How to Secure Linux Home Server

This updated guide examines How to Secure Linux Home Server and organizes the essential facts, background, and practical takeaways in clear American English.

Only install what you really need

One of the easiest ways to secure your home server is to focus on security at the beginning. Let's start with the installation. If you are not sure you need an application or service, do not install it. You can always install it later if needed.

If you have installed Linux a few times, this is even easier. Instead of sticking with default options, use modes that allow you to control the most settings. Sometimes these are named 'expert mode' or something similar

Careful monitoring of installation options can save you time to disable services for security reasons later.

Configuring sudo

Before switching to any other step, you need to configure sudo. Why? Because you will login to your server via SSH and you cannot login with root account. To make any further changes to the system, you will need to use sudo.

First, check if you can use sudo . From the user account, run the following command with an alternate real username for USERNAME:

sudo -lU USERNAME

If you see a message displayed indicating that the username can be run '(ALL) ALL' or something similar, you're ready to continue.

Now, as the root account on the server, run the following command to edit the file '/ etc / sudoers'. If you like another editor, use it instead of nano.

EDITOR=nano visudo

Edit the file and include the following items, with alternate real usernames for USERNAME:

USERNAME ALL=(ALL) ALL

SSH configuration

Please enable SSH on the home server. In fact, you can do so, because this is often the way you interact with the server.

First, make sure OpenSSH is installed. If you use another distribution, the command will change, but the package name is quite consistent. On Ubuntu, run the following command:

sudo apt install openssh-server

Using key-based authentication is much safer than password authentication, so we'll set up SSH to work this way. To do this, make sure you are working on the client that you intend to connect to the server, not the server itself. First, you want to make sure you don't have any SSH keys:

ls ~/.ssh/

If you see 'id_rsa' and 'id_rsa.pub', among the file names listed, you already have SSH key. Skip this next step.

ssh-keygen -t rsa -b 4096 -C "youremail@domain.com"

Now you will copy the SSH key to the server:

ssh-copy-id USERNAME@SERVER

For home servers, you may be using IP addresses for servers instead of names. If you don't know your server name, use the IP address instead of SERVER above.

Now, we will modify the SSH settings for more security. Log in to the server from the client you created the keys for. This will allow you to login again after this step. Execute the following command, replace nano with the editor you choose.

sudo nano /etc/ssh/sshd_config

Edit the file with the following settings. They will be placed in different places in the file. Make sure there are no copies, because only the first version of the installation is tracked.

ChallengeResponseAuthentication no PasswordAuthentication no UsePAM no PermitRootLogin no

Now, you need to restart the SSH server with one of the following commands.

On Ubuntu, run:

sudo systemctl restart ssh

Configure the firewall

Depending on the service you are running and the number of servers connected to the Internet, you may want to use a firewall. There are several options for this, but the method that has been tested and works well on Linux is iptables.

Iptables setup is beyond the scope of this article, but don't worry! TipsMake.com has a complete guide to how to configure iptables on Linux computers.

Another easier way to set up a firewall is to use ufw. You can install it with the command:

sudo apt install ufw

By default, this will block all ports. To enable SSH access and online, run the following ufw commands to open ports 80, 443 and 22:

sudo ufw allow 80 sudo ufw allow 443 sudo ufw allow 22

And finally, activate ufw:

sudo ufw enable

Always pay attention to updates!

Servers can be easily forgotten, if they still work normally, but this can be very dangerous. Make sure your software is always up to date. You can use unsupervised updates (automatic updates), but nothing can be predicted. The safest way is to schedule weekly or monthly server maintenance to make sure everything is okay.

You now have a good start to keep your server protected from external threats. What if you need to access the server from home? Every door you open is likely to be exploited and exploited by an attacker.

One of the easiest ways to access your home network from outside is to use VPN. See a list of the best available security VPN services available from TipsMake.com to know what is the right choice for you!

Hope you are succesful.