{"id":24,"date":"2019-02-02T00:28:00","date_gmt":"2019-02-02T00:28:00","guid":{"rendered":"https:\/\/hostup.org\/blog\/?p=24"},"modified":"2024-04-03T12:53:54","modified_gmt":"2024-04-03T12:53:54","slug":"how-to-secure-a-ubuntu-linux-server-in-3-simple-steps","status":"publish","type":"post","link":"https:\/\/hostup.se\/en\/blog\/how-to-secure-a-ubuntu-linux-server-in-3-simple-steps\/","title":{"rendered":"How to Secure an Ubuntu Linux Server in 3 Simple Steps"},"content":{"rendered":"\n<p>We all know that security is important, but we are usually too lazy to add basic security. In this tutorial I will show you how to secure a Linux server in 3 simple steps, starting from basic to more advanced security.<\/p>\n\n\n\n<p>This requires a VPS, if you do not already have a VPS, you can get one from HostUp starting from $3.00\/mo &#8211; <a href=\"https:\/\/hostup.se\/en\/vps\/?utm_source=blog&amp;utm_medium=tutorial&amp;utm_campaign=ubuntu_secure\">View plans<\/a>, or visit our Swedish languaged site at <a href=\"https:\/\/hostup.se\/vps\/\">hostup.se<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Create a New Account<\/h2>\n\n\n\n<p>This is not really a security &#8216;feature&#8217;, but it is always a good idea to either move away from root or setup login with authorized keys since the most common username out there is root since it is the default. For this reason, most brute-force programs tend to try to use that username.<\/p>\n\n\n\n<p>When you have logged into an SSH terminal with your specified username &amp; password proceed with the following commands to create a new root privileged account. Change <strong>changeme<\/strong> with what username you want the account to have.<\/p>\n\n\n\n<p>Create the new account:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">adduser changeme<\/pre>\n\n\n\n<p>Give the account root privilege:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">usermod -aG sudo changeme<\/pre>\n\n\n\n<p>Switch over to your newly created user account:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">su \u2013 changeme<\/pre>\n\n\n\n<p>After you have created your new account you may start a new SSH session, only this time connect with your new username &amp; password. <\/p>\n\n\n\n<script async=\"\" src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script>\n<ins class=\"adsbygoogle\" style=\"display:block; text-align:center;\" data-ad-layout=\"in-article\" data-ad-format=\"fluid\" data-ad-client=\"ca-pub-4376591297601343\" data-ad-slot=\"5387153895\"><\/ins>\n<script>\n     (adsbygoogle = window.adsbygoogle || []).push({});\n<\/script>\n\n\n\n<h2 class=\"wp-block-heading\">2. Replace Password Login With Authorized keys <\/h2>\n\n\n\n<p>Stop using passwords all together when logging into your Linux server, and replace it with public and private authentication keys instead!<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1. <\/h3>\n\n\n\n<p>Generate your 2048bit public and private keys via a generator such as <a href=\"https:\/\/www.chiark.greenend.org.uk\/~sgtatham\/putty\/latest.html\" target=\"_blank\" rel=\"noopener\">PuttyGen<\/a>. If you do not already have it you may download it from <a href=\"https:\/\/www.putty.org\/\" target=\"_blank\" rel=\"noopener\">putty.org<\/a><\/p>\n\n\n\n<p>Click the <strong>Generate button<\/strong> marked with red. You can open this window by simply searching <strong>PuttyGen<\/strong> in the Windows search box.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"480\" height=\"472\" src=\"https:\/\/hostup.org\/blog\/wp-content\/uploads\/2021\/01\/image.png\" alt=\"\" class=\"wp-image-27\" srcset=\"https:\/\/hostup.se\/en\/blog\/wp-content\/uploads\/2021\/01\/image.png 480w, https:\/\/hostup.se\/en\/blog\/wp-content\/uploads\/2021\/01\/image-300x295.png 300w\" sizes=\"auto, (max-width: 480px) 100vw, 480px\" \/><figcaption class=\"wp-element-caption\"> After you have clicked generate, follow the instructions on the screen until the loading bar is finished. <\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"479\" height=\"472\" src=\"https:\/\/hostup.org\/blog\/wp-content\/uploads\/2021\/01\/image-1.png\" alt=\"\" class=\"wp-image-29\" srcset=\"https:\/\/hostup.se\/en\/blog\/wp-content\/uploads\/2021\/01\/image-1.png 479w, https:\/\/hostup.se\/en\/blog\/wp-content\/uploads\/2021\/01\/image-1-300x296.png 300w\" sizes=\"auto, (max-width: 479px) 100vw, 479px\" \/><figcaption class=\"wp-element-caption\"> Proceed to saving the private and public keys in a safe place. <\/figcaption><\/figure>\n\n\n\n<p>You are now ready to start using your newly generated keys. Open up the contents of your public key with an editing tool such as <a href=\"https:\/\/notepad-plus-plus.org\/\" target=\"_blank\" rel=\"noopener\">NotePad++<\/a>. Back on your SSH client, run the following commands<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2.<\/h3>\n\n\n\n<p>First we want to make a new directory called <strong>ssh:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">mkdir .ssh<\/pre>\n\n\n\n<p>After this we want to create a file called <strong>authorized_keys<\/strong> where we will be putting our <strong>public key<\/strong> inside<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">nano .ssh\/authorized_keys<\/pre>\n\n\n\n<p>If you do not have nano install then please proceed to installing it by running the following command:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"> sudo apt-get install nano<\/pre>\n\n\n\n<p>You should put your <strong>public key<\/strong> in like this:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">ssh-rsa KEYHERE<\/pre>\n\n\n\n<p>Example of this being:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEApLqp8zeP5y\/7GQ99ml6325WeSr+j+vpBxi\/0YJzTgz1xkILXwjaikLaaNPP5dp7fAVyBAjl3XqlAnng7yh4KVqWSgga8drlfj1ljyzQHPeCib6pLlgyyZbh4L\/YaWjvcKfj5YK13hCUuKiHMUa69QZHmX+tT+iKr9ax49xPILGHJK8n1\/V0lYg+C+z35cS9EbHMJRP3Kx2vWFPaFkJr6OxN4N0HK3ZLYv4wdUHQbeG9Ahzj8c8iQGSgMy5lVIvlwZJAn4xE8XqjAKW7dVFwKeVciesR+HjQVvqdCq18z9fmSGN5i\/YbPfSUOKgxgtBChswf\/7BdV8XFby5Xk+hRUQ==<\/pre>\n\n\n\n<p>After this, save and exit by pressing <bawt-key>CTRL<\/bawt-key> + <bawt-key>X<\/bawt-key> and following the instructions presented on your screen. Then proceed by running the following commands to set the right privileges to the file.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">chmod 600 .ssh\/authorized_keys<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3.<\/h3>\n\n\n\n<p>Next we want to disable password authentication and only allow authentication using our newly created private and public key.<\/p>\n\n\n\n<p>First we want to open your <strong>sshd_config<\/strong> configuration file:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">nano \/etc\/ssh\/sshd_config<\/pre>\n\n\n\n<p>Find<code><strong>PasswordAuthentication yes<\/strong><\/code> and replace it with <code><strong>PasswordAuthentication no<\/strong><\/code> to disable password logins<\/p>\n\n\n\n<p>If you feel like disabling root logins: <br>Find&nbsp;<code><strong>PermitRootLogin yes<\/strong><\/code>&nbsp;and replace it with&nbsp;<code><strong>PermitRootLogin no<\/strong><\/code><br><br>Again, save and exit by pressing <bawt-key>CTRL<\/bawt-key> + <bawt-key>X<\/bawt-key> and follow the instructions presented on the screen.<\/p>\n\n\n\n<p>Restart SSH:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">sudo service sshd restart<\/pre>\n\n\n\n<p>Congratulations, you have now disabled root &amp; password logins. To login into the server in the future, you will need to use your private key. In Putty SSH client you can add this by going to:<br><br><strong>Connection &gt; SSH &gt; Auth<\/strong> and selecting your private key in the browse tab.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"452\" height=\"441\" src=\"https:\/\/hostup.org\/blog\/wp-content\/uploads\/2021\/01\/image-3.png\" alt=\"\" class=\"wp-image-30\" srcset=\"https:\/\/hostup.se\/en\/blog\/wp-content\/uploads\/2021\/01\/image-3.png 452w, https:\/\/hostup.se\/en\/blog\/wp-content\/uploads\/2021\/01\/image-3-300x293.png 300w\" sizes=\"auto, (max-width: 452px) 100vw, 452px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">3. Install a Firewall on Your Linux Server<\/h2>\n\n\n\n<p>It is highly recommended that you install a firewall and only allow for ports that you actually use.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">sudo apt-get install ufw -y<br>sudo ufw allow ssh\/tcp<br>sudo ufw limit ssh\/tcp<br>sudo ufw logging on<br>sudo ufw enable<\/pre>\n\n\n\n<p>You can add additional ports by running the command:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">sudo ufw allow PORTHERE\/tcp<\/pre>\n\n\n\n<p>Remember to replace <strong>PORTHERE<\/strong> with your specified port.<\/p>\n\n\n\n<p>Another good thing to install is <strong>Fail2ban<\/strong>. Fail2ban will monitor your firewall logs and ban any IPs that act suspiciously.<\/p>\n\n\n\n<p>To install Fail2ban firstly:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">sudo apt -y install fail2ban<\/pre>\n\n\n\n<p>After you have install your very own installation of Fail2ban, you want to make sure that it starts automaticly on restart:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">sudo systemctl enable fail2ban<\/pre>\n\n\n\n<p>All you have got left to do is to start the program:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">sudo systemctl start fail2ban<\/pre>\n\n\n\n<p>Congratulations! If you have made it this far you can be sure that your Ubuntu server is fully secured. Remember to share this tutorial to anyone who wants to have a more secure server and bookmark. It is better to be safe that sorry afterall :).<br><\/p>\n","protected":false},"excerpt":{"rendered":"<p>We all know that security is important, but we are usually too lazy to add basic security. In this tutorial I will show you how to secure a Linux server in 3 simple steps, starting from basic to more advanced security. This requires a VPS, if you do not already have a VPS, you can [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":157,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[],"class_list":["post-24","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tutorials"],"blocksy_meta":[],"_links":{"self":[{"href":"https:\/\/hostup.se\/en\/blog\/wp-json\/wp\/v2\/posts\/24","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostup.se\/en\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostup.se\/en\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostup.se\/en\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hostup.se\/en\/blog\/wp-json\/wp\/v2\/comments?post=24"}],"version-history":[{"count":5,"href":"https:\/\/hostup.se\/en\/blog\/wp-json\/wp\/v2\/posts\/24\/revisions"}],"predecessor-version":[{"id":417,"href":"https:\/\/hostup.se\/en\/blog\/wp-json\/wp\/v2\/posts\/24\/revisions\/417"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hostup.se\/en\/blog\/wp-json\/wp\/v2\/media\/157"}],"wp:attachment":[{"href":"https:\/\/hostup.se\/en\/blog\/wp-json\/wp\/v2\/media?parent=24"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostup.se\/en\/blog\/wp-json\/wp\/v2\/categories?post=24"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostup.se\/en\/blog\/wp-json\/wp\/v2\/tags?post=24"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}