistakes ;)

disable root login over ssh, and use public keys auth if possible.

fail2ban is good, but needs to be configured properly.

there’s probably lots more, but that’s a start.

@suspended
creator
link
fedilink
18M

fail2ban is good, but needs to be configured properly.

Thank you for responding kindly. Is there a resource that you’d recommend looking into proper configuration?

I think their doc’s are decent? and I could be wrong, and maybe it depends on the Linux distribution, but I’m just not 100% sure if it actually does anything without some basic configuration.

Farshid Hakimy
link
fedilink
1
edit-2
8M

@suspended @smorks Asking for a friend: is SSH not with root-user relevant if only accessible via a VPN and the network is secured?

to be clear, the only way to access ssh is by connecting through the VPN? yeah, it should be fine, as long as your vpn is secure.

@smorks Yeah, but SSH login for root isn’t disabled. And yes, the network & connection is safe.

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

  • Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
  • No misinformation
  • No NSFW content
  • No hate speech, bigotry, etc

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

  • 0 users online
  • 2 users / day
  • 14 users / week
  • 71 users / month
  • 255 users / 6 months
  • 6.28K subscribers
  • 1.88K Posts
  • 5.41K Comments
  • Modlog