4 ms·
I've taken steps to secure my Linux: * Using Yubikey PAM always as a 2FA for ssh,sudo (also on every Linux in my home network). * Always require authenticatio
by mihaigalos 4y ago
I've taken steps to secure my Linux:
* Using Yubikey PAM always as a 2FA for ssh,sudo (also on every Linux in my home network).
* Always require authentication on each sudo command (prevents escalating once and then reusing privileges).
* Only running Docker with sudo as recommended (requires 2FA now).
* Closing all traffic other than services I need with nftables.
Regularly look at the journalctl for suspicious activity.
- mihaigalos 4y agoAlso, I have a Google Authenticator as a fall-back in case the 1st Yubikey PAM fails or I have no access to the internet to contact the Yubico servers for token validation. Perhaps somebody can confirm if it's a good idea or not, but I like to generate only 1 emergency code for Authenticator (the least) and then delete that line in ~/.google-authenticator. Also, permissions of 400. In case interested, check it out in code here: https://github.com/mihaigalos/config/blob/main/services/pam/Justfile#L40 https://github.com/mihaigalos/config/blob/main/services/pam/...