Comment by buro9 | Hacker News Reader

Comment by buro9 | Hacker News Reader

Parent Full thread

On the cheap Linode instances I setup for others, I always install this: http://www.configserver.com/cp/csf.html

It includes the equivalent of fail2ban, manages iptables, watches log files, can email on failed logins, processes gone mad, and a few other things through a very simple config file.

It's that simplicity of the config file that I like, it means I can hand it to someone and know that they're unlikely to break something due to misconfiguration or failure to actually apply something.

This is on top of obvious things like running ssh on a non-default port, turning off password auth and restricting ssh to named users only (never root).

The install script is easy enough: http://www.configserver.com/free/csf/install.txt so it's really the case that I can do whatever work I'm doing for someone (hello Wordpress) and this can be my simple security solution which at least means I'm sure that I haven't left every window open.

If you disable logging in with the root user, ...do you allow Sudo for another user? Then, what's the point?

Because in order to do that you should need to provide a password.

Why do you run ssh on a non-default port?

To reduce noise in the logs so that I can focus on the more determined attackers rather than script kiddies just hitting the default ports on every IP.

It does nothing for security, but does help to reduce noise which in turn helps to reduce the time it takes to manage this stuff.

Brute-forcers only hit the default port. If there is no response on the default port then they just move on to greener servers.

Moving off the default port is a good way to avoid your logs getting filled up with failed login attempt messages.

Though something like fwknop would be a nicer way of resolving that.

Why not? You can always create an entry in .ssh/config for the host with the port if needed.

Host example.com

  IdentityFile ~/.ssh/id_rsa_example

  User foobar

  Hostname 127.0.0.1

  Port 1234

Always run SSH on a privileged port. An attacker could potentially run a rogue SSH instance on a non-privileged port and capture logins for other accounts.

If you run it on a privileged port (1024, or lower), it means that it can be trusted to root-level.

Reply on news.ycombinator.com