10 Basic Ways to Secure Ubuntu from Hackers

hey everyone this is tony futures tech i’m tony and in this video i’m going to give you 10 practical ways to secure your ubuntu server from hackers and bad actors now the tips in this video are not comprehensive because as you know anything that’s connected to the internet is never 100 truly secure but these tips are fundamental best practices for securing your server we’ll talk about everything from passwords and firewalls to security updates and locking down ssh so without any further ado let’s go ahead and get on into it [Music] before we begin here i just want to remind you that the latest information will be on my blog which i have linked down below.

A Production Server You Can Exclude Certain Packages

so check that out and with that said the first tip here is to make sure you keep everything up to date updates and more importantly security updates are released all the time for the packages that you have installed on your system and because of this it’s really hard to stay up to date so my recommendation is to automatically install security updates you can do this with the unattended upgrades package which gives you complete control over which updates you want to automatically install at the very least i recommend installing security updates in if this is a production server you can exclude certain packages specify if a reboot should happen and if so what time of day.

would be acceptable i have a full tutorial on unattended upgrades which i’ll have as part of a playlist at the end of this video next up let’s talk about the root user and users with sudo access as you know the root user is a very powerful user and it’s for that reason that we want to limit the need to even use this user instead it’s a better idea to temporarily elevate your privileges with the pseudo command you can give a user pseudo privileges with the user mod command like this now don’t go crazy and give all of your users pseudo access instead limit the number of users with pseudo access to maybe just one at.

most you can get a list of users in the sudo group with this command so check this out just to be sure the third tip is to enforce password complexity first you’ll want to check to see if any of your current users have empty passwords you can do this by looking at the slash etc shadow file after confirming that none of your users are passwordless install the plugable authentication module password quality package and configure the password complexity requirements i suggest adding at least a minimum length requirement of 16 characters with that in place any newly created users as well as password changes will have to abide by that complexity speaking of passwords we don’t want.

Server via Ssh Instead of a Password We

to use a password to log into the server via ssh instead of a password we want to use a key to access the remote server to set this up use the ssh keygen command to generate a key on your local system like this next copy that key to the server with the ssh copy id command like so test it out and you will now be able to log into your remote server without a password with that in place next let’s disable password-based authentication for ssh altogether open the ssh config file at slash etc ssh slash sshd underscore config uncomment the password authentication line and change the value to no while you are in here also.

uncomment the permit empty passwords line and change this value to no and also set use pam to no as well restart the ssh daemon with systemctl restart sshd and now when somebody tries to access your server via ssh without a valid public key they’ll see a permission denied error while we’re talking about ssh let’s also disallow the root user to log in via ssh similar to before open the sshd config file and change permit root login to no we start the ssh daemon with system ctl restart sshd for the changes to take effect and now the root user will not be able to log into the server via ssh another ssh security technique is to.

Change the Ssh Port the Default Ssh Port

change the ssh port the default ssh port is 22 and every hacker knows this open the ssh config file again uncomment the port line and change it from 22 to a random number i suggest looking through this wikipedia page of port numbers to find one that’s not used by another application as always restart the ssh daemon and now when somebody tries to log into your server with the default port they’ll get a connection refused error now in the future you can specify your port with the dash p flag and access your server that way the next tip here is to disable ipv6 system wide this falls into the category of if you’re not using it.

then turn it off and as a result this reduces the attack surface of your system to turn off ipv6 edit the slash etc ctl config file and add these lines to the end apply the changes with sys ctl-p and verify that ipv6 has been turned off with this command as an extra layer of security you can also turn off ipv6 connections for ssh in your ssh config file change the address family option to inet and restart the sshd server next up i recommend you use a firewall with brute force protection a firewall allows you to restrict incoming and outgoing traffic based on a set of rules and combine this with intrusion prevention software like fail.

A Web Server It’s a Great Idea To

to ban and you can automatically block an ip address after a certain number of failed login attempts i have an entire video on fail to ban which will be part of the playlist at the end of this video by default fail to ban automatically creates these firewall rules in the iptables firewall but you can also configure fail to ban to use the ufw firewall or the uncomplicated firewall instead assuming that you’re running a web server it’s a great idea to add an extra layer of security on top of your admin pages with basic authentication while some web applications have their own methods for authentication it’s never a bad idea to also leverage the server itself.

to further restrict access using basic authentication the browser will prompt the user for a username and a password when they navigate to an area of your website that you have locked down without the proper credentials the user will be prevented from loading the page again i have videos for setting up basic authentication on apache nginx and open lightspeed web servers which will be in the playlist as well number 10 here is to remove unnecessary packages there’s no need to be running an ftp server alongside of your web server if you’re not even using ftp to begin with the same goes for a whole bunch of other protocols which just open up holes in your system.

The Latest Security Tips from Me

assuming that you are not using any of these services execute this command to remove unnecessary packages that could otherwise give hackers another door into your system as a reminder check out the blog post that i have linked down below for all the latest security tips from me like this video if you found it valuable subscribe to this channel for more videos like this for me in the future and if you do i’ll see you in the next one [Music] you.