Linux operating system security hardening settings
Published: 2023-01-03
Basic principles of system security: only start services that are needed, only provide access to ports that are needed, and pay attention to system patch updates
1. Update software packages
centos: yum update -y
debian/ubuntu: apt update && apt upgrade -y
# Upgrade system minor version
centos: yum upgrade -y
2. Set a relatively complex password
It is recommended that passwords contain letters, numbers, symbols, uppercase and lowercase, and have sufficient length
3. Change the default remote port
/etc/ssh/sshd_config
Port 22000
systemctl restart sshd
4. Firewall settings
Only allow commonly used ports, such as remote:22000 (if the local public IP is fixed, it is best to allow only the local public IP), web:80, ftp:21
Disable UDP ports, and only allow outbound requests to external port 53
ubuntu/debian need to install: apt-get install iptables
centos: /etc/sysconfig/iptables
ubuntu: /etc/iptables.rules
debian: /etc/iptables/rules.v4
Reference rules:
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22000 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -p udp -j DROP
COMMIT
service iptables reload or systemctl reload iptables
Import iptables rules on debian: /sbin/iptables-restore < /etc/iptables/rules.v4
5. Services that do not provide external connections should listen on the loopback IP
such as redis, mysql, elasticsearch, memcache, etc.
Example:
/etc/redis/redis.conf
bind 127.0.0.1
6. Disable unnecessary system services
List running services: pstree
Stop auto-start:
centos6: chkconfig postfix off
centos7+/debian/ubuntu: systemctl stop postfix ;systemctl disable postfix