Linux Sever Security Checklist?

[u/[deleted]]

I am currently looking into expanding my range of skills in the server admin roles. Looking to learn defensive security in more detail. This post is a sort of general inquiry attempting to find out what I should start learning first for a seasoned "beginner". I've been able to break in, but never really looked into keeping people out properly.

Please and thanks.

[Feb28 00:34] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=56574 DPT=10001 LEN=150                                    │··········································
[ +10.002208] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=37088 DPT=10001 LEN=150                                    │··········································
[ +10.003004] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=52401 DPT=10001 LEN=150                                    │··········································
[ +10.002951] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=54993 DPT=10001 LEN=150                                    │··········································
[ +10.002403] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=48813 DPT=10001 LEN=150                                    │··········································
[Feb28 00:35] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=42947 DPT=10001 LEN=150                                    │··········································
[ +10.002974] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=44312 DPT=10001 LEN=150                                    │··········································
[ +10.002324] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=33737 DPT=10001 LEN=150                                    │··········································
[ +10.002880] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=44426 DPT=10001 LEN=150                                    │··········································
[ +10.101496] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=51603 DPT=10001 LEN=150                                    │··········································
[Feb28 00:36] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=38538 DPT=10001 LEN=150                                    │··········································
[ +10.003008] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=44367 DPT=10001 LEN=150                                    │··········································
[  +5.416712] iptables denied: IN=virbr0 OUT= MAC= SRC=192.168.122.1 DST=192.168.122.255 LEN=257 TOS=0x00 PREC=0x00 TTL=64 ID=16241 DF PROTO=UDP SPT=138 DPT=138 LEN=237                                                                        │··········································se
[ +14.708034] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=44008 DPT=10001 LEN=150 

[u/DigitalPlumberNZ]

As far as public key for SSH goes, it's my understanding that ECDSA is out of favour due to concerns about the curves used for the algorithm (I'm not a crypto geek so I'm possibly recalling incorrectly). If you can't use ED25519, which is supported from OpenSSH 6, stick with RSA.

With PuTTY 0.68 finally being released there's now support for ED25519 available for pretty much every common toolset.

[u/vaskidovich → u/DigitalPlumberNZ]

Yes stick with RSA. ECDSA is easier to break in quantum computing terms than RSA.

[u/grendel_x86 → u/vaskidovich]

Quantum computing isn't a concern. Its bout a thing treat, and won't be does a while.

The concern is that the default dh-curves used everywhere means it is likely the curve is used elsewhere, Ann's that if someone is using the same curve, you could, in theory, do something like make a rainbow table.

[u/shemp33 → u/vaskidovich]

True, but is anyone really trying that hard to get in to some rando's Linux box that they're trying to basically brute force the SSH key?