{"id":1431,"date":"2016-03-30T12:53:55","date_gmt":"2016-03-30T16:53:55","guid":{"rendered":"http:\/\/codinggorilla.domemtech.com\/?p=1431"},"modified":"2016-04-05T13:31:46","modified_gmt":"2016-04-05T17:31:46","slug":"hints-for-security-with-digitalocean-droplets","status":"publish","type":"post","link":"http:\/\/165.227.223.229\/index.php\/2016\/03\/30\/hints-for-security-with-digitalocean-droplets\/","title":{"rendered":"Hints for Securing Ubuntu on a VPS"},"content":{"rendered":"

Digital Ocean<\/a>\u00c2\u00a0and Godaddy Pro<\/a> are nice VPS providers. However, it’s important to update the security of any box you create ASAP. It took under 24 hours for one of my boxes to be hacked and turned into a DoS! Therefore, when you create your box, make sure to add a firewall immediately.<\/p>\n

    \n
  1. Add an SSH key<\/a>\u00c2\u00a0to the box so you can log into it without passwords. This can sometimes be a real pain in the ars, but it’s worth it. Remember, the server needs an “authorized_keys” file, and the client needs an agent, either Pageant or ‘eval $(ssh-agent)’.<\/li>\n
  2. Turn off passwords for SSH. After adding a key–and making sure that it works–turn off password prompting. Note: if you mess this up and can’t login\u00c2\u00a0without password prompting, you are totally screwed!\n
      \n
    1. vi \/etc\/ssh\/sshd_config, uncomment “PasswordAuthentication”, and change “PasswordAuthentication” from “yes” to “no”.<\/li>\n<\/ol>\n<\/li>\n
    2. Install UFW<\/a>\u00c2\u00a0(the “Uncomplicated Firewall”). Set up which ports that are exposed. For now, allow SSH (port 22).<\/li>\n<\/ol>\n
      sudo apt-get install ufw\r\nsudo ufw default deny incoming\r\nsudo ufw allow ssh\r\n# set up ssh before enabling ufw!\r\nsudo ufw --force enable\r\nsudo ufw status\r\n<\/pre>\n
        \n
      1. Install Fail2ban<\/a>. Fail2ban keeps track of hackers trying to get into the machine, and sets up blocks accordingly.\n
          \n
        1. sudo apt-get update<\/li>\n
        2. sudo apt-get install fail2ban<\/li>\n
        3. Install any additional rules you want.\n
            \n
          1. sudo cp \/etc\/fail2ban\/jail.conf \/etc\/fail2ban\/jail.local<\/li>\n
          2. vi \/etc\/fail2ban\/jail.local\n
              \n
            1. Add in rules, e.g., ‘^%(__prefix_line)sReceived disconnect from <HOST>: 11: (Bye Bye)? \\[preauth\\]$’.<\/li>\n<\/ol>\n<\/li>\n
            2. To test it with fail2ban-regex<\/code> or egrep, you can just strip off the ^%(__prefix_line)s<\/code> from the beginning. Add this line to the failregex<\/code> variable in your \/etc\/fail2ban\/filter.d\/sshd.conf<\/code>.<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/li>\n
            3. Check logs periodically. Look for strange happenings.\n
                \n
              1. grep sshd.\\*Failed \/var\/log\/auth.log | less<\/li>\n
              2. grep sshd.*Did \/var\/log\/auth.log | less<\/li>\n<\/ol>\n<\/li>\n
              3. Do not expose Redis<\/a>, Mongo DB<\/a>, or other unsafe programs directly past the firewall:\n
                  \n
                1. http:\/\/redis.io\/topics\/security<\/li>\n<\/ol>\n<\/li>\n
                2. Install nethogs<\/a> to see what’s going on with the network.\n
                    \n
                  1. sudo apt-get install nethogs<\/li>\n
                  2. sudo nethogs eth0<\/li>\n
                  3. creating socket failed while establishing local IP – are you rootwget -c https:\/\/github.com\/raboof\/nethogs\/archive\/v0.8.1.tar.gz<\/li>\n
                  4. wget -c https:\/\/github.com\/raboof\/nethogs\/archive\/v0.8.1.tar.gz<\/li>\n
                  5. tar xf v0.8.1.tar.gz<\/li>\n
                  6. cd .\/nethogs-0.8.1\/<\/li>\n
                  7. sudo apt-get install libncurses5-dev libpcap-devsudo apt-get install make<\/li>\n
                  8. sudo apt-get install make<\/li>\n
                  9. sudo apt-get install build-essential g++<\/li>\n
                  10. make && sudo make install<\/li>\n
                  11. nethogs<\/li>\n<\/ol>\n<\/li>\n
                  12. Run netstat<\/a> occasionally to see what ports are open.\n
                      \n
                    1. netstat -tnp<\/li>\n
                    2. netstat -tulpn<\/li>\n<\/ol>\n<\/li>\n
                    3. Amazon’s AWS<\/a> has firewalls built in around the machine when you create a VPS. You don’t need to set up these programs, but it’s a good thing to do.<\/li>\n<\/ol>\n
                      Resources<\/h3>\n
                      https:\/\/www.digitalocean.com\/community\/tutorials\/an-introduction-to-securing-your-linux-vps<\/a><\/code><\/p>\n
                      https:\/\/apps.ubuntu.com\/cat\/applications\/fail2ban\/<\/a><\/code><\/p>\n
                      https:\/\/www.digitalocean.com\/community\/tutorials\/how-to-protect-ssh-with-fail2ban-on-ubuntu-14-04<\/a><\/code><\/p>\n
                      https:\/\/dodwell.us\/security\/ufw-fail2ban-portscan\/<\/a><\/code><\/p>\n
                      http:\/\/antirez.com\/news\/96<\/a><\/code><\/p>\n
                       <\/p>\n","protected":false},"excerpt":{"rendered":"
                      Digital Ocean\u00c2\u00a0and Godaddy Pro are nice VPS providers. However, it’s important to update the security of any box you create ASAP. It took under 24 hours for one of my boxes to be hacked and turned into a DoS! Therefore, when you create your box, make sure to add a firewall immediately. Add an SSH … <\/p>\n
                      Continue reading “Hints for Securing Ubuntu on a VPS”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[],"tags":[],"_links":{"self":[{"href":"http:\/\/165.227.223.229\/index.php\/wp-json\/wp\/v2\/posts\/1431"}],"collection":[{"href":"http:\/\/165.227.223.229\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/165.227.223.229\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/165.227.223.229\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/165.227.223.229\/index.php\/wp-json\/wp\/v2\/comments?post=1431"}],"version-history":[{"count":0,"href":"http:\/\/165.227.223.229\/index.php\/wp-json\/wp\/v2\/posts\/1431\/revisions"}],"wp:attachment":[{"href":"http:\/\/165.227.223.229\/index.php\/wp-json\/wp\/v2\/media?parent=1431"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/165.227.223.229\/index.php\/wp-json\/wp\/v2\/categories?post=1431"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/165.227.223.229\/index.php\/wp-json\/wp\/v2\/tags?post=1431"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}