3.9 KiB
Secure a debian system
This is a small guide on how to secure a fresh debian install. Some of the commands will have to be executed as root and depending on the base system the commands can be different to the guide. The steps should be a good start though.
Prepare the system
apt-get update && apt-get upgrade -y
only if you are using awesome vim editor
apt-get install vim -y
OPTIONAL for backups with restic & rclone:
apt-get install restic -y
restic self-update
curl https://rclone.org/install.sh | sudo bash
Create Admin user
useradd -m -U -s /bin/bash -G sudo sysadmin
passwd sysadmin
Configure SSH
edit the sshd_config file
vim /etc/ssh/sshd_config
with following content:
Include /etc/ssh/sshd_config.d/*.conf
Port 29
LoginGraceTime 2m
PermitRootLogin no
StrictModes yes
MaxAuthTries 3
MaxSessions 4
AllowUsers sysadmin # change to the created user
PubkeyAuthentication no
AuthorizedKeysFile .ssh/authorized_keys
PasswordAuthentication yes
PermitEmptyPasswords no
ChallengeResponseAuthentication no
UsePAM yes
AllowAgentForwarding no
AllowTcpForwarding no
X11Forwarding no
PrintMotd no
PrintLastLog no
ClientAliveInterval 300
ClientAliveCountMax 1
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server
check config for errors
sshd -t
restart ssh service to apply settings
systemctl restart sshd
check if service has been started successfully
systemctl status sshd
Configure Fail2Ban
install fail2ban
apt-get install fail2ban
enable fail2ban
systemctl enable fail2ban
create a backup of the old config just in case
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
edit the config file
vim /etc/fail2ban/jail.local
...
bantime.increment = true
...
bantime.multipliers = 1 2 4 8 16 32 64
...
bantime = 300m
...
findtime = 10m
...
maxretry = 3
[sshd]
...
enabled = true
port = 29
logpath = %(sshd_log)s
backend = %(sshd_backend)s
...
restart fail2ban
systemctl restart fail2ban
check the status of fail2ban
systemctl status fail2ban
check the status of the client
fail2ban-client status sshd
-- Logout from Server --
Configure SSH key auth (Unix Systems)
following steps are executed on the local system - NOT on the server
create a ssh key with Edwards-curve Digital Signature Algorithm and name it server in the .ssh folder of the current user
ssh-keygen -t ed25519 -f ~/.ssh/server
edit a ssh config file
vim ~/.ssh/config
Host server
HostName 0.0.0.0
User sysadmin
IdentityFile ~/.ssh/server
Port 29
copy the created public key to the server
ssh-copy-id -i ~/.ssh/server.pub server
login to the server with the users password
ssh server
edit the sshd_config file
sudo vim /etc/ssh/sshd_config
with following content:
Include /etc/ssh/sshd_config.d/*.conf
Port 29
LoginGraceTime 2m
PermitRootLogin no
StrictModes yes
MaxAuthTries 3
MaxSessions 4
AllowUsers sysadmin
PubkeyAuthentication yes # different to previous config
AuthorizedKeysFile .ssh/authorized_keys
PasswordAuthentication no # different to previous config
PermitEmptyPasswords no
ChallengeResponseAuthentication no
UsePAM yes
AllowAgentForwarding no
AllowTcpForwarding no
X11Forwarding no
PrintMotd no
PrintLastLog no
ClientAliveInterval 300
ClientAliveCountMax 1
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server
check config for errors
sudo sshd -t
restart ssh service to apply settings
sudo systemctl restart sshd
check if service has been started successfully
sudo systemctl status sshd
OPTIONAL Install UFW Firewall
sudo apt-get install ufw
allow SSH if you are using a remote connection
sudo ufw allow ssh
check the status of the firewall (should be off)
sudo ufw status verbose
turn the firewall on
sudo ufw enable