Ubuntu server hardening on Racknerd reddit / selfhosted ---------------------------------------------------------------------- greentinCH · 2023-12-27 11:43 Hi folks, Long story short, I have a VPS on racknerd running Ubuntu 22.04 server which I discovered was hacked and used to scan IP and port (I found masscan and ntpscan running which I did not install). I was running docker behind traefik proxy with docker-socket-proxy and I did enable UFW and crowdsec. It looks I did something wrong when I tried to protect my VPS against unauthorized access. Any good source / walkthrough / script to begin learning Ubuntu hardening in order to not be hacked again? Happy holidays ---------------------------------------------------------------------- Schokkohu · 2023-12-27 11:51 Unfortunately docker bypasses Ufw firewall rules unless you manually change this behavior. Double check here: [Link](https://github.com/chaifeng/ufw-docker) This means any port mapping in your docker files opened that particular port as well on the firewall. For hardening best practices find that thread: [Link](https://www.reddit.com/r/selfhosted/s/FJhevX8zY1) ---------------------------------------------------------------------- Other-Technician-718 · 2023-12-27 11:52 How do you access that server? ---------------------------------------------------------------------- greentinCH · 2023-12-27 11:59 SSH with key and no password ---------------------------------------------------------------------- greentinCH · 2023-12-27 12:31 Thanks, I will check that! ---------------------------------------------------------------------- salty-sheep-bah · 2023-12-27 19:36 CIS Benchmarks are good https://www.cisecurity.org/benchmark/ubuntu_linux ---------------------------------------------------------------------- blackstar2043 · 2023-12-27 20:43 Here's an Ansible role that will harden your server: https://github.com/konstruktoid/ansible-role-hardening As others have suggested, check out the CIS documentation. ---------------------------------------------------------------------- greentinCH · 2023-12-27 20:46 Thanks for ansible role! ---------------------------------------------------------------------- greentinCH · 2023-12-27 20:48 I found that some people advise to switch to podman which should be more secure by design (rootless). Maybe I'll try also to launch my container with podman compose! ---------------------------------------------------------------------- tomistruth · 2023-12-27 20:57 What do those benchmark pdfs contain? Do they offer a step by step guideline to harden the server? I can't access the pdf yet. ---------------------------------------------------------------------- salty-sheep-bah · 2023-12-27 21:02 Yea, they give you the finding, the reasoning, and the fix if possible. Here's centos copy on github you can look at without an account https://github.com/jonathanbglass/cis- benchmarks/blob/master/CIS_CentOS_Linux_7_Benchmark_v2.2.0.pdf ---------------------------------------------------------------------- tomistruth · 2023-12-27 21:20 Awesome, thx! ---------------------------------------------------------------------- captainmustard · 2023-12-28 01:25 like /u/Schokkohu said, docker bypasses ufw rules. [this is the solution for that.](https://github.com/chaifeng/ufw-docker) Assuming your reverse proxy is also running in a docker container, another thing to do is to stop exposing any ports from your docker containers to begin with. Remove all the ports from your docker compose files, etc.. Create a docker network for each container you want to access, and add that container + your reverse proxy container to the network. Then create a proxy host from subdomain.yourdomain.com, and instead of putting in a domain or ip for the destination, just put in the name of the container you're pointing it to, and the containers internal port that was previously being exposed. [example from my npm](https://i.imgur.com/AmvhUlT.png) This keeps all your containers completely walled off from each other. ---------------------------------------------------------------------- NeitherManner · 2023-12-28 05:07 How is it different to this: [https://github.com/geerlingguy/ansible-role- security](https://github.com/geerlingguy/ansible-role-security) ---------------------------------------------------------------------- greentinCH · 2023-12-28 09:03 Thanks captain ! ⚓️ ---------------------------------------------------------------------- blackstar2043 · 2023-12-28 11:49 OVH offers a script that audits and tries to apply the CIS configuration for Debian: https://github.com/ovh/debian-cis ---------------------------------------------------------------------- blackstar2043 · 2023-12-28 11:59 After a quick glance at the one you linked, it appears that it only installs fail2ban, unattended-upgrades, and hardens the sshd configuration. The other one takes a more detailed approach to hardening Linux: installs aide, auditd, apparmor, ufw and rkhunter; disables redundant modules from the kernel; hardens sudo, pam.d and sshd configurations; additional hardening are all listed here: https://github.com/konstruktoid/ansible-role- hardening/tree/master/tasks ---------------------------------------------------------------------- tomistruth · 2023-12-28 12:25 Nice, I was just wandering why nobody releases distros with those benchmark configurations. ---------------------------------------------------------------------- salty-sheep-bah · 2023-12-28 16:19 Nothing works after you harden it :D ---------------------------------------------------------------------- tomistruth · 2023-12-28 16:39 Hehe, welp, nothing that a bash script can't do.