Most simple ways to secure your Linux server with this learning guide

Most Simple Ways to Secure your Linux Server With this Learning Guide because at host2in, primary objective has always been to provide you with powerful, secure and robust hosting solutions. While for product such as Shared Hosting, we take utmost care to ensure maximum server level security and redundancy.

Learn Secure Linux Server

Products such as Dedicated Servers hosting and VPS, we can ensure network level security while the OS level control lies in your hands.

Let’s start by first understanding the basic concepts of a web server. A web server, simply put is a computer host configured and connected to the internet, for serving web pages on user requests. Since web servers are open to public access and often contain critical information, it is important to shield them from hackers.

Although Linux based Operating Systems are relatively more secure and include inbuilt security mechanisms like SELINUX when compared to the others, a small vulnerability or bug can give a hacker easy access to your system.

Keeping this in mind, we’ve put together a comprehensive set of steps that you can take to mitigate the risk of getting hacked.

Always stay up to date

A great way to ensure maximum Linux server security at all times is to keep your system up to date with the latest bug fixes or the latest version of your Operating System.

A good way to keep track of update announcements is to sign up for email alerts. CentOS and Ubuntu have a security mailing list where all security and vulnerability fixes are discussed and released.

Verify Permissions

It is essential to review permission settings to ensure that a server remains secure. There are certain files such as the “/etc/password”, “/etc/shadow”, “/etc/group” and “/etc/gshadow“files that contain critical user, password and group information. These files have a greater chance of being subjected to malicious attacks.

Several utilities also require read access to the password ﬁle to function properly, however read access to the shadow file will allow malicious attacks against system passwords, and should never be enabled and should never be enabled.

Below are the default permissions and owners that should be set for these files.

cd /etc

chown root:root passwd shadow group gshadow

chmod 644 passwd group

chmod 400 shadow gshadow

Find unauthorized World Writable files

The following command discovers and prints any world-writable ﬁles in local partitions. Run it once for each local partition

find /tmp -xdev -type f -perm -0002 -print

If this command produces any output, ﬁx each reported ﬁle file using the command:

chmod o-w file

Data in world writable ﬁles can be modiﬁed by any user on the system. In almost all circumstances, ﬁles can be conﬁgured using a combination of user and group permissions to support whatever legitimate access is needed without the risk caused by world-writable ﬁles.

It is generally a good idea to remove global (other) write access to a ﬁle when it is discovered. However, it is always advisable to check relevant documentation for applications before making changes. Also, monitor for recurring world-writable ﬁles, as these may be symptoms of a misconﬁgured application or user account.

Set the sticky bit on World Writable directories

Setting the sticky bit prevents users from removing each other’s ﬁles. When a sticky-bit is set on a directory, only the owner of a given ﬁle is given the right to remove it from the directory. Without the sticky bit, any user with write access to a directory can remove any ﬁle from it.

Use the following command to discover and print any world writable files that do not have their sticky bits set.

find /tmp -xdev -type d ( -perm -0002 -a ! -perm -1000 ) -print

If this command produces any output, ﬁx each reported directory /dir using the command:

chmod +t /dir

In cases where there is no reason for a directory to be world writable, a better solution is to remove that permission rather than to set the sticky bit.

Enable ExecShield

ExecShield helps in reducing the risk of worm or other automated remote attacks. It comprises a number of kernel features to provide protection against buﬀer overﬂows. These features include random placement of the stack and other memory regions and special handling of text buﬀers.

To ensure ExecShield (including random placement of virtual memory regions) is activated at boot, add or correct the following settings in /etc/sysctl.conf:

#kernel.exec-shield = 1

#kernel.randomize_va_space = 1

Conﬁgure Sudo to improve auditing of Root access

The sudo command allows ﬁne-grained control through which users can execute commands using other accounts. The primary benifeet associated with the configuration of sudo is that it provides an audit trail of every command run by a privileged user. It is possible for a malicious administrator to circumvent this restriction, but, if there is an established procedure that all root commands are run using sudo, then it is easy for an auditor to detect unusual behavior when this procedure is not followed.

Set Strict password requirements

Setting more stringent password requirements can be an additional measure taken to step up server security.

User passwords should be strengthened with the PAM module which can be configured to require at least one uppercase character, lowercase character, digit, and other(special) character,

You can modify your password by following the steps listed below:

Locate the following line in /etc/pam.d/system-auth:

#password requisite pam_cracklib.so try_first_pass retry=3

and then alter it to read (placing the text on one line):

#password required pam_cracklib.so try_first_pass retry=3 minlen=14 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1

You may also modify the arguments to ensure compliance with your organization’s security policy. Note that the password quality requirements are not enforced for the root account

Install LFD and Config Server Firewall

ConfigServer.com has created a script which by default blocks all ports and provides you the opportunity to allow usage of only those ports on which you have applications running.

Download and install these scripts from configserver.com

Open the config server conf file /etc/csf/csf.conf and modify the below lines to your requirements

Allow incoming TCP ports

TCP_IN = “22,80”

Allow outgoing TCP ports

TCP_OUT = “22,25,80”

In the example I have allowed port 22 for ssh, port 80 for http and only outgoing for port 25 since I do not want any other server or client using my server for sending emails.

Also modify the below line to your email address.

#LF_ALERT_TO = your email address

Along with the firewall, LFD will also be installed. LFD is a daemon which scans log files and blocks IP addresses trying to brute force your server.

You can whitelist your IP address in /etc/csf/csf.ignore. Please use caution while executing the above commands and if possible test changes on a demo server.