-1

I have a couple of Ubuntu 16.04 servers. I want my server to be secure and ensure they can only be accessible by me and things. I check the auth.log and last. But I heard that hackers can change the output of them. Is there any way that I can make sure my server is 100% secured?

closed as too broad by Conor Mancone, Steffen Ullrich, Matthew, Tobi Nary, Rory Alsop Aug 27 '18 at 12:12

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Keep it up to date – Pedro Lobito Aug 20 '18 at 1:11
  • 4
    There is no such thing as 100% secured – multithr3at3d Aug 20 '18 at 1:42
  • If you want to make sure that your server is 100% secured, than unplug a network cable and power cable, that will be your success. : ) – Mirsad Aug 20 '18 at 3:10
0

Is there any way that I can make sure my server is 100% secured?

100%, absolutely not! Zero-day exploits will always be a concern, but you can reduce the number of open ports to the bare minimum, and those which you must have open, ensure their services are hardened. Hardening referring to using modern protocols or encryption ciphers, and disabling anything for legacy support. Also providing brute force protection.

For an OpenSSH server hardening includes:

  • SSH protocol 2 only
  • Opt for RSA 4096 (or better) or ED25519 exclusively for host keys
    • Generate new host keys, do not use default host keys
  • Usage of AllowUsers
  • Disable empty passwords
  • Use a non-standard port (default is TCP 22)
  • Fail2Ban; an intrusion prevention system
    • if 3 failed login attempts within 600 seconds then ban IP address for 1200 seconds
  • Disable root login (if possible)
    • if not possible use a strong password or public key authentication is used; ensure brute force protection is enforced

OpenSSH security and hardening elaborates further on this.

0

Use CIS CAT Benchmark, setup Open VAS, use complex passwords.

This all depends on how they are hosted.

Not the answer you're looking for? Browse other questions tagged or ask your own question.