Ubuntu 16.04 Server Security
In this article, we will discuss some server security configurations that are best to protect Ubuntu 16.04 server environment.
Secure shared memory
First, open the configuration file for editing using the command below:
sudo nano /etc/fstab
Next, add the following line of code to the bottom of the configuration file:
tmpfs /run/shm tmpfs defaults,noexec,nosuid 0 0
Save and close the file. Then restart the server for the changes to take effect.
Enable ssh login for specific users
It is a good practice to enable ssh login for specific users. However, if you want to only allow secure shell entry for a user from a specific IP. Here are the steps to use.
For instance, allowing only secure shell entry for the user george, from IP address 192.168.6.32.
In the terminal, open the ssh config file using the following command:
sudo nano /etc/ssh/sshd_config
At the end of the file, add this line of code:
Save the file and restart sshd with the command below:
sudo service ssh restart
Currently, secure shell only allows entry by george, from IP address 192.168.6.32. At this point, if anyone other than george tries to ssh into the server; they will get a prompt for a password which will not be accepted or get denied access.
Since we all have different needs, you might want to allow all users on a particular network to access the server via ssh.
To do that, add the following line of code to the end of the ssh config file:
Restart the ssh server for changes to take effect.
Adding security login banner
Most people will not consider adding the login banner, but with the login banner, a malicious user might think twice about continuing. This process is purely psychological, but it is a step you should not overlook.
To configure it, open the configuration file with the following command:
sudo nano /etc/issue.net
Add a suitable warning and save file.
Next, disable the banner message from motd. Use the following command to open the configuration file:
sudo nano /etc/pam.d/sshd
In the configuration file, comment the following lines of code by adding # at the beginning of each line:
#session optional pam_motd.so motd=/run/motd.dynamic #session optional pam_motd.so noupdate
Now, open the ssh configuration file and comment this line of code:
Next, save the file and restart the ssh server with the following command:
sudo service ssh restart
Harden the networking layer
To simply log all malformed IPs and prevent source routing of incoming packets the Ubuntu server, open the configuration file with the following command:
sudo nano /etc/sysctl.conf
Uncomment the following lines of code:
# IP Spoofing protection net.ipv4.conf.all.rp_filter = 1 net.ipv4.conf.default.rp_filter = 1 # Ignore ICMP broadcast requests net.ipv4.icmp_echo_ignore_broadcasts = 1 # Disable source packet routing net.ipv4.conf.all.accept_source_route = 0 net.ipv6.conf.all.accept_source_route = 0 net.ipv4.conf.default.accept_source_route = 0 net.ipv6.conf.default.accept_source_route = 0 # Ignore send redirects net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.default.send_redirects = 0 # Block SYN attacks net.ipv4.tcp_syncookies = 1 net.ipv4.tcp_max_syn_backlog = 2048 net.ipv4.tcp_synack_retries = 2 net.ipv4.tcp_syn_retries = 5 # Log Martians net.ipv4.conf.all.log_martians = 1 net.ipv4.icmp_ignore_bogus_error_responses = 1 # Ignore ICMP redirects net.ipv4.conf.all.accept_redirects = 0 net.ipv6.conf.all.accept_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 net.ipv6.conf.default.accept_redirects = 0 # Ignore Directed pings net.ipv4.icmp_echo_ignore_all = 1
Save the file, and restart the service with the following command
sudo sysctl -p
Preventing IP spoofing
Finally, to prevent the server’s IP from being spoofed, open the configuration file with the following command:
sudo nano /etc/host.conf
The initial configuration looks like this:
# The "order" line is only used by old versions of the C library. order hosts,bind multi on
Change the configuration to this:
# The "order" line is only used by old versions of the C library. order bind,hosts nospoof on
Save the file. Viola! No more IP spoofing.
The configuration above is only some of the enhancements you can make to improve your server security.