Home > server > Important things to do after installing Ubuntu Server

Important things to do after installing Ubuntu Server

June 15Hits:1
Advertisement

I just installed Ubuntu Server on a VPS.

To configure the server I'm reading the Ubuntu Server Guide. But the Ubuntu Server Guide doesn't tells me everything.

E.g. The Ubuntu Server Guide doesn't tell me about how to secure SSH, which is, in my opinion, an important thing to do after installation of a server.

I know that I've to secure SSH access, but I might forget things to configure. Because I don't know what I don't know.

Does a complete guide exists which tells me which important things I've to after installing Ubuntu server? If not, can anyone tell me those things?

Answers

Secure shared memory

/dev/shm can be used in an attack against a running service, such as httpd. Modify /etc/fstab to make it more secure.

Open a Terminal Window and enter the following :

sudo vi /etc/fstab

Add the following line and save. You will need to reboot for this setting to take effect :

tmpfs     /dev/shm     tmpfs     defaults,noexec,nosuid     0     0

Harden network with sysctl settings

The /etc/sysctl.conf file contain all the sysctl settings. Prevent source routing of incoming packets and log malformed IP's enter the following in a terminal window

sudo vi /etc/sysctl.conf

Edit the /etc/sysctl.conf file and un-comment or add the following lines :

# IP Spoofing protection
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Ignore ICMP broadcast requests
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Disable source packet routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# Ignore send redirects
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# Block SYN attacks
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 5

# Log Martians
net.ipv4.conf.all.log_martians = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1

# Ignore ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0

# Ignore Directed pings
net.ipv4.icmp_echo_ignore_all = 1

To reload sysctl with the latest changes, enter:

sudo sysctl -p

Prevent IP Spoofing

Open a Terminal and enter the following :

sudo vi /etc/host.conf

Add or edit the following lines :

order bind,hosts
nospoof on

Harden PHP for security

Edit the php.ini file :

sudo vi /etc/php5/apache2/php.ini

Add or edit the following lines :

disable_functions = exec,system,shell_exec,passthru
register_globals = Off
expose_php = Off
magic_quotes_gpc = On

Web Application Firewall - ModSecurity

http://www.thefanclub.co.za/how-to/how-install-apache2-modsecurity-and-modevasive-ubuntu-1204-lts-server

Protect from DDOS (Denial of Service) attacks - ModEvasive

http://www.thefanclub.co.za/how-to/how-install-apache2-modsecurity-and-modevasive-ubuntu-1204-lts-server

Scan logs and ban suspicious hosts - DenyHosts and Fail2Ban

@DenyHosts

DenyHosts is a python program that automatically blocks SSH attacks by adding entries to /etc/hosts.deny. DenyHosts will also inform Linux administrators about offending hosts, attacked users and suspicious logins.

Open a Terminal and enter the following :

sudo apt-get install denyhosts

After installation edit the configuration file /etc/denyhosts.conf and change the email, and other settings as required.

To edit the admin email settings open a terminal window and enter:

sudo vi /etc/denyhosts.conf

Change the following values as required on your server :

ADMIN_EMAIL = [email protected]
SMTP_HOST = localhost
SMTP_PORT = 25
#SMTP_USERNAME=foo
#SMTP_PASSWORD=bar
SMTP_FROM = DenyHosts [email protected]
#SYSLOG_REPORT=YES

@ Fail2Ban

Fail2ban is more advanced than DenyHosts as it extends the log monitoring to other services including SSH, Apache, Courier, FTP, and more.

Fail2ban scans log files and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc.

Generally Fail2Ban then used to update firewall rules to reject the IP addresses for a specified amount of time, although any arbitrary other action could also be configured. Out of the box Fail2Ban comes with filters for various services (apache, courier, ftp, ssh, etc).

Open a Terminal and enter the following :

sudo apt-get install fail2ban

After installation edit the configuration file /etc/fail2ban/jail.local and create the filter rules as required.

To edit the settings open a terminal window and enter:

sudo vi /etc/fail2ban/jail.conf

Activate all the services you would like fail2ban to monitor by changing enabled = false to *enabled = true*

For example if you would like to enable the SSH monitoring and banning jail, find the line below and change enabled from false to true. Thats it.

[ssh]

enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 3

If you would like to receive emails from Fail2Ban if hosts are banned change the following line to your email address.

destemail = [email protected]

and change the following line from :

action = %(action_)s

to:

action = %(action_mwl)s

You can also create rule filters for the various services that you would like fail2ban to monitor that is not supplied by default.

sudo vi /etc/fail2ban/jail.local

Good instructions on how to configure fail2ban and create the various filters can be found on HowtoForge - click here for an example

When done with the configuration of Fail2Ban restart the service with :

sudo /etc/init.d/fail2ban restart

You can also check the status with.

sudo fail2ban-client status

Check for rootkits - RKHunter and CHKRootKit.

Both RKHunter and CHKRootkit basically do the same thing - check your system for rootkits. No harm in using both.

Open a Terminal and enter the following :

sudo apt-get install rkhunter chkrootkit

To run chkrootkit open a terminal window and enter :

sudo chkrootkit

To update and run RKHunter. Open a Terminal and enter the following

sudo rkhunter --update
sudo rkhunter --propupd
sudo rkhunter --check

Scan open ports - Nmap

Nmap ("Network Mapper") is a free and open source utility for network discovery and security auditing.

Open a Terminal and enter the following :

sudo apt-get install nmap

Scan your system for open ports with :

nmap -v -sT localhost

SYN scanning with the following :

sudo nmap -v -sS localhost

Analyse system LOG files - LogWatch

Logwatch is a customizable log analysis system. Logwatch parses through your system's logs and creates a report analyzing areas that you specify. Logwatch is easy to use and will work right out of the package on most systems.

Open a Terminal and enter the following :

sudo apt-get install logwatch libdate-manip-perl

To view logwatch output use less :

sudo logwatch | less

To email a logwatch report for the past 7 days to an email address, enter the following and replace [email protected] with the required email. :

sudo logwatch --mailto [email protected] --output mail --format html --range 'between -7 days and today'

Audit your system security - Tiger.

Tiger is a security tool that can be use both as a security audit and intrusion detection system.

Open a Terminal and enter the following :

sudo apt-get install tiger

To run tiger enter :

sudo tiger

All Tiger output can be found in the /var/log/tiger

To view the tiger security reports, open a Terminal and enter the following :

sudo less /var/log/tiger/security.report.*

For More Help

Ubuntu is quite secure by default, as well as SSH is.

The most important thing is :

  1. Do not use a weak password for your user as 12345 or qwerty...
  2. Do not activate the root account
  3. Use Fail2ban or every similar software to avoid bruteforce login
  4. Check your logs regulary to see if everything is ok
  5. Install only what you need on the server and configure it carefully, I mean really read the docs deeply for every soft you use especially for mail server.

If you play that way it should be ok. Oh, and of course, make some regular backups :)

Tags:server

Related Articles

  • Important things to do after installing Ubuntu ServerJune 15

    I just installed Ubuntu Server on a VPS. To configure the server I'm reading the Ubuntu Server Guide. But the Ubuntu Server Guide doesn't tells me everything. E.g. The Ubuntu Server Guide doesn't tell me about how to secure SSH, which is, in my opini

  • Is it possible to install Ubuntu Server 10.04 *from* a USB drive?June 15

    I've tried the Universal USB Installer from PenDrive, and put 10.04 Ubuntu Server on it. But when I boot up and try to install, it looks for a Ubuntu CD ROM, which I do not have. I thought the whole point is to be able to install from a USB, which se

  • How to Install Ubuntu Server amd64 12.0.4.1 in Windows 2008 Hyper-V?December 29

    I would like to install Ubuntu Server 12.0.4.1 LTS in Windows Server 2008 Hyper-V. However when I run the Ubuntu installation from the CDROM ISO, I get stopped by the error "Your installation CD-ROM couldn't be mounted...". I found some referenc

  • How do I install Ubuntu Server 12.04 without losing my Windows 7 files? September 12

    This question already has an answer here: How do I install Ubuntu Server (step-by-step) 1 answer I have 3 partitions on my Compaq Presario CQ 57 in which: Partition 1 has 55 GB (it has Windows 7). Partition 2 has 225 GB with no data stored Partition

  • If I just install Ubuntu Server from a CD will it wipe any partitions?

    If I just install Ubuntu Server from a CD will it wipe any partitions?February 4

    I want to install Ubuntu server from a CD but it doesn't say anything about partitions or anything. How does that work? Does it even use a partition and if so which one will it use and will it ruin the data on that or any other partition? Or can is t

  • Installed Ubuntu Server on old Compaq Desktop - Fans run full-speed all the time. What to look at?July 15

    I installed Ubuntu Server on an old Compaq Desktop machine, for a development server. (Don't have the model number handy, can verify later). But when it's on, it seems the fans run loud constantly, and never go quiet or adjust, as I have noticed it w

  • Can you install Ubuntu Server in a Windows PC VM on Windows 7?

    Can you install Ubuntu Server in a Windows PC VM on Windows 7?August 15

    I am running Windows 7 64-bit. I've installed Windows Virtual PC and Windows XP Mode successfully. Next, I downloaded Ubuntu Server 9.04 32-bit. I created a new virtual machine with a dynamically expanding .vhd, loaded the Ubuntu .iso, and booted the

  • Installing Ubuntu Server through SSHNovember 7

    Does anyone know if it is possible to install Ubuntu server headless? I do know of the ability to output a terminal to a COM port, BUT, I was wondering if there was a way to drop a prompt, install SSH, and relaunch the setup through SSH. ------------

  • IBM HostRAID not detected when Installing Ubuntu server 9.10March 11

    I'm wanting to install Ubuntu Server 9.10 onto an IBM xSeries 306m. The onboard SATA RAID controller is not being correctly detected. Has anyone had experience installing Ubuntu or Linux onto one of these machines and encountered this problem? The SA

  • How do you install Ubuntu Server with a custom kernel?July 23

    I'm installing Ubuntu Server in a machine that has certain RAID controller not supported by the default kernel. A patch for the kernel has to be downloaded and compiled as a module for this to work. As this is going to be the booting volume, the modu

  • How to install Ubuntu server on a Dell R210 with S100 raid controllerSeptember 30

    I'm trying to install Ubuntu server on a R210 with a S100 raid controller. It's a software controlled RAID, and it's not recognized in Ubuntu. So I guess I have to disable it and use the software raid provided in Ubuntu (mbabm). I'm a bit lost about

  • Install Ubuntu Server w/o Monitor? November 13

    I have a headless storage server with preconfigured Windows Home Server. How can I install Ubuntu without a display? Do I have to build a custom install flash drive? If so, what would be the basic procedure? Is there a program (like unetbootin) to do

  • Why do I get a purple screen whilst installing Ubuntu Server 11.04

    Why do I get a purple screen whilst installing Ubuntu Server 11.04July 15

    I'm trying to install Ubuntu Server 11.04 on an 64-bit AMD machine. The install goes fine until after "Loading additional components", then I get a blank purple screen with a responsive cursor at the bottom. I've looked everywhere and can't find

  • Installing Ubuntu Server on MacMini Server 5,3October 6

    I've gotten hold of a neat new Mac Mini, i7 processor, 2x500GB hard drives and so on - model MacMini5,3. (from sysctl hw.model) I now want to install Ubuntu Server on it as I am not super comfortable in OS X Server. My problem is that while I can mak

  • Is it a good idea to install ubuntu server on mac mini server machine? February 11

    I bought this to do LAMP development, but I'm tired of all the restrictions and simplicity that comes with Mac Lion Server, I wanna install ubuntu server on that machine and say good bye to all the GUI niceness that comes with it. I have two question

  • Install Problem (Ubuntu Server 10.04) with USB as it reboots when I hit 'enter' for 'Install Ubuntu Server' option! HelpFebruary 18

    We cannot seem to install Ubuntu Server with USB as it reboots when I hit 'enter' for 'Install Ubuntu Server' option. My friend wants to try setting up a server so; we downloaded Ubuntu Server 10.04.4 we created a boot CD and installed ubuntu server

  • Install Ubuntu server using alternate iso from offline Linux systemMarch 6

    I want to install Ubuntu server from my downloader alternate iso file for the Ubuntu server, without rebooting my machine. In other word, I want to install it while I am still on a Linux/Ubuntu system. How can I do this? --------------Solutions------

  • Un-install ubuntu server and grub menu March 17

    This question already has an answer here: How to remove Ubuntu and put Windows back on? 14 answers I have installed ubuntu server 11.10 and win 7 on different drives (dual boot) on my laptop. Could anyone tell me how to remove ubuntu server and grub

  • I'm not able to install Ubuntu server 12.04 on my computerMay 1

    I'm trying to install Ubuntu server 12.04 using a usb flash drive. I used a program called Universal USB Installer to generate a version bootable on the drive. Until this point is all right. During the installation, the system is trying to "load inst

  • How to Install Ubuntu server inside WindowsMay 31

    Installation How do I Install Ubuntu server inside Windows? I want to install Ubuntu server inside my windows desktop? --------------Solutions------------- If you need it to be specifically Ubuntu server, and you want to run it in Windows, the best w

Copyright (C) 2017 ceus-now.com, All Rights Reserved. webmaster#ceus-now.com 14 q. 0.911 s.