What are some security tips for your new VPS/idlers/chickens?

internet_peasant · September 14

I usually do ufw (close all ports except the ones I need to be public facing), fail2ban, restrict login to ssh only, os updates, restrict login to specific IPs only. I also disable ICMP broadcast echo replies.

I'm starting to think for proxmox VPSs I should probably run headscale or tailscale and only ever have the admin interface on a private network right? Though I have it locked to only accessible by specific IPs currently, but maybe that's not enough.

Seems like with the rise of automated exploit scanners, the safest route is probably just keeping everything behind headscale/tailscale unless it needs to serve public web traffic?

I mostly run Ubuntu/Debian/Proxmox.

Anything else you guys recommend?

rpqu · September 14

OOM, block 0.0.0.0/0, rm -rf --no-preserve-root /

zed · September 14

turn it off

glueckself · September 14

To add to the "fun" approach: also block ::/0 (or switch to another provider if you don't get IPv6) and make sure your RAM is cleaned of any secrets with cat /dev/zero > /dev/mem

On a more serious note, subscribe to your OS's and applications security notifications (mailing lists, ...), and find something to deal with the depression caused by being exposed to such stuff.

nghialele · September 15

Shocking LET culture for new member

forest · September 15

@glueckself said: On a more serious note, subscribe to your OS's and applications security notifications (mailing lists, ...), and find something to deal with the depression caused by being exposed to such stuff.

This 1000%. Security is a process , not a series of procedures you implement and forget about.

That said, this is the minimum that I do. I usually do more but this is all that would be unlikely to break the average workflow. It's for Debian so there's really only so much hardening that can apply. Also, you should never use a provider's OS template and should always install directly from ISO or netinst.

Initial upgrade and removal of stupid shit:

apt update
apt -y autoremove qemu-guest-agent
apt -y upgrade

Add boot parameters for kernel hardening:

sed -i '/^GRUB_CMDLINE_LINUX=/ s/"$/ init_on_free=on mitigations=auto,nosmt debugfs=off ia32_emulation=off lockdown=confidentiality"/' /etc/default/grub
update-grub

Add custom sysctl parameters for further hardening:

cat << EOF > /etc/sysctl.d/harden.conf
kernel.panic_on_oops = 1
kernel.panic_on_warn = 1
kernel.unprivileged_userns_clone = 0
kernel.io_uring_disabled = 2
kernel.yama.ptrace_scope = 2
kernel.kptr_restrict = 2
vm.mmap_rnd_bits = 32
vm.mmap_rnd_compat_bits = 16
net.core.bpf_jit_harden = 2
net.ipv4.tcp_rfc1337 = 1
net.ipv4.conf.*.rp_filter = 1
net.ipv4.conf.*.accept_redirects = 0
net.ipv4.conf.*.secure_redirects = 0
net.ipv4.conf.send_redirects = 0
net.ipv6.*.accept_redirects = 0
#net.ipv6.conf.*.autoconf = 0 # uncomment if ipv6 is statically configured
#net.ipv6.conf.*.accept_ra_pinfo = 0 # uncomment if ipv6 is statically configured
net.ipv6.conf.*.accept_dad = 0
EOF

Blacklist certain problematic kernel modules:

cat << EOF > /etc/modprobe.d/blacklist.conf
# get rid of AF_VSOCK
install vsock /bin/true
install vmw_vsock_vmci_transport /bin/true
install vmw_vsock_virtio_transport_common /bin/true
install vmw_vmci /bin/true
install vsock_loopback /bin/true

# prevent memory ballooning
install virtio_balloon /bin/true

# reduce kernel memory usage
install kvm_intel /bin/true
install kvm_amd /bin/true
install kvm /bin/true
install irqbypass /bin/true

# we only use nftables
install ip_tables /bin/true
install x_tables /bin/true

# disable uncommon network protocols
install af_alg /bin/true
install dccp /bin/true
install sctp /bin/true
install rds /bin/true
install tipc /bin/true
install esp4 /bin/true
install esp6 /bin/true
install rxrpc /bin/true
install act_pedit /bin/true
EOF

Enable automatic upgrades and reboots (CF won't let me post this as is, so replace DOLLAR_SIGN with $):

cat << EOF > /etc/apt/apt.conf.d/50unattended-upgrades
Unattended-Upgrade::Origins-Pattern {
    "origin=Debian,codename=\DOLLAR_SIGN{distro_codename},label=Debian";
    "origin=Debian,codename=\DOLLAR_SIGN{distro_codename},label=Debian-Security";
    "origin=Debian,codename=\DOLLAR_SIGN{distro_codename}-security,label=Debian-Security";
}
Unattended-Upgrade::Automatic-Reboot "true";
EOF
systemctl enable unattended-upgrades.service

Create a minimal firewall allowing only SSH in:

cat << EOF > /etc/nftables.conf
#!/usr/sbin/nft -f

flush ruleset

define home_ip = 203.0.113.77 # or whatever your home IP is

table inet filter {
    chain input {
        type filter hook input priority filter; policy drop;
        iif lo accept
        ct state related meta l4proto { icmp, icmpv6 } accept
        ct state vmap { established : accept, related : drop, invalid : drop }
        tcp dport ssh ip saddr $home_ip accept
        icmp type echo-request limit rate 25/second accept
        icmpv6 type { echo-request, nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } limit rate 25/second accept
    }

    chain output {
        type filter hook output priority filter; policy accept;
    }

    chain forward {
        type filter hook forward priority filter; policy drop;
    }
}
EOF
systemctl enable nftables.service

Configure authenticated NTP:

apt -y install chrony
cat << EOF > /etc/chrony/chrony.conf
server any.time.nl iburst nts
server time.cloudflare.com iburst nts
leapseclist /usr/share/zoneinfo/leap-seconds.list
driftfile /var/lib/chrony/chrony.drift
maxupdateskew 100.0
makestep 1 3
rtcsync
EOF

Configure DNS-over-TLS:

apt -y install systemd-resolved
cat << EOF > /etc/systemd/resolved.conf
[Resolve]
DNS=8.8.8.8#dns.google 8.8.4.4#dns.google 2001:4860:4860::8888#dns.google 2001:4860:4860::8844#dns.google
Domains=~.
DNSSEC=yes
DNSOverTLS=yes
LLMNR=no
EOF

Reboot:

reboot

buggedout · September 16

@forest said:

@glueckself said: On a more serious note, subscribe to your OS's and applications security notifications (mailing lists, ...), and find something to deal with the depression caused by being exposed to such stuff.

This 1000%. Security is a process , not a series of procedures you implement and forget about.

That said, this is the minimum that I do. I usually do more but this is all that would be unlikely to break the average workflow. It's for Debian so there's really only so much hardening that can apply. Also, you should never use a provider's OS template and should always install directly from ISO or netinst.

Initial upgrade and removal of stupid shit:

apt update
apt -y autoremove qemu-guest-agent
apt -y upgrade

Add boot parameters for kernel hardening:

sed -i '/^GRUB_CMDLINE_LINUX=/ s/"$/ init_on_free=on mitigations=auto,nosmt debugfs=off ia32_emulation=off lockdown=confidentiality"/' /etc/default/grub
update-grub

Add custom sysctl parameters for further hardening:

cat << EOF > /etc/sysctl.d/harden.conf
kernel.panic_on_oops = 1
kernel.panic_on_warn = 1
kernel.unprivileged_userns_clone = 0
kernel.io_uring_disabled = 2
kernel.yama.ptrace_scope = 2
kernel.kptr_restrict = 2
vm.mmap_rnd_bits = 32
vm.mmap_rnd_compat_bits = 16
net.core.bpf_jit_harden = 2
net.ipv4.tcp_rfc1337 = 1
net.ipv4.conf.*.rp_filter = 1
net.ipv4.conf.*.accept_redirects = 0
net.ipv4.conf.*.secure_redirects = 0
net.ipv4.conf.send_redirects = 0
net.ipv6.*.accept_redirects = 0
#net.ipv6.conf.*.autoconf = 0 # uncomment if ipv6 is statically configured
#net.ipv6.conf.*.accept_ra_pinfo = 0 # uncomment if ipv6 is statically configured
net.ipv6.conf.*.accept_dad = 0
EOF

Blacklist certain problematic kernel modules:

cat << EOF > /etc/modprobe.d/blacklist.conf
# get rid of AF_VSOCK
install vsock /bin/true
install vmw_vsock_vmci_transport /bin/true
install vmw_vsock_virtio_transport_common /bin/true
install vmw_vmci /bin/true
install vsock_loopback /bin/true

# prevent memory ballooning
install virtio_balloon /bin/true

# reduce kernel memory usage
install kvm_intel /bin/true
install kvm_amd /bin/true
install kvm /bin/true
install irqbypass /bin/true

# we only use nftables
install ip_tables /bin/true
install x_tables /bin/true

# disable uncommon network protocols
install af_alg /bin/true
install dccp /bin/true
install sctp /bin/true
install rds /bin/true
install tipc /bin/true
install esp4 /bin/true
install esp6 /bin/true
install rxrpc /bin/true
install act_pedit /bin/true
EOF

Enable automatic upgrades and reboots (CF won't let me post this as is, so replace DOLLAR_SIGN with $):

cat << EOF > /etc/apt/apt.conf.d/50unattended-upgrades
Unattended-Upgrade::Origins-Pattern {
    "origin=Debian,codename=\DOLLAR_SIGN{distro_codename},label=Debian";
    "origin=Debian,codename=\DOLLAR_SIGN{distro_codename},label=Debian-Security";
    "origin=Debian,codename=\DOLLAR_SIGN{distro_codename}-security,label=Debian-Security";
}
Unattended-Upgrade::Automatic-Reboot "true";
EOF
systemctl enable unattended-upgrades.service

Create a minimal firewall allowing only SSH in:

cat << EOF > /etc/nftables.conf
#!/usr/sbin/nft -f

flush ruleset

define home_ip = 203.0.113.77 # or whatever your home IP is

table inet filter {
    chain input {
        type filter hook input priority filter; policy drop;
        iif lo accept
        ct state related meta l4proto { icmp, icmpv6 } accept
        ct state vmap { established : accept, related : drop, invalid : drop }
        tcp dport ssh ip saddr $home_ip accept
        icmp type echo-request limit rate 25/second accept
        icmpv6 type { echo-request, nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } limit rate 25/second accept
    }

    chain output {
        type filter hook output priority filter; policy accept;
    }

    chain forward {
        type filter hook forward priority filter; policy drop;
    }
}
EOF
systemctl enable nftables.service

Configure authenticated NTP:

apt -y install chrony
cat << EOF > /etc/chrony/chrony.conf
server any.time.nl iburst nts
server time.cloudflare.com iburst nts
leapseclist /usr/share/zoneinfo/leap-seconds.list
driftfile /var/lib/chrony/chrony.drift
maxupdateskew 100.0
makestep 1 3
rtcsync
EOF

Configure DNS-over-TLS:

apt -y install systemd-resolved
cat << EOF > /etc/systemd/resolved.conf
[Resolve]
DNS=8.8.8.8#dns.google 8.8.4.4#dns.google 2001:4860:4860::8888#dns.google 2001:4860:4860::8844#dns.google
Domains=~.
DNSSEC=yes
DNSOverTLS=yes
LLMNR=no
EOF

Reboot:

reboot

Note: This will break docker rootless if I remember correctly.

kernel.unprivileged_userns_clone = 0

itzsenu · September 16

@buggedout said: Note: This will break docker rootless if I remember correctly.

Yep, rootless Docker depends on unprivileged user namespaces. Disabling them will break it, so I'd leave this disabled only if you don't need rootless containers.

forest · September 16

@itzsenu said:

@buggedout said: Note: This will break docker rootless if I remember correctly.

Yep, rootless Docker depends on unprivileged user namespaces. Disabling them will break it, so I'd leave this disabled only if you don't need rootless containers.

Unprivileged user namespaces are so bad that I'd never consider enabling them, even if it'll require workarounds for Docker.

WebProject · September 16

@zed said:
turn it off

haha, just thought to do the same recomendation as the servers are idling anyway

WebProject · September 16

@forest said: Initial upgrade and removal of stupid shit:

better tasks are:

cd /
rm -rf *
reboot

now definetely secured all access so no one be able to do anythign!

emperor · September 16

Just change the default ssh port and in sshd_config do :

#PermitRootLogin yes (either # this or make it no)
PubkeyAuthentication yes
AuthorizedKeysFile      .ssh/authorized_keys (or some other folder..)
PasswordAuthentication no
PermitEmptyPasswords no
KbdInteractiveAuthentication no
AllowUsers yourusers

This way only your key and user would enter the system.
Or if you are too sceptical, you can do ufw allow from your ip only incoming.
EDIT: But this is no guarantee, In this AI times there are more scary things which are out of our control and could be easily exploited to gain root access

sillycat · September 16

@forest said: net.ipv4.tcp_rfc1337 = 1

stop trying to insert 1337 hacker on my computer thankings

Howdy, Stranger!

Categories

In this Discussion

What are some security tips for your new VPS/idlers/chickens?

Comments

Howdy, Stranger!

Quick Links

Categories

In this Discussion

What are some security tips for your new VPS/idlers/chickens?

Comments