View source for Securing its Debian machine

<span data-link_translate_ro_title="Asigurarea sa maşină de Debian"  data-link_translate_ro_url="Asigurarea+sa+ma%C5%9Fin%C4%83+de+Debian"></span>[[:ro:Asigurarea sa maşină de Debian]][[ro:Asigurarea sa maşină de Debian]]
<span data-link_translate_pl_title="Zabezpieczanie swojej maszynie Debiana"  data-link_translate_pl_url="Zabezpieczanie+swojej+maszynie+Debiana"></span>[[:pl:Zabezpieczanie swojej maszynie Debiana]][[pl:Zabezpieczanie swojej maszynie Debiana]]
<span data-link_translate_de_title="Sicherung ihrer Debian-Rechner"  data-link_translate_de_url="Sicherung+ihrer+Debian-Rechner"></span>[[:de:Sicherung ihrer Debian-Rechner]][[de:Sicherung ihrer Debian-Rechner]]
<span data-link_translate_nl_title="Beveiligen zijn Debian machine"  data-link_translate_nl_url="Beveiligen+zijn+Debian+machine"></span>[[:nl:Beveiligen zijn Debian machine]][[nl:Beveiligen zijn Debian machine]]
<span data-link_translate_it_title="Protezione relativa macchina Debian"  data-link_translate_it_url="Protezione+relativa+macchina+Debian"></span>[[:it:Protezione relativa macchina Debian]][[it:Protezione relativa macchina Debian]]
<span data-link_translate_pt_title="Protegendo sua máquina Debian"  data-link_translate_pt_url="Protegendo+sua+m%C3%A1quina+Debian"></span>[[:pt:Protegendo sua máquina Debian]][[pt:Protegendo sua máquina Debian]]
<span data-link_translate_es_title="Su máquina Debian"  data-link_translate_es_url="Su+m%C3%A1quina+Debian"></span>[[:es:Su máquina Debian]][[es:Su máquina Debian]]
<span data-link_translate_fr_title="Sécuriser sa machine Debian"  data-link_translate_fr_url="S%C3%A9curiser_sa_machine_Debian"></span>[[:fr:Sécuriser sa machine Debian]][[fr:Sécuriser sa machine Debian]]
<br />

This article has been created by an automatic translation software. You can view the article source [[:fr:Sécuriser sa machine Debian|here]].<br /><span data-translate="fr"></span>



==Introduction ==
Ensure the safety of his machine is an essential point that shor ld No. t be underestimated under penalty of becoming the target of various attacks. The current power of computers today making intrusions as the brute-force attack techniques or  ''bruteforce'' very simple to implement to gain administrator access to the target in a short time machine.
<br><br>
On this page you will find a non-exhaustive list of tracks in order to secure your Debian server on different points such as the root account, SSH  access, firewall, etc...
<div style="background-color: #FF9999;"> '''Warning ''': Before making any changes to your system always plan a backup of your files in the event of improper handling. <br>
On a production server, be sure to perform these operations during off-peak hours to minimize the impact of your actions. </div>

==Prerequisites ==
One of the prerequisite essential to the security of his server is to maintain its packages in their version the most up to date as possible. A significant number of discovered flaws are quickly corrected by the developers of packages and applications involved, wherever possible should always retain its system to update and thus to avoid security flaws.
Keeping your Debian system up-to-date, make sure you have a list of the official repositories to update. You can find a list of the available at Ikoula repositories and installation instructions  [[:fr:Quelles_sont_les_sources_des_d%C3%A9p%C3%B4ts_debian_chez_Ikoula| at this address]].

==Root access ==
Allow connections from account  ''root'' After the first use is generally not a good idea. Indeed the account  ''root'' ou ''superuser '' has full access to your system. <br>If an attacker comes to gain access to account  ''superuser '' It will have total control of your machine.
===The command sudo ===
To reduce the risk you can, for example, add a user who, if necessary, will get the rights of our  ''superuser '' by using the command  ''sudo''.
;We first need to create a new user  :
<syntaxhighlight lang="bash"> adduser votre_utilisateur</syntaxhighlight>
Next, fill the fields as well as the password which preferably will be made up of lowercase letters, uppercase letters, and numbers.
;We will now install sudo :
<syntaxhighlight lang="bash"> apt-get install sudo</syntaxhighlight>
;Now that our user is created and that sudo is installed it will have to be in the sudo group to use the command :
<syntaxhighlight lang="bash"> usermod -a -G sudo votre_utilisateur </syntaxhighlight>

From now our user may, if necessary, precede the command you want sudo to run with permissions of  ''superuser ''.
<br>Password will be asked before you run any command.
<syntaxhighlight lang="bash"> sudo cat /etc/password </syntaxhighlight> 

===Prohibit the root login ===
Now that we have another user we can for example prevent connecting to our system from the account  ''root''.<br>

;First you need to edit the configuration of the ssh service file 
<syntaxhighlight lang="bash">  vi /etc/ssh/sshd_config </syntaxhighlight>

;Find and edit the following line in your sshd_config file, by changing the  ''Yes '' by  ''no''. Needed to uncomment the line by deleting the symbol  #.
<syntaxhighlight lang="bash">  PermitRootLogin no </syntaxhighlight>

Remember then save and close the configuration file. <br>
;When the SSH service will be restarted your changes will take effect.
<syntaxhighlight lang="bash"> /etc/init.d/ssh restart </syntaxhighlight>
<br>
<div style="background-color: #FFCC99;"> '''Council ''': It is recommended that you always keep the SSH terminal as root for the duration of the tests. Indeed mishandling would make the connection to your impossible system. <br>
The opening of a second terminal in order to test the connection and use of the changes on the new user is therefore recommended. </div>

==SSH access ==
Thanks to the solutions previously our system is already well secured, but we can still enhance this security by implementing an authentication key file. <br>
Usually the connection and authentication on your system is performed via a login pair /password. We can replace this method which is not infallible by key authentication. <br>
Once the change implementation during each new connection system will watch if the user attempting to connect has a valid key and if this has permission to perform a login for this user. <br>
Although no method is foolproof authentication key file requires the person wanting to get into the system that it has this file. So, we can strengthen the security versus a password that can be guessed by  ''brute force''<br>
Several drawbacks, however, are present when this method is selected, it is imperative to have the key file regardless of the location of the connection, for example between computers at work and at home. <br>
You also need to manually added each new key file which will be allowed access to your system, in the case for example of adding a new user or access by a person authorized to your system.

=== Change the default port  ===
One of the ways the most effective to stop automatic tests launched against servers is change the default SSH port on your machine.
To do this edit your file  '''sshd_config'''
<syntaxhighlight lang="bash"> vi /etc/ssh/sshd_config </syntaxhighlight>
; Find and edit the next line of the file by changing the value by one chosen 
<syntaxhighlight lang="bash"># What ports, IPs and protocols we listen for
Port 22
</syntaxhighlight>
; Restart the SSH service 
<syntaxhighlight lang="bash"> /etc/init.d/ssh restart </syntaxhighlight>
<div style="background-color: #FFCC99;"> '''Note''': Now connect to your machine will be specifying the new port SSH : SSH user @IPAddress  -p Votre_port</div>
<br>
=== Generate a key pair  ===
==== Windows ====
[[File:puttygen.png|thumb|right|PuTTYgen sous Windows]]
You can generate your key from PuTTYgen software available for Windows.
<br>
==== Linux ====
Under linux you can type the following command  :
<syntaxhighlight lang="bash"> ssh-keygen </syntaxhighlight>

=== Copy a key pair  ===
When the pair is generated we must now indicate the server what are persons authorized to connect to our new user.
To do this each user of our system has a file  '''ssh/authorized_keys''' present in the local directory.

;If you are currently generate the keypair on your Debian system you can use the following command to automatically copy the key into the file.
<syntaxhighlight lang="bash"> ssh-copy-id votre_utilisateur@IP_VotreServeur </syntaxhighlight>

;Alternatively you can manually add your public key to the authorized persons file 
If the .ssh folder does not exist in our user's local folder we create it 
<syntaxhighlight lang="bash">mkdir .ssh
chmod 700 .ssh
</syntaxhighlight>
;Now we need to create a file  '''authorized_keys''' in our .ssh folder 
<syntaxhighlight lang="bash"> vi .ssh/authorized_keys
</syntaxhighlight>
; The public key is then added to the file, the result should be similar to this example 
<syntaxhighlight lang="bash"> ssh-rsa AAAB3NzaC1yc2EAAAADAQaSdMTJXMy3MtlQhva+j9CgguyVbU3nCKneB+KjKiS/1rggpFmu3HbXBnWSUdf votre_utilisateur@machine.locale </syntaxhighlight>
It saves and closes the file.
; For security reasons we will restrict access to our file 
<syntaxhighlight lang="bash"> chmod 600 .ssh/authorized_keys
</syntaxhighlight>
From now our user is allowed to connect to the machine.


==Firewall ==
Using a firewall is strongly recommended to secure your system. <br>
The firewall is often the first line of defense of your machine against the outside, it is indeed him who will analyze the traffic that passes between your machine and the outside. <br>
Thanks to the firewall you are able to block or allow access your machine from the outside to certain protocols or ports, thus ensuring the security of your system.
===Security policies ===
In the case of a firewall it is necessary to define a security policy to be implemented. Without an effective definition the choice of blocking or permission of the ports and protocols would be pretty random. <br>
It is therefore necessary to define in advance a clear policy for the security of its computer network or his machine. <br>
<br>
The various policies commonly used include policies of  '''whitelist ''' and de  '''the blacklist '''.
====Whitelist ====
The principle of the policy of the  '''whitelist ''' is to block all traffic entering without exception and allow explicitly only the ports and protocols that we are absolutely sure of their safety.
This security policy has many advantages compared to the  '''blacklist '''. Indeed all traffic not explicitly allowed will be blocked, this will prevent most connection attempts that we wouldn't have necessarily had the reflex to secure. <br>
One of the disadvantages of this policy is the obligation of having to define each ports or protocols used to do not block execution of our services  ( for example the Protocol  ''http'' on port  80 )We must therefore know each port used by the machine and maintain the rules when adding or deleting a service.
Concerning outbound in the majority of cases it is not considered as risky to all authorized, indeed you are supposed to know the traffic leaving your machine or network. However, it is recommended to keep a trace of the outbound security.
====Blacklist ====
The principle of the policy of the  '''blacklist ''' is to allow all incoming traffic without exception and to explicitly block only the ports and protocols which we are sure that they pose a risk to security. <br>
This security policy has many drawbacks compared to the  '''whitelist '''. Indeed allow all traffic entering without any restriction is not recommended, blocking involved only in the case of a port or explicitly established protocol.
Concerning outbound in the majority of cases it is not considered as risky to all authorized, indeed you are supposed to know the traffic leaving your machine or network. However, it is recommended to keep a trace of the outbound security.
===IPTables ===
IPTables is surely the best-known software firewall available for Debian.

Here are a few practical commands concerning :
;Installation of iptables 
<syntaxhighlight lang="bash"> sudo apt-get install iptables </syntaxhighlight>
; List the currently established rules 
<syntaxhighlight lang="bash"> sudo iptables -L </syntaxhighlight>
; Purge the established rules 
<syntaxhighlight lang="bash">
sudo iptables -F
sudo iptables -X
</syntaxhighlight>
;Add a rule 
<syntaxhighlight lang="bash">
# Autoriser les connexions entrantes sur le port ssh(22) tcp depuis l'adresse ip x.x.x.x par exemple
sudo iptables -A INPUT -p tcp --dport ssh -s x.x.x.x -j ACCEPT
</syntaxhighlight>
<div style="background-color: #FFCC99;"> '''Note''': Attention in the case of a dynamic IP address, as your IP will be changed you will be unable to log into SSH on your server !<br>
Use caution when assigning an IP address which could be dynamic, for example that of your internet box at home. </div>
;Delete a rule
<syntaxhighlight lang="bash">
# Supprimer la règle n°2 de la catégorie OUTPUT
sudo iptables -D OUTPUT 2
</syntaxhighlight>

[[Category:Dedicated_server]]
[[Category:Linux]]
<br />
<comments />