1

I have 2 severs and 12 systems (All having UBUNTU) connected to each other over LAN. The 12 systems use multiple databases (Redis/Postgres etc.) hosted on the 2 servers using LAN. Now, I need to connect the system to the internet as these systems and servers call some external APIs and cloud based databases etc. from time to time.

From outside world (over the internet) I only need SSH access to the systems for monitoring purpose etc.

My setup has all the 14 (2+12) system connected to LAN using static IP via a switch and 1 connection from switch to a router (which has connection to internet).

Inside the router, I have forwarded 14 ports, some obscure ones (range 20000 and above) and redirected them individually to port 22 of each LAN IP.

I have already enabled automatic silent security updates in the systems.

The questions are:

a) Do I need to block unused ports(apart from the ones used by them for internal use) in the 14 systems via UFW or it is not required given my situation?

b) Do I need to take care of anything else from security perspective, that I might have missed?

I am totally new to this security and setup part. Kindly advise.

closed as too broad by symcbean, Overmind, multithr3at3d, Teun Vink, Matthew Jul 31 '18 at 15:01

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • for your question a) please clarify the direction you asking about, If you redirected 14 ports fort he use of SSH from outside then other ports should be closed by default – Mr.lock Mar 30 '17 at 11:43
  • 3
    Your 'b' question is quite broad. – Black Magic Mar 30 '17 at 12:11
  • You should always block unused ports and close unused services; not only incoming but also outgoing traffic. For the ssh part, you may think of using public key+passphrase+(optional)static source (real) IP address accepted. In fact, if external API's IP addresses are static, you should configure ufw to only let those ports and those destination addresses. Apart from ufw, you may consider hardening ssh connections by limiting connections, sessions ex. – JackSparrow Nov 26 '17 at 15:22
0

A) I'd use ufw reverse technique by denying all ports as default and allow the ones you do use.

B) Well, that you can always do...taking care of your system's security. I think you've got yourself a decent setup, perhaps installing and configuring Snort on the switch would be a great idea. I'd also recommend Tripwire but due to the Ubuntu's regular updates, you would have plenty of false positives.

The other thing you can always do is to test your setup with scanning and penetration tools, most of which you can get by installing Kali linux.

0

I'm going to vote to close this its too broad - but already I hear alarm bells ringing.

From outside world (over the internet) I only need SSH access to the systems

OK

I have forwarded 14 ports, some obscure ones (range 20000 and above) and redirected them individually to port 22 of each LAN IP.

This is messy. I'm not against using non-standard ports for ssh - but if it were me, I'd do with a couple of jump boxes behind the router, and only 2 forwarded ports (you can chain ssh connections).

I presume that you are using masquerading on the router (whether you use SNAT, static DNAT or masquerading NAT is rather important to how you provision the remainder of the security)

I only need SSH access to the systems for monitoring purpose

Would it be so hard to publish monitoring information? For investigating/fixing stuff you need an interactive protocol, but its not suited for monitoring.

Do I need to block unused ports

You should certainly restrict the used ports to the LAN where possible. And if you use jump boxes you can set the default route on most of the hosts to a black hole. Whether you should apply special handling to the unused ports, and whether you drop or reject the packets is a more complex question (but probably little benefit if you are using masquerading).

Do I need to take care of anything else from security perspective, that I might have missed

If this is the extent of the steps you've taken to secure your environment, then yes, there's probably a lot of things you've missed.

-1

In my opinion, you have established most of the concepts of the security.

You should disable all the un-used ports and services so it will reduce the attack surface. Moreover, I would suggest you that whenever you want to control the systems from an external network, use a VPN to connect to the internal network and then use SSH to manage the devices individually.

Also, the rule of the thumb, always use a very complex passwords for whatever network logins you use.

If you have router that has a good hardware, you can also try to implement baisic firewall stuff over it so that will mitigate some DDOS or related attacks.

Not the answer you're looking for? Browse other questions tagged or ask your own question.