This week we’ll be going over a very important step to setting up our servers, securing it. Everyday, servers are getting hacked due to the lack of security measures on them. This is a fairly easy thing to do, and you don’t have to worry about it after you’ve set it up.
SSH Port
One of the easiest things we can do to secure our server, is to change the port SSH runs on. Because SSH attacks are always targeted at the default SSH port (22), we can avoid any such attacks by simply having it run on a different port. You’ll need a choose a port that has not been assigned to any service yet (to avoid conflicts). Check the list of port assignments for unassigned ports, you can use one of these for your SSH port. After you’ve chosen your port (you should probably write it down, just in case you forget), you can change it by editing the /etc/ssh/sshd_config file and changing:
#Port 22
to
Port 00000
Where 00000 is the port you chose. Save the file and exit. Then we need to restart the SSH service for the changes to take affect:
service sshd reload
You will probably be logged out of SSH. From now on, you’ll need to login to SSH using the port you chose. If you’re using PuTTY, there’s a box you can change this in, if you’re using Terminal in Linux or OS X, you can add the -p parameter to specify your port.
Software Firewall
Installing a software firewall will protect our server from other types of attacks. It allows you to close any ports that aren’t in use, and will even send out email alerts when certain events happen (like whenever a root user logs into SSH). For our software firewall, we’ll be using the ConfigServer Security and Firewall. ConfigServer will allow us to automatically block IP addresses attempting to hack our server, close ports, monitor SSH logins and monitor suspicious activities on our server. It also has a convenient Webmin module, which will allow you to configure it from within Webmin.
Installing ConfigServer is simple, just run the following commands in SSH:
wget http://www.configserver.com/free/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh
perl /etc/csf/csftest.pl
Next, login to Webmin and navigate to Webmin > Webmin Configuration > Webmin Modules. Choose to install from a local file, and enter /etc/csf/csfwebmin.tgz into the textbox. Then click the Install Module button. Now, navigate to the ConfigServer configuration at System > ConfigServer Security & Firewall.
Click on Firewall Allow IPs and ensure your personal IP address (not your server’s) is listed in the file. This will ensure that your IP address does not get banned (trust me, I’ve been there, you don’t want it to happen to you).
Now, click on Firewall Configuration. ConfigServer has tons of different configuration options, but we’re only going to cover some basic ones. Feel free to read the documentation and change any other options as you see fit (be careful though, you don’t want to block people who aren’t doing anything wrong). Change the following settings:
- TCP_IN = 53,80,443,10000
(also add your custom SSH port here – don’t forget the comma)
- TCP_OUT = 25,43,53,80,443,10000
(also add your custom SSH port here – don’t forget the comma)
- UDP_IN = 53
- UDP_OUT = 53,113,123
Click the Change button at the bottom of the page. Then click the Restart csf+lfd button. Check to make sure you can still access your web server, Webmin and SSH. If you can, click on Firewall Configuration again, change TESTING to 0, click Change and the click on Restart csf+lfd.
Conclusion
We have now completed the basic setup of our server. You should now have a LAMP (Linux, Apache, MySQL, PHP) stack installed on your secured server, ready for production use! You can now, safely, begin to use your server as a web server. Next week we’ll be going over how you can transfer files onto your server. If you have any suggestions for future articles, please post them in the comments.
