5 ms·
My 3 most important rules for Linux servers are: 1. Run software update! 2. Don't allow everyone to access sensitive ports. Moving SSH to some nonstandard por
by nimbix 17y ago
My 3 most important rules for Linux servers are:
1. Run software update!
2. Don't allow everyone to access sensitive ports. Moving SSH to some nonstandard port is not enough. Use iptables to limit access to it from only certain static IPs.
3. Run SELinux! If you think its only purpose is to make your life more difficult, you have a lot more studying to do. (Also, make sure you don't use a distro that comes with a badly broken selinux config)
UPDATE: formatting
- tdavis 17y agoUse iptables to limit access to it from only certain static IPs. Or just disable password logins entirely.
- smanek 17y agoYeah, that's really much more secure ;-) http://www.debian.org/security/2008/dsa-1571 http://www.debian.org/security/2008/dsa-1571
- nimbix 17y agoThis would only protect you against password guessing, but not against any remotely exploitable security holes in the SSH (or any other) daemon.
- quellhorst 17y agoTurn off password logins and move ssh to a different port.
- uggedal 17y agoAnd disable root login from ssh.
- ohlol 17y agoI've never been a fan of changing SSH's port. If you're going to firewall SSH, changing the port is redundant.. The only reason to change the port is to prevent brute force attacks, and the firewall will do that for you.
- LogicHoleFlaw 17y agoStill.... it really cleans the logs up. It's not safer, but the logs do become easier to read in a pinch.
- ohlol 17y agoHuh? The firewall logs? Got grep -v?
- weaksauce 17y agoThe thing is that a lot of the simple scripts only bang on 22. Moving the port means that a lot of scripts will move on to another server.