A command-line journey to improve Linux server security

Command line journey to improve Linux server security

In the current network environment, protecting the security of the server is crucial. The Linux operating system provides many powerful tools and commands that can help us improve server security. This article will take you on an exciting command line journey and learn how to use these commands to harden your Linux server.

1. Update system and software

First, make sure that your Linux system and installed software are the latest versions. Updating systems and software can help fix known security vulnerabilities and provide better security. Use the following command to update the system and software:

sudo apt update
sudo apt upgrade

2. Reinforce SSH access

SSH is a common tool for remote management of Linux servers, but it is also one of the main entrances for attackers. . To harden SSH access, you can take the following measures:

2.1. Disable root account login

The root account is the account with the highest privileges, and attackers usually try to guess its password to carry out attacks. Disabling root account login can reduce the attack surface. In the /etc/ssh/sshd_config file, find the PermitRootLogin parameter and set it to no:

PermitRootLogin no

Save and exit the file , and then restart the SSH service:

sudo service ssh restart

2.2. Log in using an SSH key

Using an SSH key for authentication can be more secure because it is more difficult to crack than a password. The method to generate an SSH key pair is as follows:

ssh-keygen -t rsa -b 4096

Follow the prompts to generate a key pair. Then add the public key to the ~/.ssh/authorized_keys file on the server. Save the private key locally and make sure permissions are set to 600 or higher.

Next, you can modify the /etc/ssh/sshd_config file to force the use of SSH keys for login:

PasswordAuthentication no

Save and exit the file, then restart SSH Serve.

3. Firewall settings

The firewall is an important tool to protect the server. Firewall rules can be configured using the iptables command. The following are some commonly used command examples:

3.1. Block specified IP address

If you want to block a specific IP address, you can use the following command:

iptables -A INPUT -s 192.168.1.100 -j DROP

3.2. Allow Specific port access

If you only allow specific ports to access the server, you can use the following command:

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT

The above command will allow SSH and HTTP access. Make sure you modify the port number according to your actual needs.

3.3. Block all non-specified port access

If you only allow specific ports to access the server, you can use the following command:

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -j DROP

The above command will allow SSH access, And block access to all other ports.

4. Regular backup

Regular backup of server data and configuration files is an important security measure. You can use the crontab command to set up scheduled backup tasks. The following is an example:

Open the terminal and enter:

crontab -e

Add the following line in the opened file to set up a daily scheduled backup:

0 2 * * * rsync -avz /var/www /path/to/backup

The above command will be executed every morning 2. Back up the /var/www directory to the specified path.

5. Security hardening of other services

In addition to SSH, you also need to ensure the security of other services. For example, you can use the following command to harden the Apache web server:

5.1. Disable directory browsing

Find the following lines in the /etc/apache2/apache2.conf file , and make sure it is not preceded by a comment symbol (#):

Options -Indexes

5.2. Hide server version information

In the same file, find the following line and set it to Off:

ServerTokens Prod

Save and exit the file, then restart the Apache service.

This is just a small selection of ways to improve server security. By using these commands and measures, you can enhance the security of your Linux server and reduce the risk of attacks. Remember, keeping your server secure is an ongoing task that requires frequent regular reviews and updated measures.

The command line examples provided in this article are just basic knowledge. If you want to further strengthen the security of your server, it is recommended that you learn more about related technologies and more advanced security measures.

I wish your Linux server is safe and worry-free!

The above is the detailed content of A command-line journey to improve Linux server security. For more information, please follow other related articles on the PHP Chinese website!