This article provides essential steps to secure your Linux server by implementing best practices in authentication, network configuration, and system maintenance. By following these guidelines, you can significantly reduce the risk of unauthorized access and ensure that your server remains robust against common threats.

1. Secure SSH Access

1.1 Disable Password Authentication

To enhance security, disable password authentication for SSH and use key-based authentication instead.

  1. Generate an SSH key pair on your local machine if you don't already have one:
    2. ssh-keygen -t rsa -b 4096
  2. Copy the public key to your server:
    3. ssh-copy-id user@your_server_ip
  3. Edit the SSH daemon configuration file:
    4. nano /etc/ssh/sshd_config
  4. Set PasswordAuthentication no and ensure PubkeyAuthentication yes.
  5. Restart the SSH service to apply changes:
    6. sudo systemctl restart sshd

1.2 Change Default SSH Port

Changing the default SSH port can help reduce automated attacks.

  1. Edit the SSH daemon configuration file:
    2. nano /etc/ssh/sshd_config
  2. Set a new port number, e.g., Port 2222.
  3. Restart the SSH service to apply changes:
    4. sudo systemctl restart sshd
  4. Update your firewall rules to allow traffic on the new port.

2. Configure UFW Firewall

The Uncomplicated Firewall (UFW) provides a simple way to manage firewall settings.

  1. Install UFW if it's not already installed:
    2. sudo apt-get install ufw
  2. Allow SSH access on your chosen port (e.g., 2222):
    3. sudo ufw allow 2222/tcp
  3. Enable UFW:
    4. sudo ufw enable
  4. Check the status of UFW to ensure it's active and configured correctly:
    5. sudo ufw status verbose

3. Install Fail2Ban

Fail2Ban scans log files for suspicious activity and blocks malicious IP addresses.

  1. Install Fail2Ban:
    2. sudo apt-get install fail2ban
  2. Create a custom configuration file by copying the default jail configuration:
    3. sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
  3. Edit the custom configuration file to adjust settings as needed:
    4. nano /etc/fail2ban/jail.local
  4. Start and enable Fail2Ban:
    5. sudo systemctl start fail2ban
sudo systemctl enable fail2ban

4. Enable Automatic Security Updates

Keeping your system up to date is crucial for maintaining security.

  1. Install the unattended-upgrades package:
    2. sudo apt-get install unattended-upgrades
  2. Enable automatic updates by editing the configuration file:
    3. nano /etc/apt/apt.conf.d/20auto-upgrades
  3. Add or modify the following lines to enable upgrades:
    4. Apt::Periodic::Update-Package-Lists "1";
Apt::Periodic::Unattended-Upgrade "1";

5. Remove Unused Services

Disabling unnecessary services reduces the attack surface of your server.

  1. List all running services:
    2. sudo systemctl list-units --type=service
  2. Identify and stop unused services. For example, to disable Apache:
    3. sudo systemctl stop apache2
sudo systemctl disable apache2

Troubleshooting

  • SSH connection issues after changing the port: Ensure that your SSH client is configured to use the new port and that UFW allows traffic on this port.
  • Fail2Ban not working as expected: Check the Fail2Ban logs for errors: sudo tail -f /var/log/fail2ban.log
  • Automatic updates failing: Verify that your system is configured to use a reliable package repository and check the update logs: cat /var/log/unattended-upgrades/unattended-upgrades.log