Duncan Wither

General Tips

Some general tips (that I might disagree with) from this video:

• SSH port change is not needed
  • The video argues obscurity = meaningless, however its not pointless, so it could still be worthwhile.
• Disabling IPv4 or 6 is not needed
• Disable Auto-updates
  • This is for semi-serious hosting. I’d rather be safe and have the website crash occasionally than hang about manually updating.
• Using root on a server is fine, which (through laziness) I already do.

This is another good self hosting guide with security stuff included.

SSH + RSA

Fail2Ban

Fail to ban protects people from brute forcing their way into your server.

To install:

sudo apt-get install fail2ban

The global settings are stored in /etc/fail2ban/jail.conf. It’s poor practice to modify this directly (as updates modify this file) but instead copy it to jail.local and modify it. jail.local will overwrite the jail.conf rules.

Under the [DEFAULT] header¹ here’s some key settings to modify:

• Allow local access with the lineignoreip = 127.0.0.1/8.
• bantime = 3600 sets the bantime to 1 hour.
• maxretry = 3 is how many failed attempts are allowed.
• findtime = 3600is the period in which these failed attempts are searched for (1 hour in this case).

More settings can be found in this tutorial. Also I had an issue with the install. Please see this answer for a fix.

Then to start banning run:

sudo service fail2ban restart

And confirm status with:

sudo service fail2ban status

To see if things are getting banned run:

sudo zgrep 'Ban' /var/log/fail2ban.log*

And pass it into wc -l to see how many bans have occurred.

Reverse Shell

To connect to computer Zulu that’s on you local network, from any PC via VPS/publicly accessible Yankee run the following on Zulu (courtesy of SE of course):

autossh -M 20000 -f -N -R 1234:localhost:22 user@yankee -C

Explanation: 1. autossh 1. Useful program that will try re-establish SSH connection if it sees it’s gone down 2. -M 20000 1. Which port to use to test the connection (autossh specific) 3. -f 1. Runs it as a background process (autossh specific) 4. -N 1. ssh command saying don’t execute anything (useful here as we’re just establishing a connection). 5. -R 1234:localhost:22 1. This is the ssh syntax for a normal remote shell. This does the heavy lifting of getting the connection back. 6. user@yankee 1. The user and IP addr. (or domain) of the publicly facing computer 7. -C 1. Compression - optional if you want it.

You can then expose port 1234 on Yankee and ssh -p 1234 user@zulu and you’ll be able to talk to Zulu