How to protect Linux from Hackers // My server security strategy!
How To Protect Linux From Hackers, Malware, and other bad things that could infect your server! I'll show you my server security strategy that might help you as well when you're running a Linux Server and hosting containerized applications. #Linux #Cybersecurity #HomeLab
How to use a VPN: • Tailscale VPN - WireGu...
Use a Reverse Proxy: • Nginx Proxy Manager - ...
Update Docker with Watchtower: • How To Update Docker C...
Tailscale VPN: • Tailscale VPN - WireGu...
Get started with Docker: • How to use Docker and ...
Teleport-*: goteleport.com/thedigitallife
Follow me:
TWITTER: / christianlempa
INSTAGRAM: / christianlempa
DISCORD: / discord
GITHUB: github.com/christianlempa
PATREON: / christianlempa
MY EQUIPMENT: kit.co/christianlempa
Timestamps:
00:00 - Introduction
00:43 - Plan your own security strategy!
02:03 - Update your software
04:28 - Don't forget your Docker containers
06:18 - Secure your SSH Access
13:24 - Use 2FA and an Access Proxy
15:48 - Don't expose unused services
17:36 - Use a firewall
21:21 - Use a reverse proxy when possible
23:12 - Use VPNs, DMZs, and access gateways
24:59 - Use an IPS (Intrusion Prevention System)
27:37 - Isolate Applications with Docker
________________
All links with "*" are affiliate links.
One of the best posts on security, open source server security i've watched. Simply great!
Thanks for bringing this topic up! This is what I needed so much.
Sure! Glad it helped you 😁
Another of the most important thing is network security, and your home network design. Using pfSense at network level. You talked about some of the DMZ setup. Using VLAN to separate networks, home networks, IoT networks, server network and so on.
Thanks for the quality content! You're such a wealth of information and we appreciate you sharing it
Thank you so much! :)
Another great video thanks! It would be great if you could go into more detail on how to address the firewall security issue using UFW of the docker containers and how you address them for cloud hosted servers.
Thanks mate! Yeah I thought about making a more in-depth video about UFW and IPTables, I'll put that on the backlog list ;)
If im not wrong docker doesnt play nice with UFW and tends to write its own rules in a way which supersedes ufw rules. I switched to firewalld because of this and I highly recommend it.
@@Asdasdas1337 yep, UFW writes iptables rules, and docker too. That's why they have conflicts.
Once again, another great video. Thank you for your service ! :)
Thank you so much :)
I think you're awesome, man. Keep on keeping on!
Thank you mate!
In 2021, I would recommend creating a Ed25519 key instead of a RSA key. Ed25519 offers stronger encryption and shorter keys. Only downside is that it is incompatible with older systems (older then say, 5 or 6 years?)
Yeah it's a good idea, the incompatiblity is the the major reason why I still don't include it, when RSA 4096 should be still fine. Second reason is I can't remember that stupid number 25519... who choose this name?!
@@christianlempa Its the prime number field used in the eliptical curve. 2^255 - 19.
Karthik Sriram oh, that makes it way easier.
@@danilodistefanis5990 xD
thanks for the information. the elliptical curve of erectile dysfunction is nothing to sublimate your libidinal acronyms by! That it is stupid is an easieer way to feel...
I honestly want to see your channel grow exponentially... May you get a few million subscribers real soon. Just keep maintaining your video's quality and pace...
Thank you so much :)
Awsome and on point as always Thank you
Thank you :)
Excellent Videos mate.... And thank you for sharing stuff like this..
Thank you so much :)
Nice and very useful video as usual. I liked your command prompt. How can I implement it on my Ubuntu system?
Hi from London, I have subscribed and new to your channel. Thank you so much for tips and what I needed so much & very useful.
Awesome! Thank you!
Great video! Running ss or netstat as root (with sudo) will show the PID/Program name in the final column, which is helpful if you don't already know what ports services commonly use, for well known ports or registered ports, as well as for ephemeral ports
Thanks for sharing! :)
broski explains things perfectly.. RESPECT AND LUV
thx lol :D
Great video Christian
This video is super interesting. Especially the part about Docker and iptables couldn't be stated enough. However I think that you could have also mentioned how to prevent docker from opening ports, that seem to be closed in the UFW rules. I had this issue a couple of days ago with a production system which unfortuantely wasn't protected by an external firewall. I was able to fix this in a couple of minutes, but for the novice admins, who are probably the target audience of this video, it certainly isn't that trivial to fix. btw: I only discovered your channel a few days ago and even for me as a professional linux admin, it's interesting content. I'm looking forward to seeing more from you 🙂
Any more info how you have done this?
I hit the "subscribe" button and clicked "all" on the bell 🔔 great video sir!
Thank you 🥰
5:55 I run my containers via podman in systemd units and create the descriptions via quadlet. That way I can just regularly let the system call "podman auto-update" and I am done (it also rolls it back in case the update doesn't work, but it relies on support from the containers here which may not necessarily be available).
very very very good and interesting video. Congrats!!!
Thanks bro 💯
Great video. What we do for security ? The best way is to install every server as a vm on a separate isolated vlan, apply all your suggestions. Hopefully nothing will infect your server, and even if it does, the infection will remain isolated and easily taken care of using snapshots or backups. We have applied this strategy and so far, so good, we are in safe heavens since 2 years. Not to forget, your virtualiser needs to be well protected as well.
Thanks mate! Great ideas
Please can you tell me how to do this for my servers
@@minscj Unfortunately, this is all a bit more complicated and inconvenient. On my Proxmox host I have looped each VM through to the firewall with its own vlan. All have their own IP range and are secured with all firewall rules to each other. So to say I have an independent DMZ for each VM. Any communication between the VMs has to go through the firewall by force and is allowed with filigree rules. As I said. Everything a „bit“ more complicated :)
you are awesome man!! thank you.
You, too! Thanks ❤
Great video, Thanks a lot.
Thanks!
Great Video! Curious what shell prompt are you using in your SSH tutorial? Really like that look...
Thanks mate! I'm now using a new prompt which is called starship, you can take a look here: kzhead.info/sun/dK9reqlqkKWBp6c/bejne.html
great video, thanks !.....don't forget, you could've used _ssh-copy-id_ @ 11:08
Thanks! Oh yeah, I'm still so used to the old way 🙈
Wow. The quality.
Thanks!
Thank you so much bro for your support ❤️
For 2FA in the shell I use DUO Security, with a free account you can do pretty much everything, I employ the least privilege access so I have a non sudo account for docker management and access with a pub key, for sudo I login with su to a local admin account, and for the actual sudo to execute a duo push is needed.
looks also interesting like Teleport does. But why relying on external services which can have connection/service problems while you need to login (independent they costs if not community edition is used) when you can do it with "Yubikey and SSH via PAM" by installing and configuring a package yourself and having only a Yubikey, Nitrokey or similar key buyed once for each user? Maybe only interesting solution could be to protect a suite of hard- and software by same 2FA service.
Hi, you can use Ssh-copy-id for copying SSH keys to servers. nice video, thx
Thanks mate! Yeah I'm still so used to the old way :D
Thank you.
You're welcome!
Hi, thanks for the video. Very good. Btw, what model of keyboard you are using? Regards
You're welcome, thanks! Currently the logitect G413 ;)
I learned so much on a single command line! 7:21
Awesome! 😀
Recently following you, great content. what have you used for the terminal, looks different?
Thanks mate! I recently made a video about my development setup, how that is what you're searching for: kzhead.info/sun/oqpvl7Cxn4N6l68/bejne.html
Great stuff
thanks :)
Great video, I will have to watch it at least 10 times to implement all this.
Thanks mate 😁
you the man, thank you.
Something else you can do is move the ssh port. Port 22 is well known and thus hackers hit it all the time basically automatically. You can move ssh traffic to a different port and close 22. It's only security via obscurity I know, but it avoids those automated hacking attempts.
Yeah, this didn't used to really do much. But I can see this actually becoming more and more helpful the more and more automated bots just hit 22
Thank you Christian.
You're welcome
Great
Good video. But take a look at ed255... Ssh keys :)
Yeah, maybe if I remember next time :P
Security is a journey, not a destination
💯 agreed
For any other noob who got lost when they got to the intro to the 'ss' command, you need to use sudo to display the process IDs (what the p flag in -ltnp displays)
thanks mate! Yeah I was a bit confused until realizing it in the editing :D
@@christianlempa no problem. As someone who's only knowledge of ports is that 22 is for ssh, having those descriptors was very helpful. I even tried removing the -n tag, but it seems like ss has some trouble resolving those names.
Tailscale has also added tailscale ssh it Also is like An acces Proxy
how can i set the terminal with your same graphic theme. seems very cool!
Docker is a rabbithole, but such an interesting one. :)
It really is!
I am waiting for video
Hi Christian, I cant find a decent how to setup a XMPP server on AWS or Hetzner from scratch. In the era of self-relying on privacy you might find it interesting to make such a video or post on your website. Cheers!
Well that would be far down my priority list, to be honest :/
I added 2FA to my home ssh server when I want to log from somewhere else, works amazing... uses the key and fallback to password/2FA
Very nice!
@26:48 - how do you make fail2ban work on all running service or all open ports ? @26:58 - what will it show if you removed the sshd
Hallo Christian, tolle Videos! Du hast ja viele Videos zu Docker etc. Den Aspekt, dass Docker Container die Firewall aber umgehen, reißt Du aber nur hier kurz an. Ich denke das ist sehr wichtig. Viele installieren jetzt fleißig Docker Container und wiegen sich in Sicherheit, die so gar nciht gegeben ist. Kannst Du nicht mal ein Video dazu machen, wie man auch Docker mit der Firewall sicher absichern kann?
Hey danke für dein feedback! Ich werde wahrscheinlich kein eigenes video dazu machen, weil ich im Prinzip alles wichtige gesagt habe. Allerdings glaube ich dass ich es öfter in meinen Videos sagen muss, wenn auch immer es um firewalls und linux Sicherheit geht. Vielen Dank!
@@christianlempa Danke für die Antwort. Ich glaube allerdings nicht, dass Otto Normal user "ich schau das youtube video und schmeiß mir die Docker Container drauf" damit damit docker sicher absichern kann. Viele führen nur die Schritte im Video aus, und die reichen nicht..,.. Wenn kein eigenes Video, dann vll in Deine Anleitungen zu Docker im Blog, oder in den Artiel zum wireguard mit docker. Versteht mich nicht falsch, die Videos sind klasse, aber wenn Du zb Docker ausführlich vorstellst, solltest Du auch sagen, wie man es absichert. Sonst rennen die Leute ins Verderben:)
Hi Christian, this video really helped me in my research prior to deploying my first home server. I do, however, have a few questions about securing my server and my data. Assuming I am running ubuntu: what would be the best way to share folders across my home network (to other Windows devices) and ensure that I'm protected from attacks outside my server. I will have a total of 3 users accessing these shared folders, including myself. Any help here would be greatly appreciated, or if you can provide a resource that would be helpful too. Thanks.
Depends a lot on how you're securing your home network and who has access. I personally would not let anything unauthorized and unencrypted into my home network, I can just recommend use a firewall solution, VPNs or Access Proxies. From inside the network it's a bit more difficult, there it might be a good idea to isolate the server in a separate network (DMZ), I'm doing this right now in my Homelab, check out in the next 2 weeks there is a firewall video coming out, that will explain this.
@@christianlempa Awesome. Thanks for the response. There is still so much to learn about this and I'm loving it. All of your videos are so helpful.
Nice SIr :D
is there something called very very excellent video
Thanks mate!
Subject: How to protect Linux from Hackers // My server security strategy! Rule1: don't tell hackers about your server security strategy Just joking :D great content Christian, keep on going! Regards from Czechia :)
Yes. Some security feature will be always better than none. Of course not all secure server are unhackable but to at least leave less port open. Use longer time to get stolen or own. Similar to your car if you don't have car alarm or steering lock. Car theft can happen within 1 to 5 minutes but if you have the security wheel lock gear lock brake lock will at least waste some of the car theft time. Even pentagon or military still get hack this is most secure but still got hacked. Good share. Thank you.
💯 agree!
I found your channel today and I am thrilled that you are so willing to share such pertinent information. One request I do have to ask is if you would just reduce your background music a bit. This should be a nuance addition to any video especially one's like yours with so much good info shared. The music is a bit too much at times and the mundane aspect of it distracts from your lessons and not in a good way. We want to hear what you have to say, not fight the music to hear you. Thanks Christian!
Thanks mate! Awesome feedback :) Well, I need to admit that in this video the background music is louder than usual, don't know what was going on :D But you're right! I'll reduce it in next videos even more.
what do you think about ufw-docker?
nice
New Subscriber 129k :D
Hey Christian! Why don’t ya use ssh-copy-id -I keyfile hostnamelikeinssh???
Good question, I guess I'm still used to the old way :D
I used to use UFW on all my servers - but, I ended up moving to iptables because UFW had a habit of dying after 30,000 plus IP addresses were blocked. I haven't run into that problem with iptables, but it's always possible it was a memory issue.
Wow, I will never run in that kind of issue with my small home lab, but well that might be a problem yeah.
What is this Terminal you are using, it looks cool and seems to suggest things?
Windows Terminal + ZSH + autosuggestions
Hi! How should I use the DMZ? I have 2 server. One host all my services in docker (nginx proxy manager, website, cloud services, apps, etc...) and I have a Raspberry with Adguard (and my TLS DNS) and a plex server. Should I move plex to the big one, and nginx to the small one and make the raspberry as dmz landzone to manage all traffic? Would it isolate the main server correctly? Thanks for helping!
5:26 there is a command that copy your ssh keys conveniently called ssh-copy-id
could you do a yubi key authentication integration on linux?
Hi Chris, at 8:24 you forgot to tell us what is the string you used.
hoho
Do you set up TPM for Linux?
What if we loose the SSH keys file ? We cannot log in any longer if we had disabled password login ?
How can I organize what needs to be updated like an apk file. Where should I save it to auto update?
First step is to protect the server against compromise. Next step is to have a reliable backup and disaster recovery plan in place,, for when it eventually happens despite everything you did right. ;)
Absolutely! Great points :)
thanks again christian. perhaps if you allow I'd like to add that limit instead of allow might be better on port 22 otherwise no one is held back from brut forcing although it might be hard anyway since you permit keys only but it is not reply more work
good suggestions! thanks ;)
Heftiger Typ!
What the, so SSH doesn't block that tries too make wrong passwords out-of-the-box and I have install a third-party utility?
18:48 I thought that enabling a service would only make it active after the next startup of your computer and that you have to add --now to make it work immediately. 28:12 You speak so fluently(!), but the way you say "determine"...?
What do the seemingly random numbers at the beginning of the files mean? I saw similar numbers in polkit configuration files.
When dealing with newer programs that have multiple configuration files, you can use the numbers at the beginning to determine in which order they're read. One common example is the messages you get when you log into modern Ubuntu servers. It gives you information about your server, but actually they're made up of different scripts ran from a specified folder. You can then insert your own scripts before/after the existing scripts depending on the number you set the file to. Lowest number wins in this case. I'm not 100% sure, but in theory you probably don't NEED to use numbers, it's just a human way of ordering things.
Vielen Dank Christian Grüsse von Arizona
Hey! Vielen Dank und Grüße zurück :D
Future video series idea... assessing the security benefits of NixOS and Guix OS as they compare to {insert mainstream Linux OS here}. To be fair, though, please note the considerable learning curves associated with each of the aforementioned OS'es... you have been warned. :-)
Well, I haven't looked at these distros, yet.
what time do you do a live streaming ? here from china, has a different timezone
Hey bro, Usually Thursday 5pm CET, but recently I wasn't live a lot, unfortunately :( Btw, you see the scheduled ones in the subscription feed as well!
Great video! I think you could speak a little bit slower, I feel slightly rushed when I try to comprehend what you are executing exactly. ;)
Thanks' :D Yeah, I try to slow it down a little bit. But it's hard to find that perfect balance that everybody enjoys. Most stuff on YT is fast, otherwise people are just leaving :/
Is there any git repository for this tutorial? 🙂
hello sir , can you please make a video about installing windows server on digital ocean vps ?
Hm that's probably not what I'm focussing on right now, I'm sorry.
Any reason for still using RSA for SSH key on modern server?
What would you suggest?
@@christianlempa Using ed25519 if your server update is not older than 5 years old. Sure, RSA 4096 is still good, but it's slow compared to elliptic curves. There is an option to use ed25519 in ssh-keygen, so you don't need to configure anything
@@inlophe last time I checked it wasn't supported on all devices, that’s why I still haven't used it. It might become relevant at some point, but I guess that would be worth a separate video in an unknown future 😊
Can I have opinions on some of strategy I use: 1. SSH Access only by key, no password 2. Use fail2ban, block 24 hours on 1st bad attempt 3. Optional (Only allow ssh from specific IP) Thanks
Sounds like a good solution!
Is there any web-based control panel for all of these mentioned security rules and concepts? I've heard, Portainer is able to some security tasks. But not all of my services are docker based containers. I need an overview, better than ss -ltpn
I'm not aware of any UI for this, sorry
Besides, system (Milkyway, Universe) is a simulated system inside virtual computer and your PC is a virtual computer inside that virtual computer, so from higher levels of system you can access any way you like the low level virtual computers. Bit like Russian children's toy: Matrychka doll.
There are few other things you should add to your strategy of protectiong your servers and network in general. First and foremost youn need to learn OSI layers of network and set up your security on each of the layers. I did mentioned layers didn't I? that's actualy second thing, set up your security as layers because it will help you keep track of attacker as he moves across layers to egt to destination. More layers of protection you have better it is for you because you can catch attacker sooner and respond faster, it will help you with revealing possible vunerabilty because you can see at which layer it happened. most of the time you'll connect to everything within your network for maintenance via ssh right? Yeah in that case change port you're gonna be using for ssh in your network because using default port for it is agains best practices. Now onto vlans. Fragment you network with vlans how ever one of the vlans should be designated as native vlan where everything untagged goes but that can't and shouldn't be vlan 0, also if you have unused prort assign them to unused vlan as security measure, doing what i said with vlans prevents attacker from using vlan hoping attack to get to your data. There are many more attacks but if i keep writing my comment will get too long so i will mention one that can result with DOS across your network and it's dhcp exaustion which happens as a result of dhcp receiving bunch of fake requests for ip to the point where dhcp server runs out of ip's and without ip devices cannot connect to network. There's a lot more you can do.
There’s always something more you can do, but in the end all of these strategies provide a strong foundation to cover 99% of the attacks you’re facing as a homelab dude :)
@@christianlempa what i said about ssh,vlan and dhcp exhaustion comes from best practices recommended ny cisco systems.
Hi, did my previous question get deleted? Wanted to know if it works to install fail2ban via ecex console direcly in the container of bitwarden and nextcloud to protect them from brude force attacks or doesn't it work this way? But what would be the alternative?
Don't know why YT sometimes deletes comments.. well you can configure fail2ban to look at the logfiles from the containers. Usually docker stores the logfiles in the /var/lib/docker/containers//.json.log file.
@The Digital Life I meant something else. Where do I have to install fail2ban so that I can protect Bitwarden and nextcloud (in containers and in the public network via NGINX Proxy Manager) against brute force attacks. Directly on my raspberry pi? In the respective containers etc.?
What software do you use to open the linux shells
I recently made a video about my entire setup, maybe thats interesting for you: kzhead.info/sun/oqpvl7Cxn4N6l68/bejne.html
Another good addition to reducing the attack surface is using non-standard ports i.e. anything above port 2048. Most scripts only poke around those ports and skip the rest as it significantly increases scanning time. A practical way of doing that is running a honey pot on port 22 while moving your actual SSH service somewhere else.
Yeah you can think about that. I didn't include it as I generally avoid to expose this port directly, but still a good option to get rid of annoying logs ;)
It takes half a second to scan all of your ports. Maybe you'll stop a few basic script kiddies who only target known ports like 22... but this literally does almost nothing to protect you.
Hi, which terminal client are you using?
I'm using Windows Terminal
Just use ssh-copy-id to copy your ssh key. Maybe someone else mentioned this already :)
Can you please share what you have in the ".bashrc" PS1 how you have the ubuntu logo and the directory upwards the terminal text, thank you
It's in my dotfiles on github
@@christianlempa Thank you so much 😊
Can I ask why you are using "scp" to copy the key rather than "ssh-copy-id"?
I'm still used to it ;)
What if I ignore security?
Is it possible to make a ssh connection available only when VPN is connected to the server?
Yeah, in that case you'd need to change the listening IP address of the SSH server to the internal network, or you could enable the UFW and only allow traffic from the internal network.
@@christianlempa Thank you
How do you lock down the back door built into system d
tell more about it. 🙂🙃
Coole Socke, abonniert :-)
Haha, danke! :)
ssh-copy-id, not scp. it will create remote files and permissions
I don't undertand the the docker chain, Port 9000 Problem. Why does ufw allow 9000?
That’s coming from the container engine
@@christianlempa yeah, but ufw shouldn't care where it's coming from...
Hi bro
You are One Punch man with 1 hit K.O.? :O