Linux System Security and Configuration

Proper security and configuration of a Linux system are essential to ensure its stability, performance, and resilience against threats. This guide walks you through best practices for effectively configuring and securing your Linux systems.

System Configuration

User and Group Management

User management is fundamental to the security and organization of a Linux system.

Creating and Managing Users

# Créer un nouvel utilisateur
sudo useradd -m username

# Définir un mot de passe
sudo passwd username

# Ajouter un utilisateur à un groupe (ex: sudo)
sudo usermod -aG sudo username

# Supprimer un utilisateur
sudo userdel -r username

Group Management

# Créer un nouveau groupe
sudo groupadd groupname

# Ajouter un utilisateur à un groupe
sudo usermod -aG groupname username

# Supprimer un groupe
sudo groupdel groupname

Network Configuration

A proper network configuration is essential for connectivity and security.

Static IP Configuration (Ubuntu/Debian with Netplan)

# Éditer le fichier de configuration
sudo nano /etc/netplan/01-netcfg.yaml

Example configuration:

network:
  version: 2
  renderer: networkd
  ethernets:
    enp0s3:
      addresses:
        - 192.168.1.100/24
      gateway4: 192.168.1.1
      nameservers:
        addresses: [8.8.8.8, 8.8.4.4]

Apply the changes:

sudo netplan apply

DNS Configuration

# Éditer le fichier resolv.conf
sudo nano /etc/resolv.conf

Example configuration:

nameserver 8.8.8.8
nameserver 8.8.4.4

System Services

Service management is crucial for controlling what runs on your system.

Management with systemd

# Vérifier le statut d'un service
sudo systemctl status service-name

# Démarrer un service
sudo systemctl start service-name

# Arrêter un service
sudo systemctl stop service-name

# Activer un service au démarrage
sudo systemctl enable service-name

# Désactiver un service au démarrage
sudo systemctl disable service-name

# Redémarrer un service
sudo systemctl restart service-name

Checking Active Services

# Lister tous les services actifs
systemctl list-units --type=service --state=active

Linux Security

Firewall with UFW (Uncomplicated Firewall)

UFW is a simplified interface for iptables that makes firewall configuration easier.

# Installer UFW
sudo apt install ufw

# Vérifier le statut
sudo ufw status

# Activer UFW
sudo ufw enable

# Autoriser SSH (port 22)
sudo ufw allow 22/tcp

# Autoriser HTTP et HTTPS
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Bloquer un port spécifique
sudo ufw deny 3306

# Bloquer une adresse IP
sudo ufw deny from 192.168.1.10

# Supprimer une règle
sudo ufw delete deny 3306

Securing SSH

SSH is often the main entry point to your server, so securing it is crucial.

# Éditer la configuration SSH
sudo nano /etc/ssh/sshd_config

Recommended changes:

# Désactiver la connexion root
PermitRootLogin no

# Désactiver l'authentification par mot de passe
PasswordAuthentication no

# Limiter les utilisateurs autorisés
AllowUsers user1 user2

# Changer le port par défaut (optionnel)
Port 2222

# Limiter les tentatives d'authentification
MaxAuthTries 3

Restart SSH to apply the changes:

sudo systemctl restart sshd

SSH Key Authentication

Key-based authentication is more secure than passwords.

# Sur votre machine locale, générer une paire de clés
ssh-keygen -t ed25519 -C "votre_email@exemple.com"

# Copier la clé publique sur le serveur
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server

Security Updates

Keeping your system up to date is one of the most important security measures.

# Mettre à jour la liste des paquets
sudo apt update

# Installer les mises à jour
sudo apt upgrade

# Mettre à jour le système complet
sudo apt dist-upgrade

# Supprimer les paquets obsolètes
sudo apt autoremove

For automatic updates (Ubuntu/Debian):

# Installer unattended-upgrades
sudo apt install unattended-upgrades

# Configurer les mises à jour automatiques
sudo dpkg-reconfigure unattended-upgrades

Fail2ban - Protection Against Brute-Force Attacks

Fail2ban monitors logs and temporarily blocks IP addresses that show signs of an attack.

# Installer Fail2ban
sudo apt install fail2ban

# Créer un fichier de configuration local
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

Recommended configuration for SSH:

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600

Restart Fail2ban:

sudo systemctl restart fail2ban

Check the status:

sudo fail2ban-client status sshd

Monitoring and Logging

System Logs

Logs are essential for diagnosing problems and monitoring security.

# Afficher les journaux système récents
journalctl -xe

# Suivre les journaux en temps réel
tail -f /var/log/syslog

# Rechercher des tentatives de connexion échouées
grep "Failed password" /var/log/auth.log

# Rotation des journaux
sudo logrotate -f /etc/logrotate.conf

Monitoring Tools

# Surveillance des processus et ressources
htop

# Surveillance des E/S disque
iotop

# Surveillance du réseau
nethogs

# Surveillance complète du système
glances

Security Audits with Lynis

Lynis is a security auditing tool for Unix/Linux systems.

# Installer Lynis
sudo apt install lynis

# Exécuter un audit complet
sudo lynis audit system

Backup and Recovery

Backup with rsync

# Sauvegarder un répertoire localement
rsync -av --delete /source/directory/ /destination/directory/

# Sauvegarder vers un serveur distant
rsync -avz -e ssh /source/directory/ user@remote:/destination/directory/

Backup with Duplicity

# Installer Duplicity
sudo apt install duplicity

# Sauvegarder vers un serveur FTP
duplicity /home/user ftp://user:password@ftp.example.com/backup

Conclusion

Properly securing and configuring a Linux system is an ongoing process that requires constant vigilance. By following the best practices described in this guide, you can significantly improve the security and performance of your Linux systems.

Keep in mind that security is a balance between functionality and protection. Always adapt these recommendations to your specific needs and environment.

Stay informed about the latest vulnerabilities and security updates to keep your system protected against new threats.