3 ms·
On the cheap Linode instances I setup for others, I always install this: http://www.configserver.com/cp/csf.html http://www.configserver.com/cp/csf.html It inc
by buro9 12y ago
On the cheap Linode instances I setup for others, I always install this:
http://www.configserver.com/cp/csf.html http://www.configserver.com/cp/csf.html
It includes the equivalent of fail2ban, manages iptables, watches log files, can email on failed logins, processes gone mad, and a few other things through a very simple config file.
It's that simplicity of the config file that I like, it means I can hand it to someone and know that they're unlikely to break something due to misconfiguration or failure to actually apply something.
This is on top of obvious things like running ssh on a non-default port, turning off password auth and restricting ssh to named users only (never root).
The install script is easy enough: http://www.configserver.com/free/csf/install.txt http://www.configserver.com/free/csf/install.txt so it's really the case that I can do whatever work I'm doing for someone (hello Wordpress) and this can be my simple security solution which at least means I'm sure that I haven't left every window open.
- deoxxa 12y agoWhy do you run ssh on a non-default port?
- rurounijones 12y agoBrute-forcers only hit the default port. If there is no response on the default port then they just move on to greener servers. Moving off the default port is a good way to avoid your logs getting filled up with failed login attempt messages.
- tacticus 12y agoThough something like fwknop would be a nicer way of resolving that.
- thejosh 12y agoWhy not? You can always create an entry in .ssh/config for the host with the port if needed. Host example.com IdentityFile ~/.ssh/id_rsa_example User foobar Hostname 127.0.0.1 Port 1234
- kawsper 12y agoAlways run SSH on a privileged port. An attacker could potentially run a rogue SSH instance on a non-privileged port and capture logins for other accounts. If you run it on a privileged port (1024, or lower), it means that it can be trusted to root-level.
- buro9 12y agoTo reduce noise in the logs so that I can focus on the more determined attackers rather than script kiddies just hitting the default ports on every IP. It does nothing for security, but does help to reduce noise which in turn helps to reduce the time it takes to manage this stuff.
- aragot 12y agoIf you disable logging in with the root user, ...do you allow Sudo for another user? Then, what's the point?
- hackerboos 12y agoBecause in order to do that you should need to provide a password.