logo
260712 |*| |c|

Linux server security essentials

~232s

Overview: Linux (Debian 13) basic server security guide for system administrators.

Motivation

The first thing admins usually do after logging into an off-the-shelf server is to secure it.

While there are a lot of advanced techniques and methods that can be used to improve the security of a new server and help keep it protected from various threats, this guide will only focus on the basics.

Assumptions

  • you have root access to a VPS (Debian/-based) from a GNU/Linux machine
  • you already have a SSH keypair uploaded to the server & a hardened config1
  • basic terminal and nano editor knowledge
  • ~25m free time

1. Add new user

Note: run ssh root@server_ip in a terminal if you are not connected. Replace server_ip with your VPS IP address.

To avoid using the root account on a regular basis, we need to first add a new user and grant it administrative privileges:

adduser newuser

Enter a strong password and hit Enter to skip optional fields.

usermod -aG sudo newuser

2. SSH lock down

SSH should already be hardened1, but there are extra steps you can take to reduce the attack surface even more.

2.1 Disable root SSH access

Establish two separate SSH connections to the server, for backup purposes.

Restart the sshd daemon with systemctl restart sshd and open a third connection. If you don't lose access, proceed.

Now you can create a SSH group and add your user to it:

sudo groupadd -f ssh && sudo usermod -aG ssh newuser

Check what files we already have in /etc/ssh/sshd_config.d/:

ls /etc/ssh/ssh_config.d

Create a file that has a higher number prefix than everything in that folder, like 90-security:

sudoedit /etc/ssh/sshd_config.d/90-security.conf

Paste this to restrict connections to ssh group members only:

AllowGroups ssh

Restart the SSH daemon again and try opening another connection with your priviledged user. This should work perfectly. Root access should be denied to the server.

Note: you can optionally also add the explicit 'PermitRootLogin no' and also 'PasswordAuthentication no' to your config to make sure access is restricted to keys only and prevent potential future misconfigurations.

Note: for tigher control you can replace 'AllowGroups ssh' with 'AllowUsers newuser'.

Note: replace newuser with your actual SSH user name.

2.2 Non-default SSH port

You can also change the default ssh daemon listen port from 22 to something else in an attempt to avoid open ports scans:

Port 3489

Note: if you change the default ssh port, you need to update ufw rules below; example: ufw allow 3489. Connect with ssh newuser@server_ip -p 3489.

Save the file with CTRL+X > Y > press Enter.

2.3 Test connection

Restart the sshd daemon:

systemctl restart sshd

Open another terminal tab/window and try to SSH to the server:

ssh newuser@server_ip -p $PORT

If it doesn't work, check for configuration errors using the other terminal and then try again.

If successful, you will be able to ssh into the server only with newuser from now on.

Note: replace $PORT with the non-default port you set (if applicable).

3. Install firewall

Keep a backup ssh connection open.

Update and install a basic firewall via apt:

apt update
apt install ufw

Set default policies:

ufw default deny incoming
ufw default allow outgoing

Allow ssh connections and enable the firewall:

ufw allow SSH

Verify the status with:

ufw status verbose

Only proceed if the output includes this line:

To             Action      From
--             ------      ----
22/tcp (SSH)   ALLOW IN    Anywhere

Enable the firewall:

ufw enable

Note: later you will probably need to adjust the firewall settings to allow traffic in from other services that you install; example for Nginx: sudo ufw allow 'Nginx Full'.

You can close the connection to the server with exit.

Observations

  • use strong and random passwords for system logins to protect against brute-force attacks
  • update system regularly with apt update && apt upgrade -y; you could automate the process with a cron job
  • optionally install Fail2Ban to monitor system logs and protect against DDoS attacks

That's it for this basic server security guide. Reach out to me if you run into any trouble. Good luck!

U260712: rewrote guide; added SSH lock down section.