Linux Hardening

Setup SSH Keys

ssh-keygen -t rsa -b 4096 -C "xxx@yyy.com"

Edit sshd

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.original

sudo vim /etc/ssh/sshd_config

Port 2222
ChallengeResponseAuthentication no
UsePAM no
PasswordAuthentication no
PermitRootLogin no
PermitRootLogin prohibit-password

sudo systemctl reload sshd

UFW

• sudo ufw allow 2222
• sudo ufw allow 80/tcp
• sudo ufw allow 443/tcp
• sudo ufw deny 22
• sudo ufw status
• sudo ufw reload

fail2ban / sshguard / crowdsec

sudo apt install fail2ban
sudo systemctl start fail2ban
sudo systemctl enable fail2ban

log all ssh commands

Add to /etc/bash.bashrc:
readonly PROMPT_COMMAND='history -a >(logger -t "commandlog $USER[$PWD] $SSH_CONNECTION")'

can configure syslog to forward logs elsewhere

Block Ping

sudo vim /etc/ufw/before.rules

Add under # ok icmp codes for INPUT:
Add:

-A ufw-before-input -p icmp --icmp-type echo-request -j DROP

sudo reboot

Check System

sudo ss -tulpn

# From external computer
ping xx.xx.xx.xx -t