Hacker Bits, August 2016

Simple is generally better with
security. The DigitalOcean ufw is
really good and goes over the basics.
usermod -aG sudo deploy
deploy now has access to
sudo permissions. Now normally
you need exit and re-login to the
shell in order to start having access
to the group's permissions.
There's a little trick though to
avoid having to do that:
exec su -l deploy
This starts a new interactive
shell for the deploy user with
the new permissions to the sudo
group. It will require your deploy's
password, but it feels faster
than logging out and logging
back in.
Note: Thanks to ackackacksyn
on Reddit for pointing
out that you should not add users
directly to sudoers. Thanks
to FredFS456 in /r/netsec for
pointing out you need to logout
and log back in for group permissions
to take effect.
Enforce SSH key
logins
SSH configuration for the machine
is stored here:
vim /etc/ssh/sshd_config
You'll want to change these
lines (or add if missing) in the
file to match below. I think
they're pretty self-explanatory.
You'll want to add the IP that
you use to connect. We have a
company VPN setup with Open-
VPN with cryptographic authentication,
so in order to connect
to a server, you must also be
authenticated and connected to
the VPN.
PermitRootLogin no
PasswordAuthentication no
AllowUsers deploy@(your-VPNor-static-IP)
AddressFamily inet
Enable all these rules by
restarting the ssh service. You'll
probably need to reconnect (do
so by using your deploy user!)
service ssh restart
Note: Thanks to raimue and
mwpmaybe on HN for pointing
out that fail2ban (installed later)
does not support IPv6 right now,
so I added AddressFamily inet to
the sshd_config file, which will
only allow IPv4 (which fail2ban
does support).
Setting up a firewall
There are usually two camps.
Those who use IPtables directly
and those who use a handy
interface called ufw, which is a
layer on top of IPtables meant to
simplify things. Simple is generally
better with security. The
DigitalOcean ufw is really good
and goes over the basics.
ufw is installed by default on
Ubuntu and is just an apt-get
install ufw away on Debian.
By default ufw should deny
all incoming connections and
allow all outgoing connections,
however, it won't be running
(because otherwise how would
you be connected?). We'll go
through and explicitly allow the
connections that we deem okay.
First we'll want to make sure
that we are supporting IPv6. Just
open up the config file.
vim /etc/default/ufw
Set IPv6 to yes.
IPV6=yes
For the rest of the ports that
we're going to open up, we can
just use the ufw tool from command
line, which is very handy.
sudo ufw allow from {your-ip}
to any port 22
sudo ufw allow 80
sudo ufw allow 443
sudo ufw disable
sudo ufw enable
The first one is a redundancy
hacker bits
15