With more Linux options than any other dedicated host, ServerPronto receives lots of questions regarding best practices for Linux security. Below are 9 basic tips to help you keep your server a bit more secure than the standard install. These were written for the Red Hat edition specifically, but the concepts are similar across most Linux platforms.<\/p>\n
<\/p>\n
Edit the ssh configuration file.
\nnano \/etc\/ssh\/sshd_config
\nLocate the line \u00e2\u20ac\u0153Port 22\u00e2\u20ac\u009d.
\nComment out this line by adding a \u00e2\u20ac\u0153#\u00e2\u20ac\u009d before it. (Good practice when modifying any file)
\nInsert a new line below it \u00e2\u20ac\u0153Port ####\u00e2\u20ac\u009d (Replace #### with a number between 1024 and 65535).
\nSave the file with \u00e2\u20ac\u0153ctrl+o\u00e2\u20ac\u009d and exit the editor with \u00e2\u20ac\u0153ctrl+x\u00e2\u20ac\u009d.
\n#### is the port sshd will listen on after the next restart of sshd.<\/p>\n
Edit the ssh configuration file.
\nnano \/etc\/ssh\/sshd_config
\nLocate the line \u00e2\u20ac\u0153PermitRootLogin yes\u00e2\u20ac\u009d.
\nComment out this line by adding a \u00e2\u20ac\u0153#\u00e2\u20ac\u009d before it. (Good practice when modifying any file)
\nInsert a new line below it \u00e2\u20ac\u0153PermitRootLogin no\u00e2\u20ac\u009d.
\nSave the file with \u00e2\u20ac\u0153ctrl+o\u00e2\u20ac\u009d and exit the editor with \u00e2\u20ac\u0153ctrl+x\u00e2\u20ac\u009d.<\/p>\n
Use the adduser command to create a new user with ssh access.
\n\u00e2\u20ac\u0153adduser \u00e2\u20ac\u201cG wheel ?????\u00e2\u20ac\u009d (Replace ????? with a username 5 or more characters long).
\nSet the password for the user.
\n\u00e2\u20ac\u0153passwd ?????\u00e2\u20ac\u009d follow prompts to set the password.<\/p>\n
Open new ssh port in the firewall.<\/strong> Import a functional profile for all users with ssh access. Using your ssh client open a new connection to the server on port 22. \u00e2\u20ac\u0153\/etc\/init.d\/sshd restart\u00e2\u20ac\u009d Using your ssh client open a new connection to the server on port ####. Use \u00e2\u20ac\u0153visudo\u00e2\u20ac\u009d to remove the comment from the line \u00e2\u20ac\u0153%wheel ALL=(ALL) NOPASSWD: ALL\u00e2\u20ac\u009d ServerPronto offers affordable and secure dedicated servers<\/a> and cloud<\/a> hosting service\u00c2\u00a0packages.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":" With more Linux options than any other dedicated host, ServerPronto receives lots of questions regarding best practices for Linux security. Below are 9 basic tips to help you keep your server a bit more secure than the standard install. These were written for the Red Hat edition specifically, but the concepts are similar across most<\/p>\n","protected":false},"author":2,"featured_media":1716,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[123,340,112,27,43,42,22,18],"class_list":["post-62","post","type-post","status-publish","format-standard","has-post-thumbnail","category-dedicated-server-security","tag-cloud","tag-dedicated-serber","tag-hosting","tag-linux","tag-linux-security","tag-security","tag-server","tag-web-hosting"],"_links":{"self":[{"href":"https:\/\/www.serverpronto.com\/spu\/wp-json\/wp\/v2\/posts\/62","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.serverpronto.com\/spu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.serverpronto.com\/spu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.serverpronto.com\/spu\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.serverpronto.com\/spu\/wp-json\/wp\/v2\/comments?post=62"}],"version-history":[{"count":4,"href":"https:\/\/www.serverpronto.com\/spu\/wp-json\/wp\/v2\/posts\/62\/revisions"}],"predecessor-version":[{"id":2763,"href":"https:\/\/www.serverpronto.com\/spu\/wp-json\/wp\/v2\/posts\/62\/revisions\/2763"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.serverpronto.com\/spu\/wp-json\/wp\/v2\/media\/1716"}],"wp:attachment":[{"href":"https:\/\/www.serverpronto.com\/spu\/wp-json\/wp\/v2\/media?parent=62"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.serverpronto.com\/spu\/wp-json\/wp\/v2\/categories?post=62"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.serverpronto.com\/spu\/wp-json\/wp\/v2\/tags?post=62"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nEdit the iptables configuration file.
\nnano \/etc\/sysconfig\/iptables
\nLocate the line which contains \u00e2\u20ac\u0153–dport 22\u00e2\u20ac\u009d.
\nComment out this line by adding a \u00e2\u20ac\u0153#\u00e2\u20ac\u009d before it. (Good practice when modifying any file)
\nInsert a new line below it exactly the same except replace \u00e2\u20ac\u015322\u00e2\u20ac\u009d with the number you replaced #### with.
\nSave the file with \u00e2\u20ac\u0153ctrl+o\u00e2\u20ac\u009d and exit the editor with \u00e2\u20ac\u0153ctrl+x\u00e2\u20ac\u009d.<\/p>\nMake new user accounts easier to use.<\/strong><\/h5>\n
\nCreate a file \u00e2\u20ac\u0153nano \/etc\/environment-common\u00e2\u20ac\u009d
\nAdd the text \u00e2\u20ac\u0153${EXPORT}PATH${EQ}\/bin:\/usr\/bin:\/sbin:\/usr\/sbin:\/usr\/local\/bin:\u00e2\u20ac\u009d to the new file without the \u00e2\u20ac\u0153s.
\nSave the file with \u00e2\u20ac\u0153ctrl+o\u00e2\u20ac\u009d and exit the editor with \u00e2\u20ac\u0153ctrl+x\u00e2\u20ac\u009d.
\nOpen the profile file \u00e2\u20ac\u0153nano \/etc\/profile\u00e2\u20ac\u009d
\nAdd the text \u00e2\u20ac\u0153EQ=’=’ EXPORT=”export ” . \/etc\/environment-common\u00e2\u20ac\u009d at the end of the file.
\nSave the file with \u00e2\u20ac\u0153ctrl+o\u00e2\u20ac\u009d and exit the editor with \u00e2\u20ac\u0153ctrl+x\u00e2\u20ac\u009d.<\/p>\nTest user account.<\/strong><\/h5>\n
\nLog in with the user you created.
\nCheck superuser access by typing \u00e2\u20ac\u0153su\u00e2\u20ac\u009d and entering the root password for the server.
\nType \u00e2\u20ac\u0153exit\u00e2\u20ac\u009d twice to log off of this test session.<\/p>\nRestart changed services.<\/strong><\/h5>\n
\n\u00e2\u20ac\u0153\/etc\/init.d\/iptables restart\u00e2\u20ac\u009d<\/p>\nTest new settings.<\/strong><\/h5>\n
\nLog in with the user you created.
\nCheck superuser access by typing \u00e2\u20ac\u0153su\u00e2\u20ac\u009d and entering the root password for the server.
\nSwitch to the original session logged on as root.
\nType \u00e2\u20ac\u0153exit\u00e2\u20ac\u009d to log off of this session.<\/p>\nOptional sudo (Superuser) settings.<\/strong><\/h5>\n
\nType \u00e2\u20ac\u0153:wq\u00e2\u20ac\u009d to save and exit this program.<\/p>\nOther helpful tips.<\/strong><\/h5>\n
\n