Photo by Sai Kiran Anagani on Unsplash
Now that our server is up and running we need to harden it. Or make it more difficult for anyone to gain unauthorized access to it.
There are lots of posts about this online. Here are some of my favorites:
- 10 Steps to secure Linux Server for Production Enviornment: a medium.com post by Megha Pandey
- 25 Hardening Security Tips for Linux Servers: a techmint article by Ravi Saive
- How to harden Ubuntu Server 16.04 security in five steps: a techrepublic article by Jack Wallen
I remember the first time I mistakenly connected my raspberry-pi to the internet with port forwarding enabled on my router. I was hit with thousands of login attempts for random IP addresses within half an hour. One advantage to this is that I was forced to learn about better ssh practices.
We are going to start by editing
Once you have that file open you want to uncomment and modify the following lines (I have arranged them by default value first, changed value second):
port 22 change this to an arbitrary number like 2916 (not 22, 80, 8080, etc.) PermitRootLogin no PubKeyAuthentication yes PasswordAuthentication no PermitEmptyPasswords no # This makes it so that only login attempts from specific IP # addresses can gain # access to your server. You can get your public IP address by # typing: "whats my ip" into duckduckgo.com # # You can always add new ip addresses from the web console in # your linode account if you get accidentally locked out. # # For more information: # https://www.cyberciti.biz/tips/howto-openssh-sshd-listen-multiple-ip-address.html ListenAddress <your-public-ip-address>
Next we need to create and add an rsa key to the server. On your local machine issue the following command:
Then press enter to save it to the default location, or enter a custom location. I recommend using
~/.ssh/id_rsa for the privileged user and
~/.ssh/minecraft_rsa for the Minecraft user.
Then enter a passphrase, this is another layer of added protection in case someone gets a hold of your private key. (*Note that you can also leave this blank for no passphrase, but it is highly discouraged).
We can do this by issuing the following command (note that if you entered a different filename/file location, you need to use them here):
ssh-copy-id -i ~/.ssh/id_rsa <username>@hostip ssh-copy-id -i ~/.ssh/minecraft_rsa minecraft@hostip
If you do not know your servers username or password (if you are currently using the web terminal) you can copy the key manually using the following steps:
~/.ssh/minecraft_rsa.pubto clipboard. You can do this in the following ways
- Windows (WSL):
cat ~/.ssh/minecraft_rsa.pub | clip.exe
cat ~/.ssh/minecraft_rsa.pub | xclip
cat ~/.ssh/minecraft_rsa.pub | pbcopy
- Windows (WSL):
- Create the following file in your text editor of choice:
~/.ssh/authorized_keysnote that this file may already exist
- Append your
/home/miencraft/.ssh/minecraft_rsa.pubkey to the end of this file
- Copy your other users ssh key to clipboard
- Paste that users key into
Finally, we need to restart the
sshd service so that our changes take effect.
sudo systemctl restart sshd
I have found the easiest way to do this is using
ufw. We start by enabling the service:
sudo ufw enable
Next we need to setup some default rules
sudo ufw default deny incomming sudo ufw default allow outgoing
We also need to allow the port we specified for ssh to be open (remember I chose 2916, you need to replace that with the value you chose):
sudo ufw allow 2916/tcp
Now we need to allow traffic through port 25565 (the default port for Minecraft servers).
sudo ufw allow 25565/tcp
We can check and see all our rules by the following command:
sudo ufw status
This is a tip I learned while trying to disable ICMP broadcast requests. Taken from that Tech Republic article written by Jack Wallen that I mentioned in the beginning of this article.
There is a very simple way to prevent source routing of incoming packets (and log all malformed IPs) on your Ubuntu Server. Open a terminal window, issue the command sudo nano /etc/sysctl.conf, and uncomment or add the following lines:
# IP Spoofing protection net.ipv4.conf.all.rp_filter = 1 net.ipv4.conf.default.rp_filter = 1 # Ignore ICMP broadcast requests net.ipv4.icmp_echo_ignore_broadcasts = 1 # Disable source packet routing net.ipv4.conf.all.accept_source_route = 0 net.ipv6.conf.all.accept_source_route = 0 net.ipv4.conf.default.accept_source_route = 0 net.ipv6.conf.default.accept_source_route = 0 # Ignore send redirects net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.default.send_redirects = 0 # Block SYN attacks net.ipv4.tcp_syncookies = 1 net.ipv4.tcp_max_syn_backlog = 2048 net.ipv4.tcp_synack_retries = 2 net.ipv4.tcp_syn_retries = 5 # Log Martians net.ipv4.conf.all.log_martians = 1 net.ipv4.icmp_ignore_bogus_error_responses = 1 # Ignore ICMP redirects net.ipv4.conf.all.accept_redirects = 0 net.ipv6.conf.all.accept_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 net.ipv6.conf.default.accept_redirects = 0 # Ignore Directed pings net.ipv4.icmp_echo_ignore_all = 1
We then restart the service so that the changes take effect:
sudo sysctl -p
To make it easier to copy files and to access the server, we will be creating entries in our local machines ssh config (
~/.ssh/config). Open that file in your favorite text editor and insert the following:
Host linode Hostname <linode-server-ip> Port 2916 User <username> Host minecraft Hostname <linode-server-ip> IdentityFile ~/.ssh/minecraft_rsa Port 2916 User minecraft
Now when we want to login to our server via ssh we can use:
This also makes copying files a lot easier. More on that later.
If you have any suggjectsions or comments on how I could do this better please leave them down below!