Idea Depot

Improving the security of your fresh VPS or dedicated server running Ubuntu should be your first real task to accomplish. Having it done, you'll have less trouble later on keeping script kiddies off your server. Follow the instructions below to improve your SSH security and set up a simple firewall.

Ready, steady, go!

All the tasks were performed on my Ubuntu 6.06-based VPS from Slicehost, but they should be easily replicable on any other server running Ubuntu or similar, Debian-derived distro.

Improve SSH Security

Steps up to Disable SSH root access may not be necessary if you have root account disabled already (plain Ubuntu install should have). Follow them if your hosting provider uses a custom Ubuntu setup (Slicehost does).

First step is changing your default root password.

matid@local:~$ ssh root@server
root@server's password:
root@server:~# passwd

Choose a hard-to-guess password and keep it save just for maintenance - you shouldn't be using it more than once.

OK - let's create an administrative user we'll use to manage our server:

root@server:~# adduser --ingroup users 

You'll be asked for password and some other, optional data. Please keep in mind that it's the account you'll use frequently, so having a strong password is a must.

Now we need to assign it necessary privileges (we won't use root account anymore).

root@server:~# visudo

A text editor (nano, not vim - don't worry) will pop up. Add the following line at the end to give your user root privileges:

 ALL=(ALL) ALL

You should now check if you can use sudo with your brand new account:

root@server:~# exit
matid@local:~$ ssh server
matid@server's password:
matid@server:~$ sudo cat /etc/shadow

If you see roughly 20 lines of text from /etc/shadow everything is going smoothly.

Disable SSH root access

Now let's disable SSH root access by editing /etc/ssh/sshd_config, finding a PermitRootLogin line and changing it from yes to no. You can also change your Port from 22 to a different one - it should keep off some script kiddies and bots for a while.

Now restart SSH daemon and start feeling a bit more secure:

matid@server:~$ sudo invoke-rc.d ssh restart

Setting up a Firewall

This is also a very important step - it can save you from various hacking attempts in the future, and - it's not as hard as it may seem:

matid@server:~$ sudo apt-get install shorewall

After a while we have an iptables-based firewall ready for tweaking. Configuration files are located in /etc/shorewall and as access to this directory is denied for a normal user, we'll use administrative shell to avoid typing sudo all the time:

matid@server:~$ sudo -i
Password:
root@server:~# cd /etc/shorewall

We'll now copy some default files from /usr/share/:

root@server:/etc/shorewall# cp /usr/share/doc/default-config/interfaces .
root@server:/etc/shorewall# cp /usr/share/doc/default-config/policy .
root@server:/etc/shorewall# cp /usr/share/doc/default-config/rules .
root@server:/etc/shorewall# cp /usr/share/doc/default-config/zones .

We have to specify our network interface in /etc/shorewall/interfaces, so open it with your favourite editor and add the following line at the bottom:

net eth0 detect

Let's also add a default zone to /etc/shorewall/zones by appending this line:

net ipv4

OK, here comes the security - edit /etc/shorewall/policy and block all remote access by adding these lines to the end of the file:

fw net ACCEPT
net all DROP info
all all REJECT info

These settings will allow all outgoing transfer, drop all packages coming from outside and reject all that's left. Yet, this will also lock SSH connections, leaving us in trouble, so let us take care of /etc/shorewall/rules file:

ACCEPT net fw tcp 22 # Replace 22 with your SSH port if you changed it before

If you're planning to run WWW server you have to add:

ACCEPT net fw tcp 80

As you can see, adding custom rules is not that difficult at all. The last thing to do before actually starting our firewall is editing /etc/default/shorewall, and replacing:

startup=0

with

startup=1

Our simple firewall is now ready to start with:

matid@server:~$ sudo invoke-rc.d shorewall start

After completing these simple steps you have a secure Ubuntu server up and running. Don't forget about upgrading it frequently and enjoy!