5 Steps to Secure Linux (protect from hackers)

แชร์
ฝัง
  • เผยแพร่เมื่อ 16 ก.ย. 2024

ความคิดเห็น • 1.5K

  • @k3ym067
    @k3ym067 3 ปีที่แล้ว +867

    I just want to caution everyone from enabling automatic updates on production systems. The best practice is to use scheduled maintenance windows and to always test updates in a test/dev/QA environment before making changes to prod :)

    • @officialrotorblitz2945
      @officialrotorblitz2945 3 ปีที่แล้ว +25

      Perhaps create cronjobs to update one a month

    • @michaelj8396
      @michaelj8396 3 ปีที่แล้ว +32

      You're right. The ideal situation is using a repository host, whether that's something like Red Hat Satellite, Oracle Spacewalker, or using simple webserver which synchronizes repositories.
      You then control your packages on the upstream, so that when they are downloaded by the host - only the packages that have been tested are applied.
      This is how we automate patching - determine what updates we want > synchronise packages to repo host > create test environment to mimic prod > schedule ansible jobs via Tower to auto patch test hosts with smoke tests > when smoke tests pass, execute job on prod > run smoke tests, and if it fails, execute a job to undo the patch.

    • @FaFairuz8
      @FaFairuz8 3 ปีที่แล้ว +21

      Yes. I can't stress this enough. Upgrade on other environment first and test everything first.

    • @viktatororban4407
      @viktatororban4407 3 ปีที่แล้ว +14

      This is a BS channel for wannabee network/linux/ansible people with bloated headlines and an eyecandy editing, he barely had any real life experience with these stuff, most of the stuff he teaches about are from official rtd.

    • @liesdamnlies3372
      @liesdamnlies3372 3 ปีที่แล้ว +63

      @@viktatororban4407 Everything you listed is exactly what's appropriate to teach beginners and for enthusiasts to communicate to them. Beginners need enthusiasm to draw them onto the path of becoming an expert.

  • @jarrod752
    @jarrod752 3 ปีที่แล้ว +316

    Won 20 bucks in a networking class.
    Another student told me he could get into any computer remotely.
    I accepted his challenge and turned off my network card in the drivers.
    He was pissed.

    • @raginranga3494
      @raginranga3494 3 ปีที่แล้ว +20

      Priceless..

    • @scikk3479
      @scikk3479 3 ปีที่แล้ว +3

      🤣

    • @zammarzareen6190
      @zammarzareen6190 2 ปีที่แล้ว +1

      😂😂😂

    • @Capitaltwo3710
      @Capitaltwo3710 2 ปีที่แล้ว +14

      I bet that no-one can kill you after you've committed suicide*

    • @ducky1681
      @ducky1681 2 ปีที่แล้ว +1

      clever...

  • @johncullen3542
    @johncullen3542 3 ปีที่แล้ว +91

    Definitely one of the top 3 videos of all time to date... changing TCP ports, encrypted authentication, and disabling ping. Love it... Thanks again Chuck!

    • @lukutoukka6747
      @lukutoukka6747 6 หลายเดือนก่อน

      Great video. I am Gonna subs.

  • @m97120
    @m97120 3 ปีที่แล้ว +90

    You should use "apt upgrade" instead of "apt dist-upgrade" as the latter might also remove packages or change things in the system which might break your applications. "dist-upgrade" should be used if you want to upgrade to a new release of the distro, not if you just want the latest versions of your packages in order to get security fixes.

  • @HopliteSecurity
    @HopliteSecurity 2 ปีที่แล้ว +77

    As a security professional I really found this video to be of good quality. You were to the point, informative but not overbearing, engaging while being authentic. Keep up the great work! ❤ 😍

    • @niksatt4843
      @niksatt4843 ปีที่แล้ว +7

      He's literally the only TH-camr that breaks it down enough to where even my bricked brain understands

  • @uwemeyer1688
    @uwemeyer1688 3 ปีที่แล้ว +50

    The way you deliver content is outstanding. English is my second language, but you somehow manage to be quick, to the point, and very understandable. Kudos. Fantastic work.

    • @manobrodeful
      @manobrodeful 3 ปีที่แล้ว +5

      Same here! All of his videos are really understandable and easy to learn.

  • @gswhite
    @gswhite 3 ปีที่แล้ว +26

    Brilliant. Coming from a person who is very comfortable with Linux, is so nice to see the simple security aspects covered. And I always love how enthusiastic you are, making I.T fun!! Big fan here, over in London /UK! Keep it up, and great to see your channel growing as well. Keep you fed :)

    • @NetworkChuck
      @NetworkChuck  3 ปีที่แล้ว +4

      Thank you 😊

    • @justcallmetruman
      @justcallmetruman 11 หลายเดือนก่อน +1

      Chucks the man but I've always wondered how much coffee he really drinks everyday.

    • @jirehla-ab1671
      @jirehla-ab1671 5 หลายเดือนก่อน

      Can u do videos on selinux but with a different twist​@@NetworkChuck

  • @Eschguy
    @Eschguy 3 ปีที่แล้ว +18

    Perfect timing, man! Just fired up my first Linux server this week!

  • @dertoradium
    @dertoradium 3 ปีที่แล้ว +3

    Just as a correction
    for macOS the command ssh-copy-id @ does also work.

  • @vasiovasio
    @vasiovasio 3 ปีที่แล้ว +9

    Linode, just to tell you - A really good choice for sponsorship! Keep going, his style is a remarkable combination of useful information and energetic hype!

  • @kpopempire1475
    @kpopempire1475 2 ปีที่แล้ว +8

    20:41 - The line was already there (the last entry in that section). All he had to do was change the ACCEPT to DROP. ICMP ping may be blocked but hackers can still find his server using the nmap utility. Great video though. Love the channel!

  • @joshuapettus6973
    @joshuapettus6973 3 ปีที่แล้ว +30

    It seems standard IT advice is to replace the password in ssh with the RSA key, but this thinking, I feel, is wrong. I would only do that if it was intranet only and I was feeling lazy. You can, and it's much better to, use both! What if a machine that had your RSA private key somehow gets compromised (I for one have multiple some of which are portable)? You would be done. Yes you can put a passphrase on the private key, but you are just buying yourself time, if you even know it was compromised in the first place. Having the password as well is a simple way to have MFA which is a must for any server you have on the internet. The RSA key is the thing you have, coupled with the thing you know i.e. password. Setup fail2ban on SSH, to protect against simple brute force, and you got a fairly strong setup. Even better is what I do and setup Google Authenticator on on that SSH stack, but I'll admit that maybe overkill :).
    Also another bit of SSH advice is make it so the SSH user has no administrative powers, don't even put them in the sudoers group. Remember sudo allows administrative privilege with the same password used to login. Once you login, you should elevate your privilege by using su to the an administrator account (someone who is in sudoers). This is the way cisco switches are by default and it's good practice.
    Security in layers :)

    • @okay1296
      @okay1296 ปีที่แล้ว

      Add a layer of security with encrypting your home folder/even better your whole machine with luks. Loose it? The attacker will see nothing.
      Yeah even that could be hacked (extremly hard) but it makes it harder and add a layer.

  • @edgarardon3154
    @edgarardon3154 3 ปีที่แล้ว +10

    This was great. I've just passed my Linux essentials exam and this helped learn a bit more about security. Btw, reloading the firewall did do the trick in my server. I didn't have to reboot .

  • @PatrickHener
    @PatrickHener 3 ปีที่แล้ว +17

    Just to be clear I love your videos. They are very informative and well produced. But I have to add some commentary on what you just showed (from a perspective of a professional pentester):
    - Although updates are crucial like you explained an automated update mechanism (even if it is just the stables) might break something upon updating. So you might consider automatic updates a risk depending on your situation.
    - The mac command to copy your public key to the server will also work on linux the exact same way (although your command is shorter and easier to remember)
    - Using a password upon generation of your key pair is recommended. So when your private key is getting hacked somehow it will be useless if the password is not easily guessable
    - In general just use strong (random) passwords and store them in a safe location like a password store.
    - Changing the port of your ssh listener is just security by obscurity. Any port scanner using a service scan can show you that ssh is listening on port 717 (like for example nmap -sSV ...)
    - Deactivating ping once again is security by obscurity. Nmap has the flag -Pn which will scan your ip address no matter if the server answers to a ping or not.
    Other than that your counter measures are very well designed and really good explained. Thanks for sharing that content.

  • @estudiordl
    @estudiordl 3 ปีที่แล้ว +68

    Oh my god, I need this so much, thanks you!!!!
    Edit: I need more... Moooreee. Lol, jokes away, I really like to see more about firewall managing. Great video, thanks!

    • @tibettenballs4962
      @tibettenballs4962 3 ปีที่แล้ว +2

      network chuck, i want you to networkfuq me.

    • @michaelj8396
      @michaelj8396 3 ปีที่แล้ว +3

      Linux primarily relies on nftables and ip tables as the backend to their firewalls. Modern distros based on Ubuntu use ufw, while modern Red Hat based distros use firewalld.
      I personally prefer firewalld, but both are firewalls and can be configured to how you want (I find firewalld can be customised much more heavily). In most production on prem and cloud environments in the enterprise you'll have dedicated virtualised or hardware firewalls in between each network of hosts that further regulates traffic through firewall rules. Usually these rules are more lenient, while the software firewall rules act as more specific rules specific to the host.
      You can read more about them here: wiki.ubuntu.com/UncomplicatedFirewall
      firewalld.org/documentation/

  • @royalebloodme
    @royalebloodme 3 ปีที่แล้ว +7

    @14:08
    PasswordAuthentication no is not enough to disable password for ssh login.
    Make sure to set ChallengeResponseAuthentication no as well

  • @michaellerch
    @michaellerch 3 ปีที่แล้ว +140

    12:41 "...and then I'll use my favorite text editor..."
    Don't say VIM!
    "Nano..."
    *huge sigh of relief*

    • @RedmilesShark
      @RedmilesShark 3 ปีที่แล้ว +17

      What's wrong with vim?

    • @quagmiretoiletgaming
      @quagmiretoiletgaming 3 ปีที่แล้ว +1

      Gedit

    • @mohsenmirzaei3347
      @mohsenmirzaei3347 3 ปีที่แล้ว +5

      actually i really prefer vim since things like ctrl+x and etc might not behave correctly sometimes specially when used in ssh sessions in bash

    • @michaellerch
      @michaellerch 3 ปีที่แล้ว +2

      @@mohsenmirzaei3347 thanks for that explanation I didn't know that

    • @michaellerch
      @michaellerch 3 ปีที่แล้ว +4

      @Premlez I learned VIM after awhile but because of the panic and embarrassment I suffered at the beginning I prefer nano.

  • @TH-X1000
    @TH-X1000 3 ปีที่แล้ว +34

    Good starting guide and well explained, still missing tons of hardening activities, for example unattended upgrades and other. But I guess these things are better than what 90% of the folks implement out there so it's not about out-running the hungry lion, just running faster than the guy behind you...

  • @medanisjbara1348
    @medanisjbara1348 2 ปีที่แล้ว +4

    I have another suggestion tho. there's a firewall option that allows your port to be neither "open" nor "closed" .. but instead "filtered" , making your server accepts incoming connections only from a known ip adress. it might not be useful for everyone since not everyone have static ip adresses. but hey, if you do, then that's just the best layer of security you might add to your server.

  • @lordofhack5368
    @lordofhack5368 3 ปีที่แล้ว +7

    i love the "warning" it gives when adding users not as root - with great power comes great responsibility

  • @AlexanderKhiluck
    @AlexanderKhiluck 3 ปีที่แล้ว +63

    ufw by default allow established connections, that's why reloading ufw is not helping. you need to drop all established connections, what reboot does.

    • @wakeupNeo_
      @wakeupNeo_ 3 ปีที่แล้ว

      I use FirewallD but I'm not sure if it's better though. I'm not running a server, just desktop for home use.

    • @FlexibleToast
      @FlexibleToast 3 ปีที่แล้ว +1

      @@wakeupNeo_ I don't think either one is better, they're just different. The biggest difference I've seen is that ufw seems to be easier at command line, but firewalld is easier with Ansible. At least until ufw gets an Ansible module (it might have already).

    • @明智吾郎-e4b
      @明智吾郎-e4b 3 ปีที่แล้ว

      @@wakeupNeo_ ufw can also limit access to a certain port. For example, you can prevent someone from brute forcing port 22 by limiting the connection to 2 connections per 30 seconds.

    • @wakeupNeo_
      @wakeupNeo_ 3 ปีที่แล้ว

      @@明智吾郎-e4b yeah I switched to ufw now and blocked access to port 22. You can probably do this with firewalld but ufw much more easy to use.

  • @praecorloth
    @praecorloth 3 ปีที่แล้ว +5

    I would always recommend protecting your private key. A private key with no protections on it is more commonly referred to as a back door. You can password protect your private key. Passwords are only useless in Windows these days, since Microsoft refuses to stop using unsalted MD4. Cracking a password for a 4096 bit RSA key, or a SHA512 hash? Yeah. Let me know how that works out for you. If you use a godawful password, sure, it can be done. If you take any steps to make a somewhat decent password, chances are extremely unlikely that someone's going to crack it.
    However, if you're taking all of these steps to secure your Linux boxen anyway, might as well step it up a notch. Get you a Yubikey, and use it to protect your private key, or use it as a 2nd factor. Yubico has some great documentation. Probably the hardest part about doing it is selecting which method you want to go with, since Yubikeys are extremely flexible.

  • @domemvs
    @domemvs 3 ปีที่แล้ว +6

    For mac you can use ssh-copy-id as well!

  • @foobag969
    @foobag969 2 ปีที่แล้ว +3

    I've broken like 5 virtual machines already so far on this journey haha. I love this channel.

    • @patrickgrady7505
      @patrickgrady7505 2 ปีที่แล้ว +2

      I've literally taken my SD card out of my raspberry pi and reinstalled Ubuntu Server with the pi imager several times.

  • @TrixTM
    @TrixTM 3 ปีที่แล้ว +119

    3:53 "Coffee break"
    Puts an ad
    21:22 "Coffee break"
    Puts another ad

    • @b07x
      @b07x 3 ปีที่แล้ว +10

      Yeah, Coffee gives you lots of money.

    • @tiffanytuga
      @tiffanytuga 3 ปีที่แล้ว +3

      @@b07x 😂

    • @gokul6431
      @gokul6431 3 ปีที่แล้ว +3

      Yeah man 👍

    • @senfglas214
      @senfglas214 3 ปีที่แล้ว +5

      Looks like you haven't implemented his pihole video ;)

    • @HouseJunk1e
      @HouseJunk1e 3 ปีที่แล้ว +1

      hes definitely getting carried away with this shit....but man his videos are so good w/e

  • @SteveWeltman
    @SteveWeltman 8 หลายเดือนก่อน +2

    @networkchuck.. Thank you for this video! I know this is an older video but I needed to secure my ubuntu server and stumbled onto this gem. A couple of things. First... This is probably the best 1-2-3 video for securing Linux I've ever seen. It was presented in a fun way and your on camera presence kept it interesting and at the right technical level. It was neither too technical nor too basic. Just amazing info. Also, I am genuinely jealous of your epic beard. ;) Hope you keep posting great content.

  • @KevinPfeifer
    @KevinPfeifer 3 ปีที่แล้ว +13

    Steps 1-4 I can understand and recommend too but the ping part in step 5 is just so unnecessary in my opinion.
    Sure you can block pings but any "good" hacker has many other tools to check if your server is still running (ahem.... nmap... ahem)
    I would also recommend any linux admin to install and set up at leas a basic fail2ban config to automatically block any recurring SSH logins or any other brute force attacks trying to get into your services

  • @madeyeQ
    @madeyeQ 3 ปีที่แล้ว +7

    Some good advice there. Security is always about layers. If one layer is breached the next should take over.
    I have found that limiting the allowed from address to SSH can make a big difference in how many break-in attempts you see. Even if you don't have a static IP, your ISP will only have a limited range of IPs he can give you and you can allow only that range.
    It's also a good idea to use something like fail2ban. It automatically bans IPs that e.g. have a certain number of failed SSH login attempts. Works rather well :-)

    • @laughingalien
      @laughingalien 3 ปีที่แล้ว

      Great recommendations, Madeye.

  • @briank8525
    @briank8525 3 ปีที่แล้ว +3

    Great video chuck. for ssh this is what I do . I change the port like you do but I lock it down so I can only ssh from my home ip address. ufw allow from to any port Even if your public ip address changes you can still ssh back in from the linode web console and change the firewall rules.

    • @NetworkChuck
      @NetworkChuck  3 ปีที่แล้ว +2

      That’s a great step. Very secure.

  • @michael_oconnor
    @michael_oconnor ปีที่แล้ว +1

    spent a few hours trying to get key auth to work, found out Chuck left a part out in the video. You need to add the private key to the ssh agent so your computer knows which key to use. In windows, do these commands:
    Set-Service ssh-agent -StartupType Automatic
    Start-Service ssh-agent
    ssh-add
    NOW you should be able to log in :)

  • @liamriley2100
    @liamriley2100 3 ปีที่แล้ว +6

    8:14 - "chmod" actually stands for "change mode" intead of "change modification"

  • @sapperjaeger
    @sapperjaeger ปีที่แล้ว +1

    if this is not one of the most essential (and well done) Linux 101 videos, I don't know what is
    also, just ordered a Study Hoodie -- your rock Chuck!

  • @Alexander-vo4gv
    @Alexander-vo4gv 3 ปีที่แล้ว +6

    Also a million Chuck! You well deserve it!

  • @wagnervicente2962
    @wagnervicente2962 3 ปีที่แล้ว +2

    Great video.
    On the linux servers I work on:
    Active Directory domain users;
    Certified with private and public key with password
    and 2FA with google-authenticator

  • @esra_erimez
    @esra_erimez 3 ปีที่แล้ว +6

    Automatic updates? Untested updates in a production environment?

    • @thelearner761
      @thelearner761 3 ปีที่แล้ว +1

      yes you are correct!

    • @missunderstood7331
      @missunderstood7331 2 ปีที่แล้ว

      @@thelearner761 I too was about to address that point. Good call Ezra & The Learner

  • @CraftyZA
    @CraftyZA 3 ปีที่แล้ว +4

    One other thing I would suggest is editing /etc/hosts.allow and hosts.deny.
    I know you have ufw, but adding another layer will not damage anything.
    Make sure your passwd file is shadowed.
    I've been doing this since the 90's
    Any and every install get's that treatment.

    • @bxdbwooyyy
      @bxdbwooyyy 2 ปีที่แล้ว

      how do you do that? where do you guys learn this all?

  • @codinginflow
    @codinginflow 2 ปีที่แล้ว +8

    13:48 this cracked me up 😂 Loved the tutorial. I'm gonna recommend it in my next video 👍

  • @ibrooklyn27
    @ibrooklyn27 3 ปีที่แล้ว +15

    Can you please do a v2 of these security include more security like fail2ban, snort and even a .bashrc email alert when someone logged in ?

  • @levyroth
    @levyroth 3 ปีที่แล้ว +3

    Super useful. Followed all the steps in Arch Linux (some minor differences) in Linode (simpler to set up than AWS and less invasive than Azure at collecting personal data). This is really cool.

  • @johnsummers7389
    @johnsummers7389 3 ปีที่แล้ว +1

    I don't manage Linux servers but this was so informative. I am a maker and have been looking to set up a server for my IoT devices and this is awesome to make sure my server isn't going to be hackable. AWESOME!! Thank you Chuck!!

  • @ladyViviaen
    @ladyViviaen 3 ปีที่แล้ว +6

    one more thing i would like to add is to get the linpeas enumeration script on your server and enumerate it, then try to secure as many attack vectors it can find

    • @Andremzsptm
      @Andremzsptm 3 ปีที่แล้ว

      What is that?

    • @ladyViviaen
      @ladyViviaen 3 ปีที่แล้ว +2

      @@Andremzsptm its a shell script that shows all possible ways to privesc (become root without knowing root pass basically) and with a quick google search you can find the github repo by carlospolop that has linpeas

    • @Andremzsptm
      @Andremzsptm 3 ปีที่แล้ว

      @@ladyViviaen that's really nice. Thanks

    • @Gunslinger088
      @Gunslinger088 3 ปีที่แล้ว

      Is it a script like Lynis?

    • @ladyViviaen
      @ladyViviaen 3 ปีที่แล้ว +2

      @@Gunslinger088 from what i saw on google lynis is more overall security scans and whatnot while linpeas only scans for privesc weaknesses

  • @mrr0r508
    @mrr0r508 3 ปีที่แล้ว +2

    Instructions unclear. Logged into Chuck's personal PC and traumatized by photo directory.

  • @ericsimaginaryfriend
    @ericsimaginaryfriend 3 ปีที่แล้ว +12

    $HOME also works as shorthand for your own user directory in Windows 10

    • @Leo-sd3jt
      @Leo-sd3jt 3 ปีที่แล้ว

      %userprofile% is the one that tends to work across the board in windows

  • @pandaxpanda8272
    @pandaxpanda8272 3 ปีที่แล้ว

    if you have any issue getting linux-headers and unable to find the correct one - make sure to type in apt-cache search linux-headers and find the correct one for you. Thanks. Thank you again for another amazing video. !!!!!! You are amazing my friend. Continue to inspire people !

  • @JozzyOzzy
    @JozzyOzzy 3 ปีที่แล้ว +32

    Exactly what I need

    • @ShinyTechThings
      @ShinyTechThings 3 ปีที่แล้ว +2

      @JazzyOzzy What are you running on your server? These 5 things are a start on hardening but nowhere near being hardened to a security standard like NIST.

  • @cauxxx2454
    @cauxxx2454 3 ปีที่แล้ว +2

    I always automatic update my servers and never see anyone talking about this (even in "how to security")
    Quality content++

    • @明智吾郎-e4b
      @明智吾郎-e4b 3 ปีที่แล้ว

      How do you update it automatically? unattended-upgrades?

  • @DebdutBiswasOnline
    @DebdutBiswasOnline 3 ปีที่แล้ว +5

    A good Linux tutorial by Chuck, yep these are the good measures discussed in this tutorial.
    I use ssl proxy (stunnel/nginx) to encapsulate SSH connection and also use SSLH to multiplex (more corrected ALPN based forwarding) ssl proxy encapsulated SSH connection through same port number as my web server (443).

  • @__foam
    @__foam 3 ปีที่แล้ว +1

    If anybody is having issues like me and the SSH key still requires a login
    check the ~/.ssh/config file on both machines and make sure it's sending the id_rsa.pub key instead of a different one. For example, my macbook was sending an ED25519 key, so it would fail each time

  • @steviebarrett
    @steviebarrett 3 ปีที่แล้ว +16

    Another great video Chuck, turns out I have already done most of these on my two linux VMs at home. Oh yeah and guess who just landed a new job as a Cloud Engineer ... ?

  • @Gunter-zi7yy
    @Gunter-zi7yy 3 ปีที่แล้ว +1

    In min 20:52 shouldn't we comment the fifth line?
    -A ufw-before-input -p -icmp --icmp-type echo-request -j ACCEPT
    Great video by the way!

  • @maciejkokot8396
    @maciejkokot8396 3 ปีที่แล้ว +6

    Is moving port 22 elsewhere really any good when nmap exists?

    • @thegalacticwarrior7113
      @thegalacticwarrior7113 3 ปีที่แล้ว +1

      Many hackers use a bot to scan for port 22 and try a couple of common passwords, so moving to a different port is a very good defense against anything but a targeted attack.

    • @maciejkokot8396
      @maciejkokot8396 3 ปีที่แล้ว

      @@thegalacticwarrior7113 good call, but then movong it in conjunction with deactivating root and disabling passwords is a bit of an overkill, isn't it? ;)

    • @thegalacticwarrior7113
      @thegalacticwarrior7113 3 ปีที่แล้ว +1

      @@maciejkokot8396 I have an ssh server on the open internet; I'm not taking any chances.

  • @SeleDreams
    @SeleDreams 10 หลายเดือนก่อน

    I think a good thing to add would be "ufw limit [ssh port]" to protect from ssh bruteforce attacks as well

  • @Phlacc
    @Phlacc 3 ปีที่แล้ว +6

    Whenever "Chuck" says coffee break, I drink a beer. Cheers.

    • @bluecreature39
      @bluecreature39 3 ปีที่แล้ว +1

      Thats like 20 beers per episode. I think you might have a problem, but who am I to judge.

  • @Lampe2020
    @Lampe2020 2 ปีที่แล้ว +1

    12:45 "etsie" is one of my favourite Linux-typical-directory nick names😄

  • @The_Unexpected_Inquisitor
    @The_Unexpected_Inquisitor 3 ปีที่แล้ว +4

    Please do more blue team stuff. Hacking into system as attacker is one thing, but at the end the whole idea of ethical hacking is to find vulnerability and then know how to secure them.

  • @serenitynikolaelpesteyeles9278
    @serenitynikolaelpesteyeles9278 ปีที่แล้ว

    The activity in staring in a screen conglumerates that you want to have a correscending appleture of thought, recontextualizing the greatness that can be grown from that with the "Ryzen Five"

  • @php4u
    @php4u ปีที่แล้ว +3

    Awesome tutorial, chuck. You are the man! Thanks for all that you do to help us newbies.

  • @codinginflow
    @codinginflow 2 ปีที่แล้ว

    Just released my own SaaS and now I'm trying to make it more secure 😁

  • @4dailyrunner
    @4dailyrunner 3 ปีที่แล้ว +4

    Auto updates- you make a great suggestion, but I have had automatic updates automatically break stuff... usually in the middle of the night or Friday at 4:30p.

    • @Darkk6969
      @Darkk6969 3 ปีที่แล้ว

      For basic servers auto updates should be ok. However, when you have stuffs like MariaDB, PHP, python and etc things can break.

  • @cookiebinary
    @cookiebinary 7 หลายเดือนก่อน +1

    I've had bad experiences with unattended updates, especially on a production server. They often tend to overwrite custom settings. For example, with PostgreSQL, an update might reset a custom database path, and similarly, Docker updates might alter the custom data path set for Docker.

  • @evanchaskis4315
    @evanchaskis4315 3 ปีที่แล้ว +6

    Good job dude. i hope you do a video about forensics one day

  • @vishalt2995
    @vishalt2995 3 ปีที่แล้ว +2

    Great video chuck. I'm gonna do this on all of my Linux boxes from now on.

    • @hb9145
      @hb9145 2 ปีที่แล้ว

      Doesn't help. It's snake oil.

  • @brunomachado1748
    @brunomachado1748 3 ปีที่แล้ว +5

    Nice Video 👍. I would recommend Lynis to audit the system.

  • @hlsharma705
    @hlsharma705 3 ปีที่แล้ว +1

    Most coolest thing other than hacking is the Coffee Break 🔥🔥🔥🔥🔥🔥

  • @jmhm17
    @jmhm17 3 ปีที่แล้ว +14

    I miss the twitch live streams
    "Connection refused" is still saying "im here, scan my ports"

    • @jmhm17
      @jmhm17 3 ปีที่แล้ว +1

      @@asificam1 it's common practice in network security to block echo replies and not send unreachable. No reply means you don't exist period. But yes good point in this scenario since he spun up Apache

    • @raginranga3494
      @raginranga3494 3 ปีที่แล้ว +1

      It only slows hackers down rather like a locked door..
      Criminals just go through Windows!

    • @herpderp5222
      @herpderp5222 3 ปีที่แล้ว

      What is the general consensus/opinions of Port knocking or Single Packet Authorization (FWKNOP) to keep ports closed until actively ready to use?

  • @KaiStendel
    @KaiStendel 3 ปีที่แล้ว +1

    I've got my 1st server and checked out everything you showd us. Fine, it work. Hungry to learn more... Keep up with this great work

  • @RandomGuyOnTheSreet
    @RandomGuyOnTheSreet 3 ปีที่แล้ว +4

    This was awesome. I am classes right now and we just went over ssh and private and public keys. This lab definitely helped reinforced my learning and best of all I now have a server.

  • @missunderstood7331
    @missunderstood7331 2 ปีที่แล้ว

    The comments are allways great on Network Chuck's videos. Thanks for the content too..

  • @d00dEEE
    @d00dEEE 3 ปีที่แล้ว +4

    All excellent with one nitpick: changing ssh port from 22 is sort of useless, as anyone who cares already has a port scanner and doesn't even bother checking just the default. (And, yeah, like others have said, I'd add fail2ban to the list, but that's for another video where you can talk through the details and reasons behind them.)

    • @konev13thebeast
      @konev13thebeast ปีที่แล้ว

      Looked through the comments specifically for someone that agreed on this point

    • @d00dEEE
      @d00dEEE ปีที่แล้ว +2

      @@konev13thebeast I've got to admit, though, that changing the port reduces the size of the log files. Just out of curiosity, I swapped between 22 and 1234 (I think it was) a few times, and the frequency difference is enormous. Drive-bys on 22 are about 20-30/hour for me, fell to about 2-3/day with the non-standard port.

    • @konev13thebeast
      @konev13thebeast ปีที่แล้ว

      @@d00dEEE how important is it to monitor ssh logs unless theres a massive spike though? From my experiences from windows servers, firewall can handle most flooding issues fine. Genuine question Ive never touched a linux server before

  • @Laodell
    @Laodell 2 ปีที่แล้ว +1

    Changing the SSH port will only take a script kiddy with nmap a few extra seconds to find. This also breaks some enterprise apps that are connecting via ssh to perform various audits. You would think it would be possible, but some apps cannot accept a different port for SSH, and you would require a separate service account for every non-standard ssh port you may have configured. Lets also factor in internal firewalls and routes between vlans.

    • @medanisjbara1348
      @medanisjbara1348 2 ปีที่แล้ว

      sometimes nmap doesn't recognize an open port as an ssh port if it's not port 22 , it have personally happened to me , in my case nmap recognized an open ssh port on 8022 as an oa-system .. i'm not sure what that is. but looking it up on the internet didn't give me a good hint , and i was still able to use it because i know it's an ssh port. it might be a good layer of security to make your open port non usable unless you know what it's used for. let me know what you think

  • @ilficherrimolori
    @ilficherrimolori 8 หลายเดือนก่อน +49

    How to be unhackable: do not connect to the internet.

    • @Josh-Barnett
      @Josh-Barnett 5 หลายเดือนก่อน +7

      Just don't use a computer

    • @xdila5202
      @xdila5202 4 หลายเดือนก่อน +2

      Just

    • @ilficherrimolori
      @ilficherrimolori 4 หลายเดือนก่อน +3

      J

    • @CCHO12346
      @CCHO12346 3 หลายเดือนก่อน +3

    • @Unknown-Name-g5s
      @Unknown-Name-g5s 3 หลายเดือนก่อน

      The hacker well still connect to your pc on miniport and it wont even tell you they change the code with python so it make it look like it working but is on..

  • @supervert1491
    @supervert1491 3 ปีที่แล้ว +2

    Could you make a video on how a hacker could break through this security?

  • @ZapsterZatoo
    @ZapsterZatoo 3 ปีที่แล้ว +4

    Good tips, simple to implement and well explained. Thank you!

  • @systemofapwne
    @systemofapwne 3 ปีที่แล้ว +2

    I propose to leave the ssh port default to 22. Changing that is just security through obscurity. And people will anyhow portscan your device and find that port (eg. my ssh backend for gitea is on a random port, yet people from the Internet try to SSH-hack into that port, lol). The best practice anyhow would be, to only allow ssh over a VPN tunnel or use port-knocking to enable port 22 for a short timespan. And if you don't want to do that and still use port 22, add fail2ban and probably couple it with an SSH tarpit like endlessh, when they use (disabled) password auth.

  • @williamheffernan1045
    @williamheffernan1045 3 ปีที่แล้ว +16

    So first off thank you so much Chuck for these. These are amazing. I am retired Navy and currently in HR but want to make the switch to IT. I LOVE computers but always got frustrated so I didn’t want to do it as a job, but learning makes it better. So I did this and followed your steps and secured my server. Problem is, I like to connected through terminus remotely from my IPhone/iPad. I would love a video how to add multiple authorization keys. I guess I could make multiple users each with their own key (user-iPad, or user-iPhone) but I was wondering how you would trackle multiple keys for one user. Also is it possible to stick the keys on. Thumb drive to use from another machine? I am reversing the steps because my dumb ass created keys on my windows machine for another server and overwrote the old keys *face palm* so now at am having trouble ssh’ing in.

    • @monsterkush11
      @monsterkush11 ปีที่แล้ว

      Your could just copy the private key to your iPhone maybe idk how that works from iPhone but there is ssh clients for iPhone so in sure they have the option for adding keys

  • @davidblakley5762
    @davidblakley5762 ปีที่แล้ว

    I tried this and Linode wouldn't apply the $100 discount and was going to charge me the full amount of $36/month. Dedicated 4 GB - lowest priced package per month. I watched the rest of your video and found it useful. Thank you!

  • @mihaidoboga
    @mihaidoboga 3 ปีที่แล้ว +14

    Nice video! But you should have used a port number above 1024 :)

    • @sterling1989
      @sterling1989 3 ปีที่แล้ว

      Why?

    • @mihaidoboga
      @mihaidoboga 3 ปีที่แล้ว +2

      @@sterling1989 Because port numbers in the range 0 - 1023 are the well-known ports (system ports) which are mainly used by system processes.

    • @lordbyron_
      @lordbyron_ 3 ปีที่แล้ว +1

      @@mihaidoboga Port 717 is not a standardized port. It won‘t interfere with anything. If you want to check all important/standardized ports, checkout this site: en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

  • @michalroesler
    @michalroesler 8 หลายเดือนก่อน

    I'm watching it again for the 6th time. Running the few VPS I'm managing with the list and securing the new one while watching this video.
    Your energy is amazing and the sense of humor is awesome.
    Permit Root login - yes.
    ...
    NO ! ! ! !

  • @thomascodes
    @thomascodes 3 ปีที่แล้ว +4

    Very informative video. It's a very big misconception that Linux systems are secure from hackers.. Everything with an operating system and a signal is not 100% secure..

  • @ali-mw5no
    @ali-mw5no หลายเดือนก่อน +1

    21:10 No need for whole system to reboot, just type: sudo ufw disable && sudo ufw enable

  • @tim0n243
    @tim0n243 3 ปีที่แล้ว +77

    Maybe you can also make an Video to take the SSH Security to the next Level with fail2ban and totp authentication😉, would be nice to see this.

    • @michaellerch
      @michaellerch 3 ปีที่แล้ว +3

      Fail2ban is nice!

    • @lcgn
      @lcgn 3 ปีที่แล้ว +1

      Or SSH tarpit

    • @raginranga3494
      @raginranga3494 3 ปีที่แล้ว

      @@abanoubmelad2919 GO 127.0.0.1

    • @herpderp5222
      @herpderp5222 3 ปีที่แล้ว

      Port knocking or it's successor single packet authorization (fwknop)

    • @cyberopal97
      @cyberopal97 3 ปีที่แล้ว

      this would be really nice to have this also explaind to go another step ahead.

  • @curious_carbon
    @curious_carbon 3 ปีที่แล้ว +1

    Nice one Chuck, very cool starter............Side topic, I recently managed to also configure 2FA using the google pluggable authentication module (PAM). This increases the security in the sense that you would also need to have a token using apps like Authy or Google Authenticator. So if somehow hackers get access to your private key, well their stuck for a while due to missing 2FA. 👍

  • @KaaiKivi
    @KaaiKivi 3 ปีที่แล้ว +57

    I think fail2ban is even more important than ufw

    • @scottseymour8855
      @scottseymour8855 3 ปีที่แล้ว +4

      I was gonna say add fail2ban and apparmor or selinux and set those up

    • @jag831
      @jag831 3 ปีที่แล้ว +2

      Tried it. Instead of having 1000 brute force attempts from 50 ips, I got 1000 brute force attempts from 350 different ips. Now I had 300+ ip blocked

    • @fuatkaradeniz
      @fuatkaradeniz 3 ปีที่แล้ว +4

      Thanks Chuck. Can you also make a video about SELinux? How that works with some examples?

    • @Carmoca
      @Carmoca 3 ปีที่แล้ว +13

      Respectfully, I think you missed the point for installing certificates AND disabling password logins. I suggest re-watching the video at th-cam.com/video/ZhMw53Ud2tY/w-d-xo.html and th-cam.com/video/ZhMw53Ud2tY/w-d-xo.html .
      Network Chuck is suggesting forcing the user(s) to use certificates AND disallow (simple) password logins. Since such a system forces the user to have a certificate installed AND can NOT log in via a simple password request there is no reason to use fail2ban. I've used fail2ban in the past - in fact, I was even -- initially -- thinking fail2ban would be a good addition to this video. However, in retrospect, using certs removes a user's/hacker's ability to brute force a password and, therefore, is not required. Peace. :)
      V/r

    • @sethmccoun8636
      @sethmccoun8636 3 ปีที่แล้ว +1

      Agreed

  • @AkumetsuOne
    @AkumetsuOne 3 ปีที่แล้ว

    Openssh generating the key will create the folder, set the permission, you don't need to create the folder. On both side will create the .ssh automatically with the right permissions, if you are from Linux to Linux.

  • @xanosdarkpaw1
    @xanosdarkpaw1 3 ปีที่แล้ว +6

    Don't forget fail2ban as well.

    • @MisterV..
      @MisterV.. 3 ปีที่แล้ว +2

      Yeah. Fail2bain is a must have I think.

  • @mikaela1119
    @mikaela1119 4 หลายเดือนก่อน

    BETTER explanation than my linux teacher. Excellent bro 👊🏼

  • @Jeff0769
    @Jeff0769 3 ปีที่แล้ว +17

    I AM A BIG FAN OF YOU.I HAVE LEARNED A LOT OF THINGS BY YOU.YOU ARE A GREAT TEACHER FOR ME....
    BTW CAN I GET A HEART FROM NETWORK CHUCK??

  • @sagegeas9205
    @sagegeas9205 3 ปีที่แล้ว

    Not seeing anyone mention it, but that 'weird squiggly key' for those who don't know, is called the 'Tilde' key.
    ---> ~

  • @learnprogramming3885
    @learnprogramming3885 3 ปีที่แล้ว +3

    Great video! I've learned much things. You always explain the things simple and understandable.
    If you don't mind, I just saw that in the final step you've added existing rule at the top for the `--icmp-type echo-request -j DROP`. I've tested it with simply changing that rule at the bottom and it works. Is it for a reason done this way?
    Also after the `ufw reload`, I've tried with just restarting the ping and it worked - for this I thing there is no need to reboot the whole server, except if it is under some kind of attack already.

  • @richielonewolf7725
    @richielonewolf7725 3 ปีที่แล้ว

    The only reason why i come back to watch your videos i seem to learn new things, commands, and get up to date with my passion for techstuff

  • @maciejkokot8396
    @maciejkokot8396 3 ปีที่แล้ว +5

    PowerShell is sooo two months ago. Windows Terminal is all the rage now.

    • @alexandertheepic7572
      @alexandertheepic7572 3 ปีที่แล้ว

      Sounds legit.

    • @grapesalt
      @grapesalt 3 ปีที่แล้ว +1

      ​@@alexandertheepic7572 tf you saying bro?

    • @alexandertheepic7572
      @alexandertheepic7572 3 ปีที่แล้ว

      @@grapesalt no idea
      account was compromised. No less by someone that is a fool. Just which one of is? The fool who cannot spell whilst attacking someone or the fool who allowed the fool who cannot spell gain control of his account? Good question. Regardless, carry on nothing to see here.

  • @Farizno
    @Farizno 3 ปีที่แล้ว +1

    Thanks so much for another great video. I signed up on Linode. This is my first web hosting as I am just starting to toy around with servers, websites, and such. Your videos are fantastic and I always learn a lot. Thank you.

  • @ndupontnet
    @ndupontnet 3 ปีที่แล้ว +36

    Next step : fail2ban, then Cloudflare.

    • @KaliDreams
      @KaliDreams 3 ปีที่แล้ว +5

      fail2ban is such a necessity

    • @danilodistefanis5990
      @danilodistefanis5990 3 ปีที่แล้ว

      Michael S. can you summarise fail2ban? I only know it from ZNC. I am googling it but I often appreciate the input from people who use it and recommend it. Thanks in advance !

    • @belgiumbulldog9271
      @belgiumbulldog9271 3 ปีที่แล้ว

      @@danilodistefanis5990 its mostly for ip banning/time out's when it notices repeated login attemps. so you can make a 'jail' for lets say ssh login attempts

  • @SosaiOyama
    @SosaiOyama 3 ปีที่แล้ว +1

    I’ve learned so much from chuck. Became a coding teacher and now learn great instructional etiquette through chuck. Thank you so much haha

  • @Leo-sd3jt
    @Leo-sd3jt 3 ปีที่แล้ว +6

    The best part of this is testing whether the website is accessible even though you knew that the firewall was going to be blocking port 80: expectations don't always match the reality of what will happen. That's how security bugs tend to be discovered. Just because something is expected to happen doesn't mean that it will happen so testing it doesn't hurt especially if it's something security related.

    • @briank8525
      @briank8525 3 ปีที่แล้ว +1

      I completely agree with what Leo said here. This is why when I spin up a vm on linode everything is behind a VPN either openvpn or wireguard. I typically never leave anything exposed to the public internet. Or I write a ufw rule that only allows traffic from my home IP.

  • @MichaelMaurakis
    @MichaelMaurakis 2 ปีที่แล้ว

    2 factor auth! It can elevate your security by quite a bit and even potentially give you a heads up when someone is trying to break their way in

  • @88farrel
    @88farrel 3 ปีที่แล้ว +5

    I thought I'm gonna learn a new tricks, I guess I already done with all of that setup

    • @scott32714keiser
      @scott32714keiser 3 ปีที่แล้ว +2

      add one time pad encrption to your network its hackable

    • @Carmoca
      @Carmoca 3 ปีที่แล้ว +1

      @@scott32714keiser 2FA

    • @scott32714keiser
      @scott32714keiser 3 ปีที่แล้ว

      I just code for fun I'm nobody professional

  • @sontjer
    @sontjer 3 ปีที่แล้ว

    Oh, I kinda like the padlock & the little key drew on the screen. Much appreciated!

  • @Agnubis
    @Agnubis 3 ปีที่แล้ว +13

    Nice video, but just changing the default ssh port doesn't make it that much harder for hackers to find the new ssh port. Nmap allows for service scan which will make your new ssh port be discovered very easily. That said, the tip about using a ssh key pair is indeed good practice :)

    • @jarrod752
      @jarrod752 2 ปีที่แล้ว +10

      True, but with 65535 ports and a 3 or 5 attempt ip banhammer, you can decrease your risk by a reasonable margin.

  • @ianberdahl108
    @ianberdahl108 3 ปีที่แล้ว +2

    Using this on my RazPi!!! Great content as always.!!!

    • @NetworkChuck
      @NetworkChuck  3 ปีที่แล้ว +2

      Awesome! And thank you.