{"id":317,"date":"2008-03-29T19:00:15","date_gmt":"2008-03-29T23:00:15","guid":{"rendered":"http:\/\/blogs.law.harvard.edu\/zeroday\/2008\/03\/29\/basic-ubuntu-server-hardening\/"},"modified":"2008-03-29T19:00:15","modified_gmt":"2008-03-29T23:00:15","slug":"basic-ubuntu-server-hardening","status":"publish","type":"post","link":"https:\/\/archive.blogs.harvard.edu\/zeroday\/2008\/03\/29\/basic-ubuntu-server-hardening\/","title":{"rendered":"Basic Ubuntu Server Hardening"},"content":{"rendered":"<p>This is a basic level of hardening for Ubuntu servers and should be considered a baseline.  This tutorial will cover two topics: SSH and Firewall.  This tutorial was prepared using Ubuntu Server 8.04 beta.  <\/p>\n<p><strong>SSH<\/strong><br \/>\nedit the ssh daemon configuration file to move the ssh port away from 22.  Most worms or bots are programmed to look at 22 and bruteforce whatever is there.  Moving to an unknown port is the easiest way to decrease the level of log activity.<\/p>\n<p><code><br \/>\nzeroday&gt; sudo vi \/etc\/ssh\/sshd_config<br \/>\n<\/code><br \/>\nLook for &#8220;Port 22&#8221; and change it to a different value.  Anything above 1024 is fine.<\/p>\n<blockquote><p>\n# What ports, IPs and protocols we listen for<br \/>\nPort 65522\n<\/p><\/blockquote>\n<p>Now restart sshd<\/p>\n<p><code>zeroday&gt; sudo invoke-rc.d ssh restart<\/p>\n<p><strong>Firewall<\/strong><\/p>\n<p><a href=\"http:\/\/www.shorewall.net\/\">Shorewall<\/a> is an easy to configure Netfilter and provide a basic level of perimeter for your server's Internet facing interfaces.<\/p>\n<p><code>zeroday&gt; sudo apt-get install shorewall<\/code><\/p>\n<p>Once the system is installed it will display an error message stating it can not start until configured.  This is a \"dummy proof\" feature so that new users will not deploy Shorewall without making critical changes to the rules.  Simply put it will lock out all inbound connections if deployed as is.  This is a great way to stay secure but would prevent even ssh from working.<\/p>\n<p>The first step is to copy the example configuration files<\/p>\n<p><code>zeroday&gt; sudo cp \/usr\/share\/doc\/shorewall-common\/examples\/one-interface\/* \/etc\/shorewall<\/code><\/p>\n<p>To allow the most basic of services we will add rules to allow inbound connections for the web server and ssh server.<\/p>\n<p><code><br \/>\nzeroday&gt; sudo vi \/etc\/shorewall\/rules<br \/>\n<\/code><\/p>\n<p>Look for \"Permit all ICMP traffic FROM the firewall TO the net zone\" and add the following lines after the icmp rule:<\/p>\n<ul>\n<li>ACCEPT          net             fw              tcp 65522<\/li>\n<li>ACCEPT          net             fw              tcp 80<\/li>\n<\/ul>\n<p>Your rules file should now look like this:<\/p>\n<blockquote><p>\n# Permit all ICMP traffic FROM the firewall TO the net zone<\/p>\n<p>ACCEPT          $FW             net             icmp<br \/>\nACCEPT          net             fw              tcp 65522<br \/>\nACCEPT          net             fw              tcp 80\n<\/p><\/blockquote>\n<p>Now the last two steps are enabling the system to startup.  The first location is in the shorewall.conf file.<\/p>\n<p><code><br \/>\nzeroday&gt; sudo vi \/etc\/shorewall\/shorewall.conf<br \/>\n<\/code><\/p>\n<p>Look for the STARTUP_ENABLED variable and change it from \"No\" to \"Yes\".  This is not case sensitive.<\/p>\n<p>The file should end up looking like this:<\/p>\n<blockquote><p>\n#######################################<br \/>\n#                      S T A R T U P   E N A B L E D<br \/>\n#######################################<\/p>\n<p>STARTUP_ENABLED=YES\n<\/p><\/blockquote>\n<p>Lastly we need to change the shorewall file in \/etc\/default.  <\/p>\n<p><code><br \/>\nzeroday&gt; sudo vi \/etc\/default\/shorewall<br \/>\n<\/code><\/p>\n<p>Look for the \"startup\" parameter and change it from 0 to 1.<\/p>\n<p>It should look like this when you are done<\/p>\n<blockquote><p>\n# prevent startup with default configuration<br \/>\n# set the following varible to 1 in order to allow Shorewall to start<\/p>\n<p>startup=1\n<\/p><\/blockquote>\n<p>Now you are ready to start your firewall.  It is a good idea to double check your work.  I like to compare my edited configuration files to the originals using diff.<\/p>\n<p><code><br \/>\nzeroday&gt; for i in `ls \/etc\/shorewall`;<br \/>\n                 do<br \/>\n                 diff \/etc\/shorewall\/$i \/usr\/share\/doc\/shorewall-common\/examples\/one-interface\/$i;<br \/>\n                 done<br \/>\n<\/code><\/p>\n<p>Once you have confirmed the changes start up the firewall.<\/p>\n<p><code><br \/>\nzeroday&gt; sudo invoke-rc.d shorewall start<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"<p>This is a basic level of hardening for Ubuntu servers and should be considered a baseline. This tutorial will cover two topics: SSH and Firewall. This tutorial was prepared using Ubuntu Server 8.04 beta. SSH edit the ssh daemon configuration file to move the ssh port away from 22. Most worms or bots are programmed [&hellip;]<\/p>\n","protected":false},"author":214,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[274],"tags":[],"class_list":["post-317","post","type-post","status-publish","format-standard","hentry","category-interesting-tech"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/posts\/317","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/users\/214"}],"replies":[{"embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/comments?post=317"}],"version-history":[{"count":0,"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/posts\/317\/revisions"}],"wp:attachment":[{"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/media?parent=317"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/categories?post=317"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/tags?post=317"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}