Page 4 of 4

Certificate Signing Request

October 19, 2018 / / 0 Comments

When deploying a new linux machine for a new domain and you intend on using LAMP services, you will most likely need to create an SSL certificate. Below is the command you will need to run from any directory to create the CSR request and eventual certificate key. 

openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr

Once you have run the command, you will be prompted to input some information such as company name, admin email, department and eventually a password. Please use a password with no spaces and keep it “simple” to letters and numbers. Once this is completed the two files will be created in your working directory.

Run the below command to output the contents to your terminal shell where you will be able to copy them from –

cat yourdomain.csr

You will want to upload the contents of the CSR file to your desired SSL certificate authority and download your certificate.

SSH Security on Linux

October 18, 2018 /

I have installed a service called “Fail2Ban” which I have found greatly useful as this dynamically updates your IP Tables on your machine by blocking IP’s which have had to many failures/attempts to login via SSH. You can configure with the commands below – 

  1. Install the application 
apt-get install fail2ban

2) Familiarise yourself with the sample config file /etc/fail2ban/jail.conf

3) Make a new “jail.local” file in the above directory with your favourite text editor. I use nano in my case. 

nano /etc/fail2ban/jail.local

4) Add the options you wish to use from the service, I’ve added the below to control my SSH – 

[DEFAULT]
[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 5
bantime = 3600

With the above options we have chosen to ban after 5 incorrect attempts with a total ban time of 3600 seconds. What’s good to note about the “jail.local” is that Fail2Ban keeps it’s configuration in /etc/fail2ban/jail.conf, however it can also load configuration from jail.local. So it’s best if we leave the default config file as is, since this might be changed in a version upgrade by the authors!

After the above is done, you will want to activate some basic IP Tables rules. Such as the below to allow SSH connections in the first place to the machine. I have also included port 80 and 443, as mine is a web server.

sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
sudo iptables -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT
sudo iptables -A INPUT -j DROP

You will now want to make these rules persistent, so that they do not disappear after a reboot.

sudo dpkg-reconfigure iptables-persistent

That’s it, we now have a setup ready to function and block/ban potentially malicious traffic attempts. Let’s restart the service and be done with it! ( I prefer stopping and starting services, just so I feel in control of what’s going on )

sudo service fail2ban stop
sudo service fail2ban start

One final step is to check whether the newly implemented rules are indeed working. Attempt to SSH into the server incorrectly the amount of times you chose above and once you cannot SSH into the machine with a response anymore, you should see a new IP Table rule created in your list. 

You may check that by issuing 

sudo iptables -S

You should see a rule similar to the below 

-A fail2ban-ssh -s X.X.X.X/32 -j REJECT --reject-with icmp-port-unreachable