Ubuntu Server Hardening

Simple quick checklist to make sure your Ubuntu server is hardened to some degree.

Keep System Up-to-Date

Make sure your system is up to date to help patch newly patched security vulnerabilities.

• sudo apt update
• sudo apt upgrade
• sudo apt dist-upgrade

Accounts

An important part of an Operating Systems are the accounts so make sure yours are locked down.

• Create new main admin account and do not use root
• Use strong passwords

Ensure Only root has UID of O

Accounts with an UID of 0 have the highest access to a system. This most likely should be the root account.

• List all accounts with an UID of 0
  • awk -F: ‘($3=="0"){print}’ /etc/passwd

Check for Account with Empty Passwords

Do not keep accounts with no passwords.

• List all accounts with an empty password
  • cat /etc/shadow | awk -F: ($2==""){print $1}
• Change an account password
  • sudo passwd <account-name>

Lock Accounts

• Lock an account
  • passwd -l <account-name>

Adding New User Accounts

Aforementioned, it is best to not use the root account. Just create new accounts for the users that need access.

• Add new account
  • adduser <account-name>

Sudo Configuration

The Sudo package allows a regular user to run commands in an elevated context. The regular user can run a command normally restricted to the root account. The configuration file can be found at /etc/sudoers

IpTables

Operating System firewall. Very powerful tool to control the network traffic going in and out of the system. I prefer to Drop all incoming connections and only allow the specific needed connection one-by-one.

• Drop all incoming connections w/out a rule
  • iptables -P INPUT DROP
• Allow incoming already established connections
  • iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
• Allow inbound connection to loopback interface
  • iptables -A -l lo -j ACCEPT
• Allow inbound connection from specific TCP port
  • iptables -A INPUT -p tcp -m tcp --dport <port-number> -m state --state NEW,ESTABLISHED -j ACCEPT

SSH

Configuration can be found at /etc/ssh/sshd_config

• Change default port
• Disable root login(PermitRootLogin)
• Protect against brute force
  • Install SSHGuard or Fail2Ban
• Disable roaming(UseRoaming)
• Disable IPv6(AddressFamily)
• Allow Specific Users(AllowUsers)
• Disable Empty Passwords

Restart Service

Additional Tips and Tricks:

• Display All Current Connections, Listening Services, and Processing Handling Them
  • netstat -tulpn
• Display Services and Their Status
  • service --status-all
• Check for Rootkits
  • apt install rkhunter
  • rkhunter -C
• Common Configuration File Locations
  • Apache
    • /etc/apache/apache2.conf
  • SSH
    • /etc/ssh/sshd_config
  • MySQL
    • /etc/mysql/mysql.cnf
  • Database in MySQL
    • /var/lib/mysql/
• Log Locations
  • System
    • /var/log/message
  • Authentication
    • /var/log/auth.log
    • /var/log/secure
  • Kernel
    • /var/log/kern.log
  • Crond
    • /var/log/cron.log
  • Mail server
    • /var/log/maillog
  • System boot
    • /var/log/boot.log
  • MySQL
    • /var/log/mysqld.log
  • Login records
    • /var/log/utmp or /var/log/wtmp
  • Apt package manager
    • /var/log/apt

References

https://www.nuharborsecurity.com/ubuntu-server-hardening-guide-2/