How to secure a new server in 10 minutes

Steps

1. Update the system and make a user

   Work as a normal user with sudo, not as root. Pick your own name instead of dev.

   $ ssh [email protected]
   $ apt update && apt upgrade -y
   $ adduser dev
   $ usermod -aG sudo dev

2. Put your SSH key on the server

   Run these on your laptop, not on the server. The key is a pair of files: the private one stays with you, the public one goes to the server. ed25519 is the type the Ubuntu documentation recommends: shorter and cheaper to compute than the older types.

   $ ssh-keygen -t ed25519
   $ ssh-copy-id username@target_machine
   $ ssh [email protected]

   Keep this last session open. You need it in the next step if something goes wrong.

3. Switch off passwords and root login

   Put the changes in a small file of their own. sshd reads the files in /etc/ssh/sshd_config.d/ in alphabetical order, and for each setting the first value it finds wins. A name that starts with 00- goes first and beats files that cloud images ship. Test the config before you restart: if SSH is your only way in, one mistake can lock you out.

   $ sudo nano /etc/ssh/sshd_config.d/00-hardening.conf
   
   PasswordAuthentication no
   KbdInteractiveAuthentication no
   PermitRootLogin no
   
   $ sudo sshd -t
   $ sudo systemctl restart ssh.service
   $ sudo sshd -T | grep -E 'passwordauthentication|permitrootlogin'
   passwordauthentication no
   permitrootlogin no

   By default sshd accepts passwords (PasswordAuthentication yes), and root may log in only with a key (PermitRootLogin prohibit-password). Now open a second window and log in again as dev. Only when that works, close the first one.

4. Turn on the firewall

   Deny everything coming in, allow everything going out, then open SSH before you enable the firewall. Open a port only when a program listens on it, for example 80 and 443 for a web server.

   $ sudo ufw default deny incoming
   $ sudo ufw default allow outgoing
   $ sudo ufw allow OpenSSH
   $ sudo ufw allow 80,443/tcp
   $ sudo ufw enable
   $ sudo ufw status verbose

   ufw asks for a confirmation because enabling it over SSH can cut your session. Answer y: SSH is already allowed.

5. Install security updates by themselves

   On Ubuntu, security updates switch on right after installation and run once a day. Install the package, then ask it for a trial run to see what it would do.

   $ sudo apt install unattended-upgrades
   $ sudo unattended-upgrade -v --dry-run

   On Debian, switch it on with sudo dpkg-reconfigure unattended-upgrades and answer yes. The settings live in /etc/apt/apt.conf.d/50unattended-upgrades and /etc/apt/apt.conf.d/20auto-upgrades; logs are in /var/log/unattended-upgrades.

6. Add fail2ban

   fail2ban scans log files such as /var/log/auth.log and bans IP addresses with too many failed logins by updating firewall rules. Keep your settings in jail.local, not in jail.conf. These values ban an address for an hour after five failures in ten minutes.

   $ sudo apt install -y fail2ban
   $ sudo nano /etc/fail2ban/jail.local
   
   [sshd]
   enabled = true
   maxretry = 5
   findtime = 10m
   bantime = 1h
   
   $ sudo systemctl restart fail2ban
   $ sudo fail2ban-client status sshd

Check that it works

Try to log in with a password from your laptop: the server must refuse. Then list what listens on the network and who logged in lately. Every open port in the list should be one you can name.

$ ssh -o PubkeyAuthentication=no [email protected]
Permission denied (publickey).
$ sudo ss -tlnp
$ last -n 10

• The log covers the ways in that go through Uno and your computer's own sign-ins. Root on the physical server can reach a computer's disk and memory without leaving a row in the log.
• Uno does not promise that it cannot get in. It promises that its ways in are written down and shown to you.
• Uno does not update the software inside your computer for you. Security updates (step 5) are yours to turn on.
• No firewall runs inside an Uno computer, so you cannot add your own rules there. You choose which ports are forwarded and who can reach them.

Common problems