Contents
1.SSH Service Security Settings
The SSH service allows the root user to log in by default, and since the root user already knows the user name and can log in to the server with administrative privileges once the password is known, we will deny this setting.
SSH service configuration file changes
Modify the configuration file to change the SSH service settings, which is located in "/etc/ssh/sshd_config".
This time, we will proceed by changing the default SSH port from 22 to 2244.
|
1 |
# vi /etc/ssh/sshd_config |
1
2 # This is the sshd server system-wide configuration file. See
3 # sshd_config(5) for more information.
4
5 # This sshd was compiled with PATH=/usr/local/bin:/usr/bin:/bin:/usr/games
6
7 # The strategy used for options in the default sshd_config shipped with
8 # OpenSSH is to specify options with their default value where
9 # possible, but leave them commented. Uncommented options override the
10 # default value.
11
12 Include /etc/ssh/sshd_config.d/*.conf
13
14 #Port 22
15 Port 2244
16 #AddressFamily any
17 ListenAddress 0.0.0.0
18 #ListenAddress ::
19
20 #HostKey /etc/ssh/ssh_host_rsa_key
21 #HostKey /etc/ssh/ssh_host_ecdsa_key
22 #HostKey /etc/ssh/ssh_host_ed25519_key
23
24 # Ciphers and keying
25 #RekeyLimit default none
26
27 # Logging
28 #SyslogFacility AUTH
29 #LogLevel INFO
30
31 # Authentication:
32
33 #LoginGraceTime 2m
34 PermitRootLogin prohibit-password
35 #StrictModes yes
36 #MaxAuthTries 6
37 #MaxSessions 10
38
39 #PubkeyAuthentication yes
#Line 15 : Added ssh connection port 2244
#Line 17 : ListenAddress 0.0.0.0 Uncomment
#Change the "PermitRootLogin prohibit-password" parameter, which is found near line 34.
The parameter "inhibit-password" implies that password authentication is disabled for root.
#PermitRootLogin prohibit-password
↓
PermitRootLogin prohibit-password
Restart SSH service
|
1 |
# systemctl restart sshd |
2. Firewall Settings
Since Debian often uses software called "ufw" to configure firewalls, we will configure firewall settings using ufw.
Since ufw is not installed when the OS is installed, the ufw package must be installed prior to configuration. The following is a procedure to configure minimal filter settings after installation.
Filter rules to be set in ufw
• All packets forwarded to the server are rejected
• All packets sent from the server to the outside are allowed
• The first port to allow is the port for SSH
• Limit packets coming into the server
2.1 Installing the ufw package
|
1 |
# apt install -y ufw |
Confirmation after installation of ufw package
|
1 2 |
# dpkg -l | grep ufw ii ufw 0.36.2-9 all program for managing a Netfilter firewall |
The installed "ufw package" is now displayed
Run the "systemctl status" command to check the status of ufw
|
1 2 3 4 5 |
# systemctl status ufw ○ ufw.service - Uncomplicated firewall Loaded: loaded (/lib/systemd/system/ufw.service; enabled; preset: enabled) Active: inactive (dead) Docs: man:ufw(8) |
It can be confirmed that the ufw service is stopped by displaying "Active: inactive (dead)".
Enable ufw.
|
1 2 3 |
# systemctl enable ufw Synchronizing state of ufw.service with SysV service script with /lib/systemd/systemd-sysv-install. Executing: /lib/systemd/systemd-sysv-install enable ufw |
|
1 2 |
# ufw enable Firewall is active and enabled on system startup |
2.2 Basic firewall rule configuration
When ufw is enabled, default firewall rules are applied. If you enable it as is, you may lose communication with the server, so set up some basic rules before enabling ufw.
2.2.1 Incoming packets Default rule settings
First, set the rules for incoming packets. The general rule is to deny all incoming packets except for specific communications. Execute "ufw default deny incoming" to basically deny all incoming packets.
|
1 2 3 |
# ufw default deny incoming Default incoming policy changed to 'deny' (be sure to update your rules accordingly) |
2.2.2 Outgoing packets Default rule settings
The general rule is to allow all outgoing packets. Execute "ufw default allow outgoing" to basically allow outgoing packets.
|
1 2 3 |
# ufw default allow outgoing Default outgoing policy changed to 'allow' (be sure to update your rules accordingly) |
2.3 SSH Port Permissions
Enable automatic startup of ufw. but set SSH connection permissions first, as you may not be able to connect SSH remotely. The default SSH port is 22. Set permissions with the following command
|
1 2 |
# ufw allow ssh # ufw reload |
If you have set your own 2244 port (e.g.)
|
1 2 |
# ufw allow 2244/tcp # ufw reload |
2.4 Confirmation of ufw settings
Check the rules set in the firewall after enabling.
|
1 2 3 4 5 6 7 8 9 10 11 |
# ufw status verbose Status: active Logging: on (low) Default: deny (incoming), allow (outgoing), disabled (routed) New profiles: skip To Action From -- ------ ---- 22/tcp ALLOW IN Anywhere 2244/tcp ALLOW IN Anywhere 22/tcp (v6) ALLOW IN Anywhere (v6) 2244/tcp (v6) ALLOW IN Anywhere (v6) |
2.5. Permission for web services and other services
You can also specify a port number to allow connections, or specify an application.
You can see a list of applications with the following command.
|
1 |
# vi /etc/services |
For example, to enable http and https for web services
|
1 2 3 4 5 6 7 |
# ufw allow http Rule added Rule added (v6) # ufw allow https Rule added Rule added (v6) # ufw reload |
2.6 Disable ipv6 ufw
|
1 2 |
# vi /etc/default/ufw IPV6=yes → IPV6=no rewrite |
Restart the firewall after all work
|
1 |
# systemctl restart ufw |