Fedora Linux: security

Showing posts with label security. Show all posts

Slow ssh login

Originally, I thought it was the sshd DNS configuration (i.e. UseDNS) which is already set to no. It turns out that the first domain server in /etc/resolv.conf on the server is slow. After switching the order of the servers, ssh become fast again... This is related to the entries I added to hosts.deny.

Add SSL Certificate from Startcom to Apache

Get free certificates(3 files) from Startssl.com and modify the following:

SSLCertificateFile /etc/pki/tls/certs/mydomain.com.crt      #generated by startcom
SSLCertificateKeyFile /etc/pki/tls/private/mydomain.com.key #generated by startcom
SSLCACertificateFile /etc/pki/tls/certs/startcom.bundle.crt #downloaded from startcom

tcpwrapper: hosts.allow / hosts.deny

hosts.allow will overide hosts.deny.
Below is a configuration I use for my home computer that can not be connected directly from outside:

hosts.allow:
sshd: 192.168.0.0/255.255.255.224 except 192.168.0.1
hosts.deny:
sshd: ALL

The Below is a machine that can be connected from outside:

hosts.allow:
sshd: 192.168.0.0/255.255.255.224 except 192.168.0.1
hosts.deny:
sshd: PARANOID,UNKNOWN
sshd: *.com.mx,*.com.ar,*.it, *.ro

ssh session stuck

press ~ tehn . to send a break/recover.

Redirect kern.warn iptables log

add the following lines to /etc/syslog.conf

kern.warning /var/log/iptables.log

Ssh Read from remote host remote.com: Connection reset by peer

My hosting company firewall seems to drop idle connections. When I do a who on the server, there are many ssh sessions that are already dropped on the client side. I add the following to the /etc/ssh/sshd_config, then restarted the sshd. Connection reset does not happen anymore. Had to adjust ClientAliveInterval a few times to half of the firewall's timeout value.

TCPKeepAlive yes
ClientAliveInterval 240

Also you can change this in the kernel:

# cat /proc/sys/net/ipv4/tcp_keepalive_time
7200
# echo 240 > /proc/sys/net/ipv4/tcp_keepalive_time

And make changes to /etc/sysctl.conf permanently.

net.ipv4.tcp_keepalive_time = 180

Simple Security Set up

Disable ftp and telnet, use ssh instead. This is default on Redhat family. Use iptable and selinux. In addition:

Disable ssh login for root, add the following line to /etc/ssh/sshd_config:
```
PermitRootLogin no
```
Use protocol 2 in ssh
```
protocol 2
```
Reduce the number of retries
```
MaxAuthTries 1
```

Slow down sshd brute force attack with iptables (twice/min)

-A RH-Firewall-1-INPUT -p tcp --dport 22 --syn -m limit --limit 1/m --limit-burst 2 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp --dport 22 --syn -j DROP

Install pam_abl to auto blacklisting hosts.
Create nologin account for emails.
Use AllowUsers in sshd_config
```
AllowUsers userid1 userid2
```

If tried ssh more than 6 times in a second, it is rejected for one hour:

-N SSH
-N SSH_ABL
-A SSH -m recent --name SSH_ABL --update --seconds 3600 -j REJECT
-A SSH -m recent --name SSH --rcheck --seconds 60 --hitcount 6 -j SSH_ABL
-A SSH_ABL -m recent --name SSH_ABL --set -j LOG --log-level warn --log-prefix "ABL: +SSH: "
-A SSH_ABL -j REJECT
# two second pause enforced between accesses
-A SSH -m recent --name SSH --rcheck --seconds 2 -j LOG --log-level warn --log-prefix "RATE: "
-A SSH -m recent --name SSH --update --seconds 2 -j REJECT
-A SSH -m recent --name SSH_ABL --remove -j LOG --log-level warn --log-prefix "ABL: -SSH: "
-A SSH -m recent --name SSH --set -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -p tcp -m tcp --dport 22 -j SSH

tcpwrapper hosts.allow and hosts.deny.

fuser: check who is using a tcp/udp port

# fuser 702/tcp
702/tcp:              4336
# ps -ef |grep 4336
rpcuser   4336     1  0 Sep26 ?        00:00:00 rpc.statd
root      7692  7458  0 15:46 pts/0    00:00:00 grep 4336

nmap

To check machine 192.168.0.22, run nmap remotely from another machine.

# nmap -sT -sU -p 1-1023 192.168.0.22
Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2008-10-05 15:44 MDT
Interesting ports on (192.168.0.22):
Not shown: 2040 filtered ports
PORT    STATE         SERVICE
22/tcp  open          ssh
25/tcp  closed        smtp
80/tcp  closed        http
443/tcp closed        https
631/tcp closed        ipp
631/udp open|filtered unknown

Fedora Linux