Background: 15 years of experience in software and apparently spoiled because it was already set up correctly.

Been practicing doing my own servers, published a test site and 24 hours later, root was compromised.

Rolled back to the backup before I made it public and now I have a security checklist.

  • satans_methpipe@lemmy.world
    0·
    10 days ago

    On a new linux install or image I will always:

    • Make new users(s)
    • Setup new user to sudo
    • Change ssh port
    • Change new user to authenticate ssh via key+password
    • Disable root ssh login
    • njordomir@lemmy.world
      0·
      10 days ago

      That’s more or less the advice I’ve gotten as well. I’ve also read good things about fail2ban which tries to ban sources of repeated authentication failures to prevent brute force password attempts. I’ve used it, but the only person who has managed to get banned is myself! I did get back in after the delay, but I’m happy to know it works.

    • stebator@lemmy.world
      0·
      10 days ago
      • Setup new user to sudo

      I hope it is not a passwordless sudo, it is basically the same as root.

  • kibiz0r@midwest.socialEnglish
    0·
    12 days ago

    One time, I didn’t realize I had allowed all users to log in via ssh, and I had a user “steam” whose password was just “steam”.

    “Hey, why is this Valheim server running like shit?”

    “Wtf is xrx?”

    “Oh, it looks like it’s mining crypto. Cool. Welp, gotta nuke this whole box now.”

    So anyway, now I use NixOS.

    • pageflight@lemmy.worldEnglish
      0·
      11 days ago

      Good point about a default deny approach to users and ssh, so random services don’t add insecure logins.

  • frezik@midwest.social
    0·
    10 days ago

    I’m having the opposite problem right now. Tightend a VM down so hard that now I can’t get into it.

  • potentiallynotfelix@lemmy.fish
    0·
    11 days ago

    Weird. My last setup had a NAT with a few VMs hosting a few different services. For example, Jellyfin, a web server, and novnc/vm. That turned out perfectly fine and it was exposed to the web. You must have had a vulnerable version of whatever web host you were using, or maybe if you had SSH open without rate limits.

  • gerryflap@feddit.nl
    0·
    11 days ago

    I’ve been quite stupid with this but never really had issues. Ever since I changed the open ssh port from 22 to something else, my server is basically ignored by botnets. These days I obviously also have some other tricks like fail2ban, but it was funny how effective that was.

    • kureta@lemmy.ml
      0·
      10 days ago

      Almost the same here. I also change some ssh settings: disable root login, disable password, allow only public key login. That’s about it. I never had any problems.

    • surph_ninja@lemmy.world
      0·
      10 days ago

      We’re not really supposed to expose the ssh port to the internet at all. Better to hide it behind a vpn.

      But it’s too damn convenient for so many use cases. Fuck it. Fail2Ban works fine.

      You can also set up an ssh tarpit on port 22, which will tie up the bot’s resources and get them stuck in a loop for a while. But I didn’t think it was worth attracting extra attention from the bot admins to satisfy my pettiness.

    • LordCrom@lemmy.world
      0·
      11 days ago

      If it’s public facing, how about dont turn on ssh to the public, open it to select ips or ranges. Use a non standard port, use a cert or even a radius with TOTP like privacyIdea. How about a port knocker to open the non standard port as well. Autoban to lock out source ips.

      That’s just off the top of my head.

      There’s a lot you can do to harden a host.

      • Faresh@lemmy.mlEnglish
        0·
        10 days ago

        dont turn on ssh to the public, open it to select ips or ranges

        What if you don’t have a static IP, do you ask your ISP in what range their public addresses fall?

    • DefederateLemmyMl@feddit.nl
      0·
      11 days ago

      Do not allow username/password login for ssh

      This is disabled by default for the root user.

      $ man sshd_config

...
       PermitRootLogin
               Specifies whether root  can  log  in  using  ssh(1).   The  argument  must  be  yes,  prohibit-password,
               forced-commands-only, or no.  The default is prohibit-password.
...
  • Fedegenerate@lemmynsfw.comEnglish
    0·
    10 days ago

    I don’t think I’m ever opening up anything to the internet. It’s scary out there.

    I don’t trust my competence, and if I did, I dont trust my attention to detail. That’s why I outsource my security: pihole+firebog for links, ISP for my firewall, and Tailscale for tunnels. I’m not claiming any of them are the best, but they’re all better than me.

  • Hozerkiller@lemmy.caEnglish
    0·
    11 days ago

    I’ve gotta say this post made me appreciate switching to lemmy. This post is actually helpful for the poor sap that didn’t know better, instead of pure salt like another site I won’t mention.

    • Tablaste@linux.communityOPEnglish
      0·
      11 days ago

      I shared it because, out there, there is a junior engineer experiencing severe imposter syndrome. And here I am, someone who has successfully delivered applications with millions of users and advanced to leadership roles within the tech industry, who overlook basic security principles.

      We all make mistakes!

      • LordCrom@lemmy.world
        0·
        11 days ago

        There’s a 40 year I.T. veteran here that still suffers imposter syndrome. It’s a real thing I’ve never been able to shake off

        • pulsewidth@lemmy.world
          0·
          11 days ago

          Just look at who is in the White House, mate - and not just the president, but basically you can pick anyone he’s hand-picked for his staff.

          Surely that’s an instant cure for any qualified person feeling imposter syndrome in their job.

  • phx@lemmy.ca
    0·
    11 days ago

    Had this years ago except it was a dumbass contractor where I worked who left a Windows server with FTP services exposed to the Internet and IIRC anonymous FTP enabled, on a Friday.

    When I came in on Monday it had become a repository for warez, malware, and questionable porn. We wiped out rather than trying to recover anything.

  • recklessengagement@lemmy.world
    0·
    11 days ago

    This sounds like something everyone should go through at least once, to underscore the importance of hardening that can be easily taken for granted

  • Rentlar@lemmy.ca
    0·
    11 days ago

    I do worry about putting up public servers that other people might rely on because there’s something I might not realize making it vulnerable.

    So far I have pubkey root login only on the VPSs I’m messing around with, but my ol’ reliable private key from 6 years ago might be beginning to fall behind on encryption standards.

  • ikidd@lemmy.worldEnglish
    0·
    12 days ago

    This is like browsing /c/selfhosted as everyone portforwards every experimental piece of garbage across their router…

    • MonkeMischief@lemmy.today
      0·
      11 days ago

      portforwards every experimental piece of garbage across their router…

      Man some of those “It’s so E-Z bro” YouTubers are WAY too cavalier about doing this.

    • smiletolerantly@awful.systems
      0·
      12 days ago

      Meh. Each service in its isolated VM and subnet. Plus just generally a good firewall setup. Currently hosting ~10 services plubicly, never had any issue.

      • ikidd@lemmy.worldEnglish
        0·
        11 days ago

        Well, if you actually do that, bully for you, that’s how that should be done if you have to expose services.

        Everyone else there is probably DMZing their desktop from what I can tell.

    • InputZero@lemmy.world
      0·
      12 days ago

      Yeah the only thing forwarded past my router is my VPN. Assuming I did my job decently, without a valid private key it should be pretty difficult to compromise.