### Make Your Server a Fortress #### A Developer's Guide to Server Security

#### Who this talk is for: Web developers who manage a cloud server, or those who want to manage one

#### Key Takeaways Attendees will leave this talk with a better understanding of the threats that impact servers, and how to mitigate those threats. They will also have a list of resources and will leave with a basic understanding of how best utilize and implement those resources.

#### Some of what this talk will cover : * Passwords - generating and protecting strong passwords<!-- .element: class="fragment fade-up" data-fragment-index="1" --> * Users - setting up, restricting access, granting rights (like sudo)<!-- .element: class="fragment fade-up" data-fragment-index="2" --> * Root - keeping access to root safe<!-- .element: class="fragment fade-up" data-fragment-index="3" --> * SSH - managing keys, defending against unautorized access<!-- .element: class="fragment fade-up" data-fragment-index="4" --> * Firewalls - enhancing security with firewall rules<!-- .element: class="fragment fade-up" data-fragment-index="5" --> * Fail2ban - rule-based control of your firewall<!-- .element: class="fragment fade-up" data-fragment-index="6" --> * Logwatch - get a daily email that summarizes security issues<!-- .element: class="fragment fade-up" data-fragment-index="7" -->


#### How to stay 100% safe

My Security Hat<!-- .element: class="fragment fade-up" data-fragment-index="1" --> ## PARANOID<!-- .element: class="fragment fade-up" data-fragment-index="2" --> <!-- .element: class="fragment fade-up" data-fragment-index="3" -->

#### Passwords * Pass Phrases<!-- .element: class="fragment fade-up" data-fragment-index="1" --> * 2FA<!-- .element: class="fragment fade-up" data-fragment-index="2" --> * Password Generator<!-- .element: class="fragment fade-up" data-fragment-index="3" --> * Password Manager<!-- .element: class="fragment fade-up" data-fragment-index="4" -->

#### Users * Regular Users<!-- .element: class="fragment fade-up" data-fragment-index="1" --> * Administrators<!-- .element: class="fragment fade-up" data-fragment-index="2" --> * Root<!-- .element: class="fragment fade-up" data-fragment-index="3" --> <aside class="notes"> Regular users<br> 1. Limit users access to only what they need<br> 2. use groups to more easily manage permissions<br><br> Administrators<br> 1. limit access by type of administrator<br> 2. not all administrators need root access<br> 3. sudo can be limited by account - not only root access<br> root<br><br> 1. no one should be able to log in as root<br> 2. no ssh access<br> 3. use sudoers for access to privileged files and operations<br><br> Create a User account<br> 1. Start DO droplet<br> 2. SSH into it<br> 3. add a user - adduser <user><br> 4. create user password - passwd <user><br> 5. add the user to the wheel (sudoers) group - usermod -aG wheel roger<br> 6. create user authorized_keys file<br> a. su roger<br> b. mkdir /home/roger/.ssh<br> c. chmod 700 /home/roger/.ssh<br> d. touch /home/roger/.ssh/authorized_keys<br> e. chmod 400 /home/roger/.ssh/authorized_keys<br><br> SSH Group<br> 1. sudo groupadd ssh-users<br> 2. sudo usermod -aG ssh-users <user><br> </aside>

#### SSH * Keys<!-- .element: class="fragment fade-up" data-fragment-index="1" --> * Server Side Configuration<!-- .element: class="fragment fade-up" data-fragment-index="2" -->

##### Keys * DSA<!-- .element: class="fragment fade-up" data-fragment-index="1" --> * ECDSA<!-- .element: class="fragment fade-up" data-fragment-index="2" --> * RSA<!-- .element: class="fragment fade-up" data-fragment-index="3" --> * Ed25519<!-- .element: class="fragment fade-up" data-fragment-index="4" --> <aside class="notes"> keys<br> 1. DSA - Digital Signature Algorithm<br> a. may be in older tutorials<br> b. insecure<br> c. deprecated in openSSH<br><br> 2. ECDCA - Edwards (Eliptical) Curve Digital Signature Algorithm<br> a. concerns with backdoors being injected<br> b. technical concerns with design flaws<br> c. slowness<br><br> 3. RSA - Rivest Shamir Adleman<br> a. bit size<br> i. 1024 has been cracked<br> ii. 2048 still safe<br> iii. 4096 secure, can be slow<br> b. required for some services<br><br> 4. Ed25519 <br> a. My choice<br> b. As secure as RSA 4096, but smaller, faster<br> i. 256 bit<br> c. Not implemented by all services<br> </aside>

##### Generating Keys

RSA <pre><code>ssh-keygen -f ~/.ssh/[keyname] -t rsa -b 4096</code></pre> <aside class="notes"> -f where to save the file<br> -t key type<br> -b key size in bits </aside>

Ed25519 <pre><code>ssh-keygen -f ~/.ssh/[keyname] -t ed25519 -a 100</code></pre> <aside class="notes"> ssh-keygen -f ~/.ssh/[keyname] -t ed25519 -a 100<br> -f where to save the file<br> -t key type<br> -a number of kdf (key derivation function) rounds<br> number of times the encryption hash is applied </aside>

On Windows - PuTTYgen


##### Copying your Public Keys to the server <pre><code>/home/[user]/.ssh/authorized_keys</code></pre><!-- .element: class="fragment fade-up" data-fragment-index="1" --> * Copy & Paste<!-- .element: class="fragment fade-up" data-fragment-index="2" --> * ssh-copy-id<!-- .element: class="fragment fade-up" data-fragment-index="3" --> <pre style="width: 100%;"><code>ssh-copy-id -i ~/.ssh/[keyname] user@n.n.n.n</code></pre><!-- .element: class="fragment fade-up" data-fragment-index="4" --> * Cool CLI command<!-- .element: class="fragment fade-up" data-fragment-index="5" --> <pre style="width: 100%;"><code>cat ~/.ssh/[keyname.pub] | / ssh -F /dev/null -i ~/.ssh/[root key] root@n.n.n.n / "cat >> /home/[user]/.ssh/authorized_keys"</code></pre><!-- .element: class="fragment fade-up" data-fragment-index="6" --> <aside class="notes"> Windows - puTTY and c&p<br> C & P is not always available<br><br> cat ~/.ssh/[keyname.pub] | ssh -F /dev/null -i ~/.ssh/[root key] root@n.n.n.n "cat >> /home/[user]/.ssh/authorized_keys"<br> </aside>

##### Server Configuration<!-- .element: class="fragment fade-up" data-fragment-index="1" --> <pre><code> /etc/ssh/sshd_config</code></pre><!-- .element: class="fragment fade-up" data-fragment-index="1" --> * change these lines<!-- .element: class="fragment fade-up" data-fragment-index="2" --> <pre style="width: 100%;"><code>PermitRootLogin no PasswordAuthentication no AllowGroups ssh-users</code></pre><!-- .element: class="fragment fade-up" data-fragment-index="2" --> * restart the ssh service<!-- .element: class="fragment fade-up" data-fragment-index="3" --> <pre style="width: 100%";><code>sudo systemctl reload sshd</code></pre><!-- .element: class="fragment fade-up" data-fragment-index="3" --> <aside class="notes"> On the server<br> MAKE A BACKUP BEFORE CHANGING<br> Optionally, user@ip<br> lines may be commented out<br> When you restart ssh you will likely be disconnected<br> </aside>

#### Firewalls * Netfilter<!-- .element: class="fragment fade-up" data-fragment-index="1" --> * iptables<!-- .element: class="fragment fade-up" data-fragment-index="2" --> * firewalld<!-- .element: class="fragment fade-up" data-fragment-index="3" --> <aside class="notes"> Netfilter is a packet filtering framework provided by the kernel<br> remainder of firewalls hook into this framework<br><br> iptables uses chains and rules<br> chains are INPUT, FORWARD, OUTPUT by default<br> all iptables rules have to be reloaded if one is added<br> UFW is abstraacted commands for iptables<br><br> firewalld runs as a daemon under systemd<br> cannot run with iptables<br><br> nftables is new, I have not used it yet </aside>

#### iptables * View iptables rules<!-- .element: class="fragment fade-up" data-fragment-index="1" --> <pre><code>sudo iptables -L</code><pre><!-- .element: class="fragment fade-up" data-fragment-index="1" --> * DROP vs REJECT<!-- .element: class="fragment fade-up" data-fragment-index="2" --> * DROP all by default<!-- .element: class="fragment fade-up" data-fragment-index="3" --> <pre><code>iptables --policy INPUT DROP</code></pre><!-- .element: class="fragment fade-up" data-fragment-index="3" --> * Allow a port through the firewall<!-- .element: class="fragment fade-up" data-fragment-index="4" --> <pre><code>sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT</code></pre><!-- .element: class="fragment fade-up" data-fragment-index="4" --> * DROP requests from an IP<!-- .element: class="fragment fade-up" data-fragment-index="5" --> <pre style="width: 100%;"><code>sudo iptables -A INPUT -p tcp -s n.n.n.n --dport 22 -j DROP</code></pre><!-- .element: class="fragment fade-up" data-fragment-index="5" --> <aside class="notes"> DROP sends the request to the abyss, REJECT reports back to the requester<br> DROP as the default policy for the INPUT chain<br><br> -A means apend<br> -p is protocol - tcp here<br> --dport means destination port<br> -j means jump, what to do with the packet<br> -s means source, can be a CIDR block<br> </aside>

#### firewalld * Get active zones<!-- .element: class="fragment fade-up" data-fragment-index="1" --> <pre style="width: 100%;"><code>sudo firewall-cmd --get-active-zones</code></pre><!-- .element: class="fragment fade-up" data-fragment-index="1" --> * Add a port to a zone<!-- .element: class="fragment fade-up" data-fragment-index="2" --> <pre style="width: 100%;"><code>sudo firewall-cmd --permanent \ --zone=public --add-port=80/tcp</code></pre><!-- .element: class="fragment fade-up" data-fragment-index="2" --> * DROP requests from an IP<!-- .element: class="fragment fade-up" data-fragment-index="3" --> <pre style="width: 100%;"><code>sudo firewall-cmd --zone=public \ --add-rich-rule='rule family="ipv4" \ source address="n.n.n.n" drop'</code></pre><!-- .element: class="fragment fade-up" data-fragment-index="3" --> <aside class="notes"> firewalld is a dynamically managed firewall<br> - doesn't require a complete firewall restart for changes<br> - therefore, doesn't require a reload of the kernel modules<br> - cannot parse rules added by iptable cli commands<br><br> zones are groups of rules. i.e. public, work, trusted<br> interfaces are assigned to zones. assigned to default if not specified<br><br> add port<br> confirm sudo firewall-cmd --zone=public --list-ports<br><br> DROP IP<br> rich rules allow more complex settings<br> note that in the example the rich rule ends with the DROP directive<br> </aside>

#### Protect with Fail2ban  <aside class="notes"> Fail2ban actively scans logs for suspicious activity and blocks activity according to rules you specify by adding firewall rules. </aside>

#### By default Fail2ban scans for: * Too many password failures<!-- .element: class="fragment fade-up" data-fragment-index="1" --> * Probes for exploits<!-- .element: class="fragment fade-up" data-fragment-index="2" --> * Other basic attacks<!-- .element: class="fragment fade-up" data-fragment-index="3" -->

#### Installation * Ubuntu<!-- .element: class="fragment fade-up" data-fragment-index="1" --> <pre style="width: 100%;"><code>sudo apt-get install -y fail2ban</code></pre><!-- .element: class="fragment fade-up" data-fragment-index="1" --> * Centos<!-- .element: class="fragment fade-up" data-fragment-index="2" --> <pre><code>sudo yum install fail2ban</code></pre><!-- .element: class="fragment fade-up" data-fragment-index="2" --> * Make sure postfix is running<!-- .element: class="fragment fade-up" data-fragment-index="3" --> <pre style="width: 100%;"><code>sudo systemctl enable postfix sudo systemctl start postfix</code></pre><!-- .element: class="fragment fade-up" data-fragment-index="3" --> * Start Fail2ban<!-- .element: class="fragment fade-up" data-fragment-index="4" --> <pre style="width: 100%;"><code>sudo systemctl enable Fail2ban sudo systemctl start Fail2ban</code></pre><!-- .element: class="fragment fade-up" data-fragment-index="4" -->

#### Components * Filters<!-- .element: class="fragment fade-up" data-fragment-index="1" --> <pre style="width: 100%;"><code>/etc/fail2ban/filter.d</code></pre><!-- .element: class="fragment fade-up" data-fragment-index="2" --> * Actions<!-- .element: class="fragment fade-up" data-fragment-index="3" --> <pre style="width: 100%;"><code>/etc/fail2ban/action.d</code></pre><!-- .element: class="fragment fade-up" data-fragment-index="4" --> * Jails<!-- .element: class="fragment fade-up" data-fragment-index="5" --> <pre style="width: 100%;"><code>/etc/fail2ban/jail.d</code></pre><!-- .element: class="fragment fade-up" data-fragment-index="6" -->

#### jail.conf * Copy jail.conf to jail.local<!-- .element: class="fragment fade-up" data-fragment-index="1" --> * Enable and Configure Jails<!-- .element: class="fragment fade-up" data-fragment-index="2" --> <pre style="width: 100%;"><code class="hljs regex" data-trim contenteditable> [jail name] enabled = true | false filter = name of filter logpath = /path/to/log maxretry = number of matches the triggers the action findtime = amount of time during which repeat matches happen bantime = how long to ban </code></pre><!-- .element: class="fragment fade-up" data-fragment-index="3" --> <aside class="notes"> /etc/fail2ban/jail.local </aside>

#### Hide Server Response Header info * PHP Version<!-- .element: class="fragment fade-up" data-fragment-index="1" --> * Server Version<!-- .element: class="fragment fade-up" data-fragment-index="2" -->

#### PHP Version * Edit php.ini - using setting below<!-- .element: class="fragment fade-up" data-fragment-index="1" --> <pre><code>expose_php = Off</code></pre><!-- .element: class="fragment fade-up" data-fragment-index="2" --> * The location of php.ini varies by OS and Webserver<!-- .element: class="fragment fade-up" data-fragment-index="3" --> <pre style="width: 100%;"><code class="hljs regex" data-trim contenteditable> find / -name php.ini </code></pre><!-- .element: class="fragment fade-up" data-fragment-index="3" -->

#### Server Version * Apache<!-- .element: class="fragment fade-up" data-fragment-index="1" --> - Debian-based: apache2.conf<!-- .element: class="fragment fade-up" data-fragment-index="2" --> - Red Hat: httpd.conf<!-- .element: class="fragment fade-up" data-fragment-index="3" --> <pre><code>ServerSignature Off ServerTokens Prod </code></pre><!-- .element: class="fragment fade-up" data-fragment-index="4" --> * Nginx - nginx.conf<!-- .element: class="fragment fade-up" data-fragment-index="5" --> <pre style="width: 100%;"><code class="hljs regex" data-trim contenteditable> server_tokens off; </code></pre><!-- .element: class="fragment fade-up" data-fragment-index="6" -->

#### Logwatch * Consolidates logs<!-- .element: class="fragment fade-up" data-fragment-index="1" --> * Configurable - get only what you want<!-- .element: class="fragment fade-up" data-fragment-index="2" --> * Scheduled eMail report<!-- .element: class="fragment fade-up" data-fragment-index="3" -->

#### Configuration * Main Configuration<!-- .element: class="fragment fade-up" data-fragment-index="1" --> <pre style="width: 100%;"><code>/usr/share/logwatch/default.conf/logwatch.conf</code></pre><!-- .element: class="fragment fade-up" data-fragment-index="2" --> * Create your own configuration<!-- .element: class="fragment fade-up" data-fragment-index="3" --> <pre style="width: 100%;"><code>/etc/logwatch/conf/logwatch.conf</code></pre><!-- .element: class="fragment fade-up" data-fragment-index="4" -->

#### What to Configure * Email to<!-- .element: class="fragment fade-up" data-fragment-index="1" --> <pre style="width: 100%;"><code>Mailto = you@yourdomain.com</code></pre><!-- .element: class="fragment fade-up" data-fragment-index="2" --> * Email From<!-- .element: class="fragment fade-up" data-fragment-index="3" --> <pre style="width: 100%;"><code>MailFrom = logwatchServer21@yourdomain.com</code></pre><!-- .element: class="fragment fade-up" data-fragment-index="4" --> * Report Range<!-- .element: class="fragment fade-up" data-fragment-index="5" --> <pre style="width: 100%;"><code>Range = yesterday</code></pre><!-- .element: class="fragment fade-up" data-fragment-index="6" --> * Report Detail<!-- .element: class="fragment fade-up" data-fragment-index="7" --> <pre style="width: 100%;"><code>Detail = Low | Medium | High</code></pre><!-- .element: class="fragment fade-up" data-fragment-index="8" -->

#### What to Configure continued * Services to Report<!-- .element: class="fragment fade-up" data-fragment-index="1" --> <pre style="width: 100%;"><code>Service = All</code></pre><!-- .element: class="fragment fade-up" data-fragment-index="2" --> * Or...<!-- .element: class="fragment fade-up" data-fragment-index="3" --> <pre style="width: 100%;"><code> Service = sendmail Service = http Service = identd Service = sshd2 Service = sudo .. </code></pre><!-- .element: class="fragment fade-up" data-fragment-index="4" -->

#### More to look at * rkhunter<!-- .element: class="fragment fade-up" data-fragment-index="1" --> * Maldet<!-- .element: class="fragment fade-up" data-fragment-index="2" --> * Change SSH port<!-- .element: class="fragment fade-up" data-fragment-index="3" --> * Automatic Security updates<!-- .element: class="fragment fade-up" data-fragment-index="4" --> - Red Hat yum-cron<!-- .element: class="fragment fade-up" data-fragment-index="5" --> - Debian unattended-updates<!-- .element: class="fragment fade-up" data-fragment-index="6" --> <aside class="notes"> rootkits - malware that gives access to restricted areas<br> it searches for files, suspecious strings, and system changes<br> Maldet uses info aggregated from multiple malware sites<br> </aside>

#### Even More to look at * auditd<!-- .element: class="fragment fade-up" data-fragment-index="1" --> * OpenSCAP<!-- .element: class="fragment fade-up" data-fragment-index="2" --> * SELinux <!-- .element: class="fragment fade-up" data-fragment-index="3" --> <aside class="notes"> auditd - daemon that monitors your system for:<br> files or direcories chaneges<br> system calls - user actions, logins, access attempts, etc<br> authentication reports<br> Security Content Automation Protocol<br> hardening tools and templates<br> Security Enhanced Linux <br> </aside>

## Resources #### RogerCreasy.com/resources/security

### Help Me Improve this Presentation #### joind.in/talk/3547d

CONTACT INFO

TWITTER:
WEB :
IRC :
HAM RADIO:

@rogercreasy
RogerCreasy.com
rogercreasy
KN4OJN

bit.ly/serverFortress