Tag Info

Hot answers tagged

5

This recommendation is most relevant on systems where multiple people can perform root-level operations. The Linux auditing daemon can distinguish "UID" and "effective UID", so user "bob" who does "sudo -i" and then performs a root-level operation will show up in audit logs as "user bob acting as user root". So, if you track changes to files in /etc, or ...


4

Don't allow SSH login into the root account. Login with a user account with a name which is harder to guess. When you need to do something as root, use su or sudo after you logged in. Make sure your passwords are long enough to avoid getting brute-forced. The speed an attacker can use to brute-force over the network is severely limited, so an 8-character ...


2

I always review the Digital Ocean when I provision a VPS follow these steps. Add a new user (standard command) Grant this new user root privileges by running visudo and adding your username under the one for root in the section titled "# User privilege specification". Effectively give yourself the same privileges as root Change the port SSH listens on by ...


2

What I normally do myself is configure log on to the root account, configure the server with sudo (adding myself to the sudoers) and then not permit root login anymore through SSH. I don't see a reason why you should not be able to work like this, but should you have a valid case yourself, using a key and a password is normally good protection (it's ...


1

I'm not familiar with VMWare Player, but with VirtualBox, if the network is in "NAT" mode (or, presumably, host-only mode, but I haven't tested it), the source IP address for network connections from the guest to the host is the address of the host's network adapter. For example, if the host's address is 192.168.0.10, connections from the guest will show up ...


1

First rule to remember is that you don't perform tasks as root unless they have to be performed as root. This part reduces the risk of doing damage by a typo or other mistake. It also reduces the risk of damage if the tools you are using happen to have a security vulnerability. Additionally accounts should only have the privileges they need and nothing ...


1

mricon brought up two excellent points for not using root login in a multi-user system. I just want to add a counter-point for using root login. If I need to rsync config files to the server, I can do it in one step using root login instead of uploading to the home directory of a user, then do su or sudo to rsync again into the /etc folder. Of course, I am ...


1

I think on a server the "don't login as root" recommendation isn't as hard. If you are on a desktop, you don't use root privileges most time. But if you are on a server, most time you use it is some maintenance task. While you can give people who only have to care for the webserver limited accounts, if you are the admin of the server, you can give yourself ...


1

Another suggestion, thats is actually better than fail2ban, is to firewall off ALL ips EXCEPT for a few permitted ones. Thus lets say you have a SSH server at home that you access from your vacation home (3G mobile broadband) and your work. Your work propably have a static IP. Simple to tell the firewall to allow through packets for this IP. 3G mobile ...


1

The best way is to use SCP with SSH keys. It's some of the best encryption commonly available, designed to work without intervention, very reliable, easy to script, and extremely well documented. Set up your keys and a cron job. The only other good option is to change your application design to sync the data over an encrypted channel, such as a mysql slave ...



Only top voted, non community-wiki answers of a minimum length are eligible