Securing its Debian machine - Revision history

Cbrochot1072d at 14:37, 1 October 2021

2021-10-01T14:37:45Z

Cbrochot1072d at 10:27, 27 September 2021

2021-09-27T10:27:15Z

Woussen.alexis59c630e at 15:07, 16 December 2020

2020-12-16T15:07:32Z

Ikbot at 14:32, 9 February 2017

2017-02-09T14:32:56Z

Ikbot at 21:17, 7 December 2015

2015-12-07T21:17:22Z

Ikbot at 21:17, 7 December 2015

2015-12-07T21:17:21Z

Ikbot at 21:17, 7 December 2015

2015-12-07T21:17:19Z

Ikbot at 21:17, 7 December 2015

2015-12-07T21:17:18Z

Ikbot at 21:17, 7 December 2015

2015-12-07T21:17:17Z

Ikbot: Bot: Automated text replacement (-security +{{Template:Sécurité}})

2015-11-05T14:31:23Z

Bot: Automated text replacement (-security +{{Template:Sécurité}})

@@ Line 24: / Line 24: @@
 |image_alt=Wiki Logo
 }}
 ==Introduction ==

@@ Line 29: / Line 29: @@
 Ensure the safety of his machine is an essential point that shor ld No. t be underestimated under penalty of becoming the target of various attacks. The current power of computers today making intrusions as the brute-force attack techniques or  ''bruteforce'' very simple to implement to gain administrator access to the target in a short time machine.
 <br><br>
-On this page you will find a non-exhaustive list of tracks in order to secure your Debian server on different points such as the root account, SSH  access, firewall, etc...
+On this page you will find a non-exhaustive list of tracks in order to secure your [https://www.ikoula.com/en/dedicated-server/linux/debian Debian] server on different points such as the root account, SSH  access, firewall, etc...
 <div style="background-color: #FF9999;"> '''Warning ''': Before making any changes to your system always plan a {{Template:Backup}} of your files in the event of improper handling. <br>
 On a production server, be sure to perform these operations during off-peak hours to minimize the impact of your actions. </div>

@@ Line 14: / Line 14: @@
 <span data-link_translate_fr_title="Sécuriser sa machine Debian"  data-link_translate_fr_url="S%C3%A9curiser_sa_machine_Debian"></span>[[:fr:Sécuriser sa machine Debian]][[fr:Sécuriser sa machine Debian]]
 <br />
 This article has been created by an automatic translation software. You can view the article source [[:fr:Sécuriser sa machine Debian|here]].<br /><span data-translate="fr"></span>

← Older revision		Revision as of 14:32, 9 February 2017
Line 1:		Line 1:
		+	<span data-link_translate_en_title="Securing its Debian machine" data-link_translate_en_url="Securing its Debian machine"></span>[[:en:Securing its Debian machine]][[en:Securing its Debian machine]]
	<span data-link_translate_he_title="אבטחת הרכב דביאן שלה" data-link_translate_he_url="%D7%90%D7%91%D7%98%D7%97%D7%AA+%D7%94%D7%A8%D7%9B%D7%91+%D7%93%D7%91%D7%99%D7%90%D7%9F+%D7%A9%D7%9C%D7%94"></span>[[:he:אבטחת הרכב דביאן שלה]][[he:אבטחת הרכב דביאן שלה]]		<span data-link_translate_he_title="אבטחת הרכב דביאן שלה" data-link_translate_he_url="%D7%90%D7%91%D7%98%D7%97%D7%AA+%D7%94%D7%A8%D7%9B%D7%91+%D7%93%D7%91%D7%99%D7%90%D7%9F+%D7%A9%D7%9C%D7%94"></span>[[:he:אבטחת הרכב דביאן שלה]][[he:אבטחת הרכב דביאן שלה]]
	<span data-link_translate_ru_title="Обеспечение его машины под управлением Debian" data-link_translate_ru_url="%D0%9E%D0%B1%D0%B5%D1%81%D0%BF%D0%B5%D1%87%D0%B5%D0%BD%D0%B8%D0%B5+%D0%B5%D0%B3%D0%BE+%D0%BC%D0%B0%D1%88%D0%B8%D0%BD%D1%8B+%D0%BF%D0%BE%D0%B4+%D1%83%D0%BF%D1%80%D0%B0%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5%D0%BC+Debian"></span>[[:ru:Обеспечение его машины под управлением Debian]][[ru:Обеспечение его машины под управлением Debian]]		<span data-link_translate_ru_title="Обеспечение его машины под управлением Debian" data-link_translate_ru_url="%D0%9E%D0%B1%D0%B5%D1%81%D0%BF%D0%B5%D1%87%D0%B5%D0%BD%D0%B8%D0%B5+%D0%B5%D0%B3%D0%BE+%D0%BC%D0%B0%D1%88%D0%B8%D0%BD%D1%8B+%D0%BF%D0%BE%D0%B4+%D1%83%D0%BF%D1%80%D0%B0%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5%D0%BC+Debian"></span>[[:ru:Обеспечение его машины под управлением Debian]][[ru:Обеспечение его машины под управлением Debian]]

← Older revision		Revision as of 21:17, 7 December 2015
Line 1:		Line 1:
		+	<span data-link_translate_he_title="אבטחת הרכב דביאן שלה" data-link_translate_he_url="%D7%90%D7%91%D7%98%D7%97%D7%AA+%D7%94%D7%A8%D7%9B%D7%91+%D7%93%D7%91%D7%99%D7%90%D7%9F+%D7%A9%D7%9C%D7%94"></span>[[:he:אבטחת הרכב דביאן שלה]][[he:אבטחת הרכב דביאן שלה]]
	<span data-link_translate_ru_title="Обеспечение его машины под управлением Debian" data-link_translate_ru_url="%D0%9E%D0%B1%D0%B5%D1%81%D0%BF%D0%B5%D1%87%D0%B5%D0%BD%D0%B8%D0%B5+%D0%B5%D0%B3%D0%BE+%D0%BC%D0%B0%D1%88%D0%B8%D0%BD%D1%8B+%D0%BF%D0%BE%D0%B4+%D1%83%D0%BF%D1%80%D0%B0%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5%D0%BC+Debian"></span>[[:ru:Обеспечение его машины под управлением Debian]][[ru:Обеспечение его машины под управлением Debian]]		<span data-link_translate_ru_title="Обеспечение его машины под управлением Debian" data-link_translate_ru_url="%D0%9E%D0%B1%D0%B5%D1%81%D0%BF%D0%B5%D1%87%D0%B5%D0%BD%D0%B8%D0%B5+%D0%B5%D0%B3%D0%BE+%D0%BC%D0%B0%D1%88%D0%B8%D0%BD%D1%8B+%D0%BF%D0%BE%D0%B4+%D1%83%D0%BF%D1%80%D0%B0%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5%D0%BC+Debian"></span>[[:ru:Обеспечение его машины под управлением Debian]][[ru:Обеспечение его машины под управлением Debian]]
	<span data-link_translate_ja_title="その Debian マシンを確保" data-link_translate_ja_url="%E3%81%9D%E3%81%AE+Debian+%E3%83%9E%E3%82%B7%E3%83%B3%E3%82%92%E7%A2%BA%E4%BF%9D"></span>[[:ja:その Debian マシンを確保]][[ja:その Debian マシンを確保]]		<span data-link_translate_ja_title="その Debian マシンを確保" data-link_translate_ja_url="%E3%81%9D%E3%81%AE+Debian+%E3%83%9E%E3%82%B7%E3%83%B3%E3%82%92%E7%A2%BA%E4%BF%9D"></span>[[:ja:その Debian マシンを確保]][[ja:その Debian マシンを確保]]

@@ Line 21: / Line 21: @@
 ==Prerequisites ==
-One of the prerequisite essential to the security of his server is to maintain its packages in their version the most up to date as possible. A significant number of discovered flaws are quickly corrected by the developers of packages and applications involved, wherever possible should always retain its system to update and thus to avoid security flaws.
+One of the prerequisite essential to the {{Template:Sécurité}} of his server is to maintain its packages in their version the most up to date as possible. A significant number of discovered flaws are quickly corrected by the developers of packages and applications involved, wherever possible should always retain its system to update and thus to avoid {{Template:Sécurité}} flaws.
 Keeping your Debian system up-to-date, make sure you have a list of the official repositories to update. You can find a list of the available at Ikoula repositories and installation instructions  [[:fr:Quelles_sont_les_sources_des_d%C3%A9p%C3%B4ts_debian_chez_Ikoula| at this address]].
@@ Line 57: / Line 57: @@
 ==SSH access ==
-Thanks to the solutions previously our system is already well secured, but we can still enhance this security by implementing an authentication key file. <br>
+Thanks to the solutions previously our system is already well secured, but we can still enhance this {{Template:Sécurité}} by implementing an authentication key file. <br>
 Usually the connection and authentication on your system is performed via a login pair /password. We can replace this method which is not infallible by key authentication. <br>
 Once the change implementation during each new connection system will watch if the user attempting to connect has a valid key and if this has permission to perform a login for this user. <br>
-Although no method is foolproof authentication key file requires the person wanting to get into the system that it has this file. So, we can strengthen the security versus a password that can be guessed by  ''brute force''<br>
+Although no method is foolproof authentication key file requires the person wanting to get into the system that it has this file. So, we can strengthen the {{Template:Sécurité}} versus a password that can be guessed by  ''brute force''<br>
 Several drawbacks, however, are present when this method is selected, it is imperative to have the key file regardless of the location of the connection, for example between computers at work and at home. <br>
 You also need to manually added each new key file which will be allowed access to your system, in the case for example of adding a new user or access by a person authorized to your system.
@@ Line 103: / Line 103: @@
 <syntaxhighlight lang="bash"> ssh-rsa AAAB3NzaC1yc2EAAAADAQaSdMTJXMy3MtlQhva+j9CgguyVbU3nCKneB+KjKiS/1rggpFmu3HbXBnWSUdf votre_utilisateur@machine.locale </syntaxhighlight>
 It saves and closes the file.
-; For security reasons we will restrict access to our file
+; For {{Template:Sécurité}} reasons we will restrict access to our file
 <syntaxhighlight lang="bash"> chmod 600 .ssh/authorized_keys
 </syntaxhighlight>
@@ Line 112: / Line 112: @@
 Using a firewall is strongly recommended to secure your system. <br>
 The firewall is often the first line of defense of your machine against the outside, it is indeed him who will analyze the traffic that passes between your machine and the outside. <br>
-Thanks to the firewall you are able to block or allow access your machine from the outside to certain protocols or ports, thus ensuring the security of your system.
+Thanks to the firewall you are able to block or allow access your machine from the outside to certain protocols or ports, thus ensuring the {{Template:Sécurité}} of your system.
 ===Security policies ===
-In the case of a firewall it is necessary to define a security policy to be implemented. Without an effective definition the choice of blocking or permission of the ports and protocols would be pretty random. <br>
+In the case of a firewall it is necessary to define a {{Template:Sécurité}} policy to be implemented. Without an effective definition the choice of blocking or permission of the ports and protocols would be pretty random. <br>
-It is therefore necessary to define in advance a clear policy for the security of its computer network or his machine. <br>
+It is therefore necessary to define in advance a clear policy for the {{Template:Sécurité}} of its computer network or his machine. <br>
 <br>
 The various policies commonly used include policies of  '''whitelist ''' and de  '''the blacklist '''.
 ====Whitelist ====
 The principle of the policy of the  '''whitelist ''' is to block all traffic entering without exception and allow explicitly only the ports and protocols that we are absolutely sure of their safety.
-This security policy has many advantages compared to the  '''blacklist '''. Indeed all traffic not explicitly allowed will be blocked, this will prevent most connection attempts that we wouldn't have necessarily had the reflex to secure. <br>
+This {{Template:Sécurité}} policy has many advantages compared to the  '''blacklist '''. Indeed all traffic not explicitly allowed will be blocked, this will prevent most connection attempts that we wouldn't have necessarily had the reflex to secure. <br>
 One of the disadvantages of this policy is the obligation of having to define each ports or protocols used to do not block execution of our services  ( for example the Protocol  ''http'' on port  80 )We must therefore know each port used by the machine and maintain the rules when adding or deleting a service.
-Concerning outbound in the majority of cases it is not considered as risky to all authorized, indeed you are supposed to know the traffic leaving your machine or network. However, it is recommended to keep a trace of the outbound security.
+Concerning outbound in the majority of cases it is not considered as risky to all authorized, indeed you are supposed to know the traffic leaving your machine or network. However, it is recommended to keep a trace of the outbound {{Template:Sécurité}}.
 ====Blacklist ====
-The principle of the policy of the  '''blacklist ''' is to allow all incoming traffic without exception and to explicitly block only the ports and protocols which we are sure that they pose a risk to security. <br>
+The principle of the policy of the  '''blacklist ''' is to allow all incoming traffic without exception and to explicitly block only the ports and protocols which we are sure that they pose a risk to {{Template:Sécurité}}. <br>
-This security policy has many drawbacks compared to the  '''whitelist '''. Indeed allow all traffic entering without any restriction is not recommended, blocking involved only in the case of a port or explicitly established protocol.
+This {{Template:Sécurité}} policy has many drawbacks compared to the  '''whitelist '''. Indeed allow all traffic entering without any restriction is not recommended, blocking involved only in the case of a port or explicitly established protocol.
-Concerning outbound in the majority of cases it is not considered as risky to all authorized, indeed you are supposed to know the traffic leaving your machine or network. However, it is recommended to keep a trace of the outbound security.
+Concerning outbound in the majority of cases it is not considered as risky to all authorized, indeed you are supposed to know the traffic leaving your machine or network. However, it is recommended to keep a trace of the outbound {{Template:Sécurité}}.
 ===IPTables ===
 IPTables is surely the best-known software firewall available for Debian.

← Older revision		Revision as of 21:17, 7 December 2015
Line 1:		Line 1:
		+	<span data-link_translate_ja_title="その Debian マシンを確保" data-link_translate_ja_url="%E3%81%9D%E3%81%AE+Debian+%E3%83%9E%E3%82%B7%E3%83%B3%E3%82%92%E7%A2%BA%E4%BF%9D"></span>[[:ja:その Debian マシンを確保]][[ja:その Debian マシンを確保]]
	<span data-link_translate_ar_title="تأمين جهاز به دبيان" data-link_translate_ar_url="%D8%AA%D8%A3%D9%85%D9%8A%D9%86+%D8%AC%D9%87%D8%A7%D8%B2+%D8%A8%D9%87+%D8%AF%D8%A8%D9%8A%D8%A7%D9%86"></span>[[:ar:تأمين جهاز به دبيان]][[ar:تأمين جهاز به دبيان]]		<span data-link_translate_ar_title="تأمين جهاز به دبيان" data-link_translate_ar_url="%D8%AA%D8%A3%D9%85%D9%8A%D9%86+%D8%AC%D9%87%D8%A7%D8%B2+%D8%A8%D9%87+%D8%AF%D8%A8%D9%8A%D8%A7%D9%86"></span>[[:ar:تأمين جهاز به دبيان]][[ar:تأمين جهاز به دبيان]]
	<span data-link_translate_zh_title="确保其 Debian 的机器" data-link_translate_zh_url="%E7%A1%AE%E4%BF%9D%E5%85%B6+Debian+%E7%9A%84%E6%9C%BA%E5%99%A8"></span>[[:zh:确保其 Debian 的机器]][[zh:确保其 Debian 的机器]]		<span data-link_translate_zh_title="确保其 Debian 的机器" data-link_translate_zh_url="%E7%A1%AE%E4%BF%9D%E5%85%B6+Debian+%E7%9A%84%E6%9C%BA%E5%99%A8"></span>[[:zh:确保其 Debian 的机器]][[zh:确保其 Debian 的机器]]

← Older revision		Revision as of 21:17, 7 December 2015
Line 1:		Line 1:
		+	<span data-link_translate_ar_title="تأمين جهاز به دبيان" data-link_translate_ar_url="%D8%AA%D8%A3%D9%85%D9%8A%D9%86+%D8%AC%D9%87%D8%A7%D8%B2+%D8%A8%D9%87+%D8%AF%D8%A8%D9%8A%D8%A7%D9%86"></span>[[:ar:تأمين جهاز به دبيان]][[ar:تأمين جهاز به دبيان]]
	<span data-link_translate_zh_title="确保其 Debian 的机器" data-link_translate_zh_url="%E7%A1%AE%E4%BF%9D%E5%85%B6+Debian+%E7%9A%84%E6%9C%BA%E5%99%A8"></span>[[:zh:确保其 Debian 的机器]][[zh:确保其 Debian 的机器]]		<span data-link_translate_zh_title="确保其 Debian 的机器" data-link_translate_zh_url="%E7%A1%AE%E4%BF%9D%E5%85%B6+Debian+%E7%9A%84%E6%9C%BA%E5%99%A8"></span>[[:zh:确保其 Debian 的机器]][[zh:确保其 Debian 的机器]]
	<span data-link_translate_ro_title="Asigurarea sa maşină de Debian" data-link_translate_ro_url="Asigurarea+sa+ma%C5%9Fin%C4%83+de+Debian"></span>[[:ro:Asigurarea sa maşină de Debian]][[ro:Asigurarea sa maşină de Debian]]		<span data-link_translate_ro_title="Asigurarea sa maşină de Debian" data-link_translate_ro_url="Asigurarea+sa+ma%C5%9Fin%C4%83+de+Debian"></span>[[:ro:Asigurarea sa maşină de Debian]][[ro:Asigurarea sa maşină de Debian]]

← Older revision		Revision as of 21:17, 7 December 2015
Line 1:		Line 1:
		+	<span data-link_translate_zh_title="确保其 Debian 的机器" data-link_translate_zh_url="%E7%A1%AE%E4%BF%9D%E5%85%B6+Debian+%E7%9A%84%E6%9C%BA%E5%99%A8"></span>[[:zh:确保其 Debian 的机器]][[zh:确保其 Debian 的机器]]
	<span data-link_translate_ro_title="Asigurarea sa maşină de Debian" data-link_translate_ro_url="Asigurarea+sa+ma%C5%9Fin%C4%83+de+Debian"></span>[[:ro:Asigurarea sa maşină de Debian]][[ro:Asigurarea sa maşină de Debian]]		<span data-link_translate_ro_title="Asigurarea sa maşină de Debian" data-link_translate_ro_url="Asigurarea+sa+ma%C5%9Fin%C4%83+de+Debian"></span>[[:ro:Asigurarea sa maşină de Debian]][[ro:Asigurarea sa maşină de Debian]]
	<span data-link_translate_pl_title="Zabezpieczanie swojej maszynie Debiana" data-link_translate_pl_url="Zabezpieczanie+swojej+maszynie+Debiana"></span>[[:pl:Zabezpieczanie swojej maszynie Debiana]][[pl:Zabezpieczanie swojej maszynie Debiana]]		<span data-link_translate_pl_title="Zabezpieczanie swojej maszynie Debiana" data-link_translate_pl_url="Zabezpieczanie+swojej+maszynie+Debiana"></span>[[:pl:Zabezpieczanie swojej maszynie Debiana]][[pl:Zabezpieczanie swojej maszynie Debiana]]