BASIC SERVER SECURITY (EN)

Create accounts

Access to the server should always be via dedicated user accounts and not via centralized accounts or even the root user. There are two simple reasons for this:

1. If a user is compromised, that user's access can be revoked. 2. It is possible to track which user made which changes.

A user account is created using sudo adduser <username> --force-badname. The user is then added to the sudo group so that they can execute commands as an administrator: sudo usermod -aG sudo <username>.

In principle, access should only be possible via SSH keys. To do this, store the public SSH key in the user account. Use sudo su <username> to switch to the newly created user and create the .ssh directory in their home directory (mkdir ~/.ssh).

In this directory, create the authorized_keys file, which will contain the public key. The command for this is: cd ~/.ssh && nano authorized_keys. Enter the public key here and save the file. Finally, the access rights to the .ssh folder and the authorized_keys file must be set correctly. This is done with the command: chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys.

This is now repeated for each user who is to have access to the server.

Sudo only with password

To ensure that the sudo command can only be used with a password—this is an additional security mechanism—a configuration must be created. This is done using sudo nano /etc/sudoers.d/10-default-user-config. Here, an entry is created for each user account according to the following scheme: <username> ALL=(ALL) ALL. This means that the password will be requested the first time the sudo command is used in a session.

Important: Only users who have SSH access may be included in this file.

Securing SSH

Once the users have been created, SSH itself is secured. As described above, we want to prevent access for the root user and at the same time only allow login via keys. It is also a good idea to change the SSH port (preferably to a port > 1024). This does not prevent attacks, but it does make them more difficult. To do this, a configuration file for ssh is created using cd /etc/ssh/sshd_config.d && sudo nano 10-custom-ssh.conf. We use the following configuration:

Port <SSH Port>
PermitRootLogin no # Verhindert Root Login
PasswordAuthentication no # Verhindert Login mit Passwort
IgnoreRhosts yes # Deaktiviert altes RSH Protokoll

Since Ubuntu 22.04 uses ssh sockets, the port must be adjusted there. To do this, open the file with sudo nano /lib/systemd/system/ssh.socket and replace all instances of 22 with the previously selected SSH port.

Now SSH can be restarted with the commands sudo systemctl daemon-reload && sudo systemctl restart ssh.

After logging out, you can only log in with the user accounts you have created.

Disable root shell

To prevent users from switching to the root shell and executing commands there, the root shell is disabled. To do this, open the necessary configuration with sudo nano /etc/passwd and change /bin/bash to /usr/sbin/nologin in the line where root is located. This prevents users from switching to the root shell with su root. Any attempt to switch to the root shell is also logged.

Firewall

In the final step, a firewall is activated so that only the ports that are needed are open. This means that attempts to access other ports are blocked directly by the firewall. We use ufw as our firewall. Using sudo ufw default deny incoming and sudo ufw default allow outgoing, we block all incoming traffic and allow outgoing traffic. Now the SSH port is reopened with sudo ufw allow <SSH port>. This must not be forgotten, otherwise access via SSH will no longer work once the firewall is activated. Additional ports are opened using the same procedure. The firewall is then activated with the command sudo ufw enable.

Conclusion

This brief guide provides basic security for a server. Further configurations and security measures must be reviewed and implemented based on specific requirements.

TL;DR

For anyone who just wants a quick guide. 

Create Accounts

1. sudo adduser <username> --force-badname -> adds the account
2. sudo usermod -aG sudo <username> -> adds the account to the sudo group
3. sudo su <username> && mkdir ~/.ssh -> Switches to the created account and creates an  .ssh directory in its home directory.
4. cd ~/.ssh && nano authorized_keys -> switches to the .ssh Directory and opens the file authorized_keys. The user's public key is entered into this field.
5. chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys -> sets the appropriate access rights 

Repeat steps 1–5 for each additional user. 

Sudo only with Passwort 

1. sudo nano /etc/sudoers.d/10-default-user-config -> Create a new sudoers configuration
2. <username> ALL=(ALL) ALL -> Add this line for each user  

Only SSH accounts may be included in this file! 

Secure SSH 

1. cd /etc/ssh/sshd_config.d && sudo nano 10-custom-ssh.conf -> Create an SSH configuration with the following content
 

Port <SSH Port>
PermitRootLogin no # Prevents root login
PasswordAuthentication no # Verhindert Login with Passwort
IgnoreRhosts yes # Deactivate old RSH Protokoll

Since Ubuntu 22.04, ssh uses sockets. To change the port there as well, the following must be done

1. sudo nano /lib/systemd/system/ssh.socket
2. ListenStream=0.0.0.0:22 auf ListenStream=0.0.0.0:<SSH Port> change
3. ListenStream=[::]:22 auf ListenStream=[::]:<SSH Port> change

Restart SSH using sudo systemctl daemon-reload && sudo systemctl restart ssh. Now log out and log in with one of the accounts you created and check that everything is working.

Deactivate Root Shell 

1. sudo nano /etc/passwd -> opens the configuration
2. /bin/bash auf /usr/sbin/nologin change in the line that starts with root

Firewall

1. sudo ufw default deny incoming -> Block all incoming traffic
2. sudo ufw default allow outgoing -> allow traffic originating from the domain
3. sudo ufw allow <SSH Port> -> allow SSH 
4. sudo ufw allow <port> -> Open additional ports (if necessary)
5. sudo ufw enable -> activates the firewall. IMPORTANT: The SSH port must be open beforehand, otherwise access to the server will no longer be possible.