Do you Secure/Harden you Server?

graca

@earl: I noticed that debian don't have iptables enabled by default where as centos does, I have locked myself out couple of times on centos cause I forgot about the iptables.

I mean the iptables modules for OpenVz container, some provider didn't enable it by default, you have to send ticket to make your iptables rules work, I found this annoying.

earl

@graca said: I mean the iptables modules for OpenVz container, some provider didn't enable it by default, you have to send ticket to make your iptables rules work

Ohh I never knew that..

yeah having to put in a ticket for anything really kind of annoys me too, I prefer to self serve! I currently have a dedi that I have to register the MAC to IP so when I'm playing around with vmware/proxmox I have to put a ticket in all the time.

rm_

SSH:

1) disable password authenication (key only);
2) firewall off SSH to only a small set of whitelisted addresses that you connect from (if your IPv4 is dynamic, use IPv6, which are typically static);
3) set SSH to IPv6-only (optional);
4) having done the above, can leave the SSH port as default 22.

If you lock-out yourself from SSH, you can always recover via using the VPS console at the provider's control panel. And gotta use a long good password for the control panel and the VNC console.

earl

@rm_ said: If you lock-out yourself from SSH, you can always recover via using the VPS console at the provider's control panel.

Yes that thing is a life saver for sure! used it many times..

I would use IPV6 for SSH but I don't have native IPV6 yet from my ISP, well they do offer it but have not applied yet.

sentarum

I'm using Dome9.Com to security. I can open or close any port...

earl

@sentarum said: I'm using Dome9.Com to security. I can open or close any port...

Very fancy!! but unfortunately the price is a bit high for just a few hobby sites, $19/m seems to be the lowest plan.. I'm thinking more on open source compared to a commercialized solution

Bogdacutuu

@earl said: Very fancy!! but unfortunately the price is a bit high for just a few hobby sites, $19/m seems to be the lowest plan.. I'm thinking more on open source compared to a commercialized solution

there seems to be a free version for personal use
http://www.dome9.com/pricing

earl

@Bogdacutuu said: there seems to be a free version for personal use

Ah yes your right not sure how I missed that..Well I will see if that works with my DO VPS when I have the time.

taronyu

I don't harden my server at all to be honest. But I don't got any 10k visitor a day sites or any real visitor pulling thing.

jar

@taronyu said: I don't harden my server at all to be honest. But I don't got any 10k visitor a day sites or any real visitor pulling thing.

True statistic that I just made up:
99% of all attempted server hacks are a direct result of the addition of an IP address to a server.

I've had 64 visits today and over 300 brute force attempts.

taronyu

@jarland said: True statistic that I just made up:

99% of all attempted server hacks are a direct result of the addition of an IP address to a server.

What about the other %1?

I'm talking here about my private vps'es. Our dedicated servers are locked up

jar

@taronyu said: What about the other %1?

Those belong to China Telecom

jar

@taronyu said: I'm talking here about my private vps'es.

Yeah those get hammered too, unless you're just really lucky. You may want to double check the logs. No password is safe against open ended brute force attempts with no roadblocks. Even little toying around, either the password itself is worth something to you or your vps suddenly all turning into spam bots is a big inconvenience. That's why I put fail2ban on now no matter what it's for.

Neo

• SSH Keys
• (Disable Root Login/Create additional User)
• Install Fail2ban
• Change SSH Port
• Remove everything that you dont need, like bind9...

raindog308

On a related note:

http://www.lowendtalk.com/discussion/2253/building-the-ultimately-secure-vps-add-to-this-list

earl

@jarland said: 99% of all attempted server hacks are a direct result of the addition of an IP address

I guess it's a good thing all my VPS's only come with 1 IP, the last time I had two IP's was when I was with Virpus and enotech which actually included 3 IP's but that was years ago..

@Neo said: Install Fail2ban

Looks like a pretty popular program around here..

@raindog308 said: On a related note:

Thanks, Very helpful link..

kornnflake

@lainme said: I just disable password and root login, change ssh port and use ufw to configure the firewall.

same

trewq

I do almost everything mentioned above.

https://sites.google.com/site/seppsbrainoverload/it-security/2-step-verification-in-ssh

Would be fun to set that up.

earl

@trewq said: Would be fun to set that up.

Yes that looks easy enough to do..thanks for sharing.