5 ms·

Ask HN: How to secure Ubuntu VPS in 2022?

20 points by lukaszwojtow 5y ago

So obvious things spring to mind: 1. Uninstall what's not needed 2. Firewall 3. Strong root's and main user's passwords What else?

cpach 5y ago
Never allow password-based login for SSH.
- DarylZero 5y ago
  Yeah and that's not even about security just about keeping /var/log from filling up right quick.
codegeek 5y ago
Bare minimum: 1. Security updates/unattended upgrades 2. Sudo user (don't use root directly) 3. Log Rotation 4. SSH. Key based only. Ideally with a passphrase. No root login 5. Firewall. Only open ports that are needed (80,443 etc) Then you can do other things as needed (private network etc).
mobilio 5y ago
Here is everything that you need: https://ubuntu.com/server/docs/security-introduction https://ubuntu.com/server/docs/security-introduction
- MonaroVXR 5y ago
  Yes, this a good source of information. +1
franga2000 5y ago
One rather specific thing that may or may not apply to you, but I see very often on Ubuntu servers: Docker containers completely bypass UFW rules (the default firewall on Ubuntu Server). Even if a port isn't open, if a docker forwards it to a container it will be acceptable from the outside. So if you're running Docker, make sure your container port forwards are only bound to localhost (apart from the ones you want to expose intentionally of course) and/or that you use the appropriate patches/scripts that fix this issue (there's a few different ways floating around the web).
- MonaroVXR 5y ago
  Yes, saw this too, it's in the official documentation.
franga2000 5y ago
Here's my checklist (some of these are the default on Ubuntu): - disabled root account password - ssh rejects root, allows only key-based auth, listens on non-standard port - fail2ban is installed and active - firewall is enabled and all ports are "closed" by default
0xdeadb00f 5y ago
Further than strong root account would be to dissalow root login altogether. Rather, create a dedicated admin user with a strong password that's able to do privileged actions via sudo. This leaves an audit trail in case the admin account is compromised.
hakanderyal 5y ago
Have a look at https://github.com/dev-sec/ansible-collection-hardening https://github.com/dev-sec/ansible-collection-hardening
crate_barre 5y ago
Install fail2ban
strzibny 5y ago
You need to secure the system as a whole (SSH, sudo, logs, firewalls, SELinux) and then each individual component (db access). For example, here's my thread on basic firewalld configuration[0] (yes I know firewalld is not Ubuntu's default, but it's in the repository and can be used). There is a lot to go through for a comment answer. I think little bit of Google will reveal some decent Ubuntu articles. I'll say at least this. Scratch root access completely, and set up an admin account with SSH-keys auth. That would be a good start to replace password-access. If you want to be more confident in system configuration, I wrote a book on the topic[0]. It uses enterprise Linux rather than Ubuntu, so I can teach SELinux too (which is actually a big security improvement). [0] https://twitter.com/strzibnyj/status/1480494670299815939 https://twitter.com/strzibnyj/status/1480494670299815939 [1] https://deploymentfromscratch.com https://deploymentfromscratch.com

20 points by lukaszwojtow 5y ago

So obvious things spring to mind: 1. Uninstall what's not needed 2. Firewall 3. Strong root's and main user's passwords What else?

cpach 5y ago

Never allow password-based login for SSH.

DarylZero 5y ago
Yeah and that's not even about security just about keeping /var/log from filling up right quick.

codegeek 5y ago

Bare minimum: 1. Security updates/unattended upgrades 2. Sudo user (don't use root directly) 3. Log Rotation 4. SSH. Key based only. Ideally with a passphrase. No root login 5. Firewall. Only open ports that are needed (80,443 etc) Then you can do other things as needed (private network etc).

mobilio 5y ago

Here is everything that you need: https://ubuntu.com/server/docs/security-introduction https://ubuntu.com/server/docs/security-introduction

MonaroVXR 5y ago
Yes, this a good source of information. +1

franga2000 5y ago

One rather specific thing that may or may not apply to you, but I see very often on Ubuntu servers: Docker containers completely bypass UFW rules (the default firewall on Ubuntu Server). Even if a port isn't open, if a docker forwards it to a container it will be acceptable from the outside. So if you're running Docker, make sure your container port forwards are only bound to localhost (apart from the ones you want to expose intentionally of course) and/or that you use the appropriate patches/scripts that fix this issue (there's a few different ways floating around the web).

MonaroVXR 5y ago
Yes, saw this too, it's in the official documentation.

franga2000 5y ago

Here's my checklist (some of these are the default on Ubuntu): - disabled root account password - ssh rejects root, allows only key-based auth, listens on non-standard port - fail2ban is installed and active - firewall is enabled and all ports are "closed" by default

0xdeadb00f 5y ago

Further than strong root account would be to dissalow root login altogether. Rather, create a dedicated admin user with a strong password that's able to do privileged actions via sudo. This leaves an audit trail in case the admin account is compromised.

hakanderyal 5y ago

Have a look at https://github.com/dev-sec/ansible-collection-hardening https://github.com/dev-sec/ansible-collection-hardening

crate_barre 5y ago

Install fail2ban

strzibny 5y ago

You need to secure the system as a whole (SSH, sudo, logs, firewalls, SELinux) and then each individual component (db access). For example, here's my thread on basic firewalld configuration[0] (yes I know firewalld is not Ubuntu's default, but it's in the repository and can be used). There is a lot to go through for a comment answer. I think little bit of Google will reveal some decent Ubuntu articles. I'll say at least this. Scratch root access completely, and set up an admin account with SSH-keys auth. That would be a good start to replace password-access. If you want to be more confident in system configuration, I wrote a book on the topic[0]. It uses enterprise Linux rather than Ubuntu, so I can teach SELinux too (which is actually a big security improvement). [0] https://twitter.com/strzibnyj/status/1480494670299815939 https://twitter.com/strzibnyj/status/1480494670299815939 [1] https://deploymentfromscratch.com https://deploymentfromscratch.com