# Secure a debian system

This is a small guide on how to secure a fresh debian install. Some of the commands will have to be executed as root and depending on the base system the commands can be different to the guide. The steps should be a good start though.

## Prepare the system

```apt-get update && apt-get upgrade -y```

only if you are using awesome vim editor

```apt-get install vim -y```

OPTIONAL for backups with restic & rclone:

```apt-get install restic -y```

```restic self-update```

```curl https://rclone.org/install.sh | bash```

## Change Timezone

```timedatectl set-timezone Europe/Berlin```

```timedatectl```

## Create Admin user

```useradd -m -U -s /bin/bash -G sudo sysadmin```

```passwd sysadmin```

## Configure SSH

edit the sshd_config file

```vim /etc/ssh/sshd_config```

with following content:

```bash
Include /etc/ssh/sshd_config.d/*.conf

Port 29

LoginGraceTime 2m
PermitRootLogin no
StrictModes yes
MaxAuthTries 3
MaxSessions 4

AllowUsers sysadmin # change to the created user

PubkeyAuthentication no

AuthorizedKeysFile .ssh/authorized_keys

PasswordAuthentication yes
PermitEmptyPasswords no

ChallengeResponseAuthentication no

UsePAM yes

AllowAgentForwarding no
AllowTcpForwarding no
X11Forwarding no
PrintMotd no
PrintLastLog no
ClientAliveInterval 300
ClientAliveCountMax 1

AcceptEnv LANG LC_*

Subsystem	sftp	/usr/lib/openssh/sftp-server
```

check config for errors

```sshd -t```

restart ssh service to apply settings

```systemctl restart sshd```

check if service has been started successfully

```systemctl status sshd```

## Configure SSH key auth (Unix Systems)

**-- Logout from Server --**

**following steps are executed on the local system - NOT on the server**

create a ssh key with Edwards-curve Digital Signature Algorithm and name it server in the .ssh folder of the current user

```ssh-keygen -t ed25519 -f ~/.ssh/server```

if you want, you can change the comment of the key to something better

```ssh-keygen -c -C "server.example.com" -f ~/.ssh/server```

edit a ssh config file

```vim ~/.ssh/config```

```bash
Host server
    HostName 0.0.0.0
    User sysadmin
    IdentityFile ~/.ssh/server
    Port 29
```

copy the created public key to the server

```ssh-copy-id -i ~/.ssh/server.pub server```

login to the server with the users password

```ssh server```

edit the sshd_config file

```sudo vim /etc/ssh/sshd_config```

with following content:

```bash
Include /etc/ssh/sshd_config.d/*.conf

Port 29

LoginGraceTime 2m
PermitRootLogin no
StrictModes yes
MaxAuthTries 3
MaxSessions 4

AllowUsers sysadmin

PubkeyAuthentication yes # different to previous config

AuthorizedKeysFile .ssh/authorized_keys

PasswordAuthentication no # different to previous config
PermitEmptyPasswords no

ChallengeResponseAuthentication no

UsePAM yes

AllowAgentForwarding no
AllowTcpForwarding no
X11Forwarding no
PrintMotd no
PrintLastLog no
ClientAliveInterval 300
ClientAliveCountMax 1

AcceptEnv LANG LC_*

Subsystem	sftp	/usr/lib/openssh/sftp-server
```

check config for errors

```sudo sshd -t```

restart ssh service to apply settings

```sudo systemctl restart sshd```

check if service has been started successfully

```sudo systemctl status sshd```

## OPTIONAL Configure Fail2Ban

install fail2ban

```apt-get install fail2ban```

enable fail2ban

```systemctl enable fail2ban```

create a backup of the old config just in case

```cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local```

edit the config file

```vim /etc/fail2ban/jail.local```

```bash
...
bantime.increment = true
...
bantime.multipliers = 1 2 4 8 16 32 64
...
bantime  = 300m
...
findtime  = 10m
...
maxretry = 3

[sshd]
...
enabled = true
port    = 29
logpath = %(sshd_log)s
backend = %(sshd_backend)s
...
```
restart fail2ban

```systemctl restart fail2ban```

check the status of fail2ban

```systemctl status fail2ban```

check the status of the client

```fail2ban-client status sshd```

## OPTIONAL Install UFW Firewall

```sudo su```

```apt-get install ufw```

allow SSH (or port 29 like in the config earlier) if you are using a remote connection

```ufw allow ssh```

or

```ufw allow 29/tcp```

check the status of the firewall (should be off)

```ufw status verbose```

turn the firewall on

```ufw enable```

check the status of the firewall (should be on)

```ufw status verbose```