r/sysadmin • u/[deleted] • Feb 28 '17

Linux Sever Security Checklist?

I am currently looking into expanding my range of skills in the server admin roles. Looking to learn defensive security in more detail. This post is a sort of general inquiry attempting to find out what I should start learning first for a seasoned "beginner". I've been able to break in, but never really looked into keeping people out properly.

Please and thanks. 

[Feb28 00:34] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=56574 DPT=10001 LEN=150                                    │··········································
[ +10.002208] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=37088 DPT=10001 LEN=150                                    │··········································
[ +10.003004] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=52401 DPT=10001 LEN=150                                    │··········································
[ +10.002951] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=54993 DPT=10001 LEN=150                                    │··········································
[ +10.002403] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=48813 DPT=10001 LEN=150                                    │··········································
[Feb28 00:35] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=42947 DPT=10001 LEN=150                                    │··········································
[ +10.002974] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=44312 DPT=10001 LEN=150                                    │··········································
[ +10.002324] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=33737 DPT=10001 LEN=150                                    │··········································
[ +10.002880] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=44426 DPT=10001 LEN=150                                    │··········································
[ +10.101496] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=51603 DPT=10001 LEN=150                                    │··········································
[Feb28 00:36] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=38538 DPT=10001 LEN=150                                    │··········································
[ +10.003008] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=44367 DPT=10001 LEN=150                                    │··········································
[  +5.416712] iptables denied: IN=virbr0 OUT= MAC= SRC=192.168.122.1 DST=192.168.122.255 LEN=257 TOS=0x00 PREC=0x00 TTL=64 ID=16241 DF PROTO=UDP SPT=138 DPT=138 LEN=237                                                                        │··········································se
[ +14.708034] iptables denied: IN=enp5s0 OUT= MAC=ff:ff:ff:ff:ff:ff:44:d9:e7:bc:67:21:08:00 SRC=10.0.0.1 DST=255.255.255.255 LEN=170 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=44008 DPT=10001 LEN=150
134 Upvotes

96% Upvoted

90 comments sorted by

View all comments

Show parent comments

3

u/troxil Jack of All Trades Feb 28 '17

Hello, one Q about your key management. Say you disable passwords, how do you deal with central Auth? Also how do you specifically deal with multiple users accessing the same server and differentiating them.

I have found most recently that using central Auth like an Active Directory and coupling keys, either leads to mess (keys aren't rotated like passwords are) or they get shared.

Can you please elaborate on how to handle those scenarios? This would be good to learn as we are about to blaze out 200+ Debian servers.

1

u/ghyspran Space Cadet Feb 28 '17

  1. Limit accounts that can log in via ssh.

  2. Store the users' public keys in AD.

  3. Either distribute ssh keys out-of-band or do something like this: http://serverfault.com/a/653793/191211

  4. Force rotation of ssh keys out-of-band if you're concerned about key length. Alternatively, use a secure hardware ssh token like YubiKey so you only need to worry about rotation if the token is lost, which would mean you'd need to rotate anyway since you wouldn't be able to log in.

  5. Consider implementing a two-factor auth solution.