1. ---

2. Change the root password
   
   
   Code

   passwd
   
   I always use a 20-25 character long password, which consists of
   • Uppercase and Lowercase Letters
     
   • Numbers
     
   • Symbols
     
   
   A good site to use is https://strongpasswordgenerator.com/
   It'll spit out passwords like "t~4=&':71$_}@8(ZQ)@Q" which is exactly what you want.
   
   

   ---

3. Update your system
   
   You should always update your system to have the latest versions of everything installed to ensure any vulnerabilities found in the OS have been patched.
   
   Centos:
   
   Code

   yum update -y
   
   Debian/Ubuntu:
   
   Code

   apt-get update -y
and apt-get upgrade -y
   
   

   ---

4. Install Fail2Ban
   Fail2Ban is a nifty tool to have installed, which blocks malicious users/bots from bruteforcing your VPS.
   
   Centos
   
   Code

   yum install fail2ban -y
   
   If you get an error saying it's not found or something, click here
   
   Debian/Ubuntu
   
   Code

   apt-get install fail2ban -y
   
   The default config works fine but you can tweak it, just google it.
   
   Important Links:
   https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-centos-6
   https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-14-04
   
   

   ---

5. Add a non-root user
   
   Having root be able to login remotely is a huge security risk. It's the most targetted account. If you get root of a server, your like the god of the server. You have FULL ACCESS to EVERYTHING.
   
   
   Code

   useradd usernamehere
passwd usernamehere
   
   For the password, use a secure password just like you did for root at the beginning of this guide.
   
   Next we have to give this non-root user permissions.
   
   Run the command
   Code

   visudo
   
   It will open up a file, scroll down till you see
   

   Quote:root ALL=(ALL:ALL) ALL

   
   Right below it add
   
   
   Code

   TheUsernameYouCreatedHere ALL=(ALL:ALL) ALL
   
   Save the file.
   
   

   ---

6. Setup SSH Keys!
   
   I cringe every-time I see an HF user hosting something on a VPS that allows remote root logins and do not use SSH Keys and thinking their secure password 'imAl33tHax4or' is going to protect them.
   
   I'm a Mac/Linux user so I simply go to terminal on MY machine and run the command.
   
   
   Code

   ssh-keygen -t rsa
   
   If you use Windows, Putty or any other SSH client has an option to generate SSH keys.
   
   This generates an SSH Key which looks similar to this
   

   Quote:The key fingerprint is:
   4a:dd:0a:c6:35:4e:3f:ed:27:38:8c:74:44:4d:93:67 demo@a
   The key's randomart image is:
   +--[ RSA 2048]----+
   | .oo. |
   | . o.E |
   | + . o |
   | . = = . |
   | = S = . |
   | o + = + |
   | . o + o . |
   | . o |
   | |
   +-----------------+

   
   I then copy the Public SSH key onto the server by running the command
   
   
   Code

   ssh-copy-id [email protected]
   
   Note: user is the new user account we created a few steps ago. DO NOT USE ROOT
   
   If you use Windows you can use an FTP client to place the public key you generated on your machine into the /user/home/.ssh folder on your server.
   
   Important Link(s): https://www.digitalocean.com/community/tutorials/how-to-set-up-ssh-keys--2
   
   

   ---

7. Disable Root Login and Password Based Authentication
   
   SSH server settings are stored in the /etc/ssh/sshd_config file. To disable root logins open up the file by running
   
   
   Code

   nano etc/ssh/sshd_config
   
   If you do not have nano installed you can use vi or just install it by running
   Code

   yum install nano -y
   
   Set PermitRootLogin to no.
   
   Also, disable password based authentication completely. To do so
   Set PasswordAuthentication to no.
   
   Save the file and then run the following command
   
   
   Code

   service sshd restart
   
   
   That is pretty much it. There are steps you can take to further secure your box, such as locking the root account (command passwd -l root)
   
   I may post a more in-depth/advanced tutorial in the future, but I feel that this guide should put you in a good place.
   
   If you have any questions, just post below.
   
   

(Mar 1, 2016 04:54 PM)BooGod Wrote:  Nice guide, I knew you would do something good from it.

(Mar 1, 2016 04:57 PM)Cryptic™ Wrote:  After I saw how insecure Elfonzo's server's were. I searched if there were any decent server security guides on HF, and there weren't any.

So I figured I'd write one up.

(Mar 1, 2016 04:57 PM)Cryptic™ Wrote:  After I saw how insecure Elfonzo's server's were. I searched if there were any decent server security guides on HF, and there weren't any.

So I figured I'd write one up.

(Mar 3, 2016 11:51 PM)Queenie Wrote:  I'd say that changing the SSH port is a fundamental step in securing a server.

Along with that, it would be helpful to some users if you could explain a bit more about how sudo works.

Also, found an error. In the last part, it's /etc/ssh/sshd_config, not etc/ssh/sshd_config