How To Secure A Linux Server
This is a basic guide for securing a Linux server such as a VPS for hosting a website or something on a RaspberryPI at home.
1. Disable Root Login
This is the big one. The root account will almost certainly be used as a first attempt to access the server over SSH, since it's the obvious user name that every UNIX-like machine has and would gain you full control over the server if accessed.
1.1. Make an admin/user account
The idea is that you have a less privileged user account with which you can still perform adminstrative tasks without needing direct access to the root.
# If you are on Debian/Ubuntu/Alpine
# Here we name it admin, but you can choose whatever name you want
useradd -mG wheel admin
# Set a password for the 'admin' user
passwd admin
2. Using either doas or sudo
For using sudo you use this:
# Debian/Ubuntu
# (as root)
apt install sudo
# On Alpine
apk add sudo
# Next you edit the sudoers file
# Open /etc/sudoers with visudo,
# which is just a front-end formats
# your favorite text editor
visudo /etc/sudoers
# Between the the line that gives root sudo privileges
# and the include line add:
# Below this line
root ALL=(ALL:ALL) ALL
# Add this
%wheel ALL=(ALL:ALL) ALL
# And above this line
@includedir /etc/sudoers.d
# Alternatively, if you want password-less sudo,
# you can replace that line with:
%wheel ALL=(ALL) NOPASSWD: ALL
It should be noted that like the name of the user, the name of the group, which is now "wheel", is also completely arbitrary unless your particular system has it already set up that way.
For using doas you use this:
# For doing the same with doas:
# Install
# Debian/Ubuntu
apt install doas
# Arch Linux/Artix
pacman -S opendoas
# Alpine
apk add doas
# Create a new file called /etc/doas.conf
# and write this:
permit persist :wheel as root
# Or if you prefer it without a password
permit nopass :wheel as root
With both sudo and doas the rights can be given to the user and not to the group, just by omitting the % in the sudo config or the : in the doas.conf.
3. Making root inaccessible
BEFORE DOING ANY OF THIS. MAKE SURE THAT SUDO WORKS FOR 'admin' AND YOU WON'T LOCK YOURSELF OUT OF YOUR OWN SERVER
3.1. The login shell itself
Every user has a login shell set which he can use upon log in and which are all to be configured in `/etc/passwd`.
To make it impossible to login to the root account you can configure `/etc/passwd` such that there will be no shell for the root user, effectively making the account inaccessible, even when you have physical access to the server.
Go to the `/etc/passwd` file and change
# This
root:x:0:0:root:/root:/bin/bash
# To this
root:x:0:0:root:/root:/sbin/nologin
Beware that your login shell for root might differ, like it being set to `/bin/sh` for instance, but it should work there too.
Once this is done, it is impossible to log into the root account, so beware of this before doing this change.
3.2. SSH
To go the extra mile and make sure SSH won't accept any logins for root in first place, you can go to the `/etc/ssh/sshdconfig` and change the following:
# This
PermitRootLogin yes
# To this
PermitRootLogin no
Additionally, you should restart ssh to make the changes to be effective:
# With either sudo or doas
sudo/doas systemctl restart sshd
If you are using a systemd-less distribution, adjust the command accordingly to fit your init system/daemon manager.