6 ms·
I have a little checklist I use to cover the basics: https://drewdevault.com/new-server.html https://drewdevault.com/new-server.html
by Sir_Cmpwn 9y ago
I have a little checklist I use to cover the basics:
https://drewdevault.com/new-server.html https://drewdevault.com/new-server.html
- brianjking 9y agoChanging the default SSH port is a great idea too.
- KeybInterrupt 9y agoYeah, it is security through obscurity, I do it anyway on my Internet facing systems because then I don't have to bother with most automated SSH Scanners.
- rodolphoarruda 9y agoI'm a generalist project manager. When you say "Disable password login via ssh", what is going to be the login method from this point onwards? Via a personal certificate? Tks
- Sir_Cmpwn 9y ago~/.ssh/authorized_keys, which is basically personal certificates.
- zmyrgel 9y agoOr just use actual SSH certificates instead of public keys so you don't need to have authorized_keys file at all.
- brobinson 9y agoYou should be using public key authentication: https://www.digitalocean.com/community/tutorials/how-to-set-up-ssh-keys--2 https://www.digitalocean.com/community/tutorials/how-to-set-... If you insist on using passwords, make sure you at least install something like fail2ban or denyhosts to block the compromised machines which are hammering your server trying to guess passwords. Clients can see which authentication methods are allowed so they know which machines to attack (i.e., yours, if you allow passwords).
- MertsA 9y agoOr for something even cleaner than a program trying to parse plaintext logs you can use a PAM module. https://wiki.archlinux.org/index.php/Pam_abl https://wiki.archlinux.org/index.php/Pam_abl
- adfskjldsjfk 9y agoHow would you compare it with fail2ban?
- deleted 9y ago[deleted]
- AFNobody 9y agoI suggest you setup an account on Github and then create a SSH key with a passphrase: https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/ https://help.github.com/articles/generating-a-new-ssh-key-an... https://help.github.com/articles/testing-your-ssh-connection/ https://help.github.com/articles/testing-your-ssh-connection... SSH Keys are substantially more secure than passwords.
- Sir_Cmpwn 9y agoWhat does GitHub have to do with it?
- AFNobody 9y agoIts a free way to test he knows how to use SSH w/o a SSH server to talk to on the other end.
- madez 9y agoOne can simply start an openssh-server on localhost with some unused port for testing. There is no need for the internet, other computers or let alone other computers from somebody else over the internet for that.
- moondev 9y agoYeah I'm sure they are running linux. Actually just have them build openssh from source first. Much easier then signing up for GitHub and following their guide to do a test push for a litmus test.
- AFNobody 9y agoThe person in question is a project manager and may be using something other than linux or mac.
- rodolphoarruda 9y ago
- Eupolemos 9y agoSSH with keys. I used this ancient video to get going: https://www.youtube.com/watch?v=Fatbs4eTdJE https://www.youtube.com/watch?v=Fatbs4eTdJE
- deleted 9y ago[deleted]
- madez 9y agoI use a gpg smartcard to log into SSH. That way I don't need a password (technically, the smartcards reader wants the PIN, but the computer sees no PIN) and the key can't be stolen easily.
- newbear 9y agoThe general advice I've seen is to not host your own server. But I think it would be a great learning experience. If you cover the basics, is your server still extremely vulnerable?
- madez 9y agoWho is giving the advice to not host your own server? My advice is to do host your own server.
- peterwwillis 9y agoYep, you should definitely host your own server. And build your own Linux distro. And your own computer. Then weave your own cloth, sew your own clothes, cobble your own shoes. Build a car. Buy some land. Build a house. Move to the country. Raise chickens. Till and sow land. Get off the grid. Abandon the modern world. It's perfectly possible to drive a car without building one, or to become technically proficient without hosting your own server. If you DIY something, you may learn a lot about it, but it won't make you any better at the thing you actually wanted to do with it.
- NinjaKitten 9y agoYou could have said that without the snark.
- deleted 9y ago[deleted]
- madez 9y agoIt is not about learning everything by doing it yourself from scratch. Hosting a service yourself on your own server is becoming simpler and simpler by the day. Capable hardware is cheaply available in the form of single board computers and projects like Freedombox[0] and Yunohost[1] make the hosting part simple for the services they preconfigure. I don't know why you write such a confrontative comment. Hosting your server is important to have control over your data. You don't need to build your own Linux distro for that... [0] https://freedombox.org/ https://freedombox.org/ [1] https://yunohost.org/ https://yunohost.org/
- AFNobody 9y agoMy list is similar but I do a UFW setup and move SSH to a non-standard port that is easy to remember (i.e. 12345) to reduce noise in my log files. Is there any particular reason you left firewall setup off?
- Sir_Cmpwn 9y agoI don't think firewall is terribly important. I know it's kind of against the grain, probably best to do it if you don't understand the consequences.