What Can Be Done To Secure Ubuntu Server?
I have a project to secure Ubuntu Server as much as I can. The server is a web hosting server. The server will be running LAMP , Mail , and DNS.
Here is a list of things I do to secure my server.
- Turn on UFW (
sudo ufw enable) and then only allow ports that are actually used. (sudo ufw allow 80) - Make sure MySQL only allows connections from localhost.
- Enable TLS on mail services. Even if it's a self-signed cert. You don't want passwords sent in the clear.
- Install ssh bruteforce blockers like denyhosts or fail2ban. (
sudo apt-get install denyhosts) - Look into making ssh key-based logins only.
- Learn AppArmor. If you use fairly vanilla configurations, then it's extremely easy. Just make sure it's turned on. It will help reduce zero-day exploits.
- Depending on physical access to the server, you may even want to look at encrypting the data on the harddisk.
- Follow other recommendations in https://help.ubuntu.com/18.04/serverguide/security.html.
- Never trust your users. If you are having multiple users with access to the system, lock them down. If you have to give them sudo access, give them only what they need.
- Use common sense. Think real hard about how you'd get in if you were ever locked out. Then close those holes.
A few more things to consider. Most people forget about physical access. All the software configurations in the world don't mean anything if I can physically walk in with a LiveCD and steal your data. Beware of social engineering. Ask questions to verify who is on the phone and make sure they have the authorization to make the request they are making.
You can read up more about this subject on https://help.ubuntu.com/18.04/serverguide/index.html and pay special attention to https://help.ubuntu.com/18.04/serverguide/security.html.
Since you said this is web-hosting-server... I would like to share my best practices and experience of 5 long years in the web-hosting line.
From my past experiences, rather than going into configuration hell straight away, you should first assemble the low hanging grapes of security as indicated on the given article.
Since you are having LAMP, thus you must be very cautious bout PHP and its php.ini settings. This is a good link for securing PHP. PHP has super powers which may become security loop when not configured properly.
You may use a cron job to check when your files were modified without your permission and possibly hacked; using this cron job. I prefer Notepad++ to compare the cron results (directly download the cron email from your web server and open in Notepad++).
If you want to install some SEM, then cPanel is best preferred (however paid). Webmin and zpanel are very good free alternatives. Webmin is better for it atleast uses self signed certificates and adds security.
If you want something to work right out of the box then you may go for Turnkey Linux. It is based on Ubuntu, extremely easy to implement and flexible to your needs. With very little effort you get security out of the box. This is their LAMP stack. I personally use and prefer this only.
If you are starting from scratches, then you may also install ISPconfig3. Instruction Here.
you may test your security by trying to penetrate your security using Back-Track-Linux.
keep complex long and random passwords. Dont store them on PC. write them down. Use a live CD to access these logins.
get a brute force protection software like fail2ban.
Dont run those daemons which you don't need.
Block all the unnecessary ports. be extremely careful with SSH port (22).
Get yourself with a static IP on the system through which you gonna manage the server. Make most of the things IP block and only allow your particular IP to access those configuration places like port 22.
In the end of the day... work with utter piece of mind, don't get emotional with the install and applying common sense takes you far beyond.
**My heartiest best wishes to you. good luck.**