diff --git a/.github/workflows/build-docker-images.yml b/.github/workflows/build-docker-images.yml index 096b6d0..765691b 100644 --- a/.github/workflows/build-docker-images.yml +++ b/.github/workflows/build-docker-images.yml @@ -51,14 +51,15 @@ jobs: steps: - name: Tailscale - uses: tailscale/github-action@v2 + uses: tailscale/github-action@v3 with: oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }} oauth-secret: ${{ secrets.TS_OAUTH_SECRET }} - tags: tag:prod-ahmza-blog + tags: tag:ci + version: 1.80.0 - - name: deploy - uses: appleboy/ssh-action@v1.2.0 + - name: Deploy to Cluster + uses: appleboy/ssh-action@v1.2.2 with: host: ${{ secrets.SSH_HOST }} username: ${{ secrets.SSH_USER }} diff --git a/archetypes/posts.md b/archetypes/posts.md index 93e52bf..5ee5ccc 100644 --- a/archetypes/posts.md +++ b/archetypes/posts.md @@ -1,15 +1,15 @@ --- -title: {{ replace .TranslationBaseName "-" " " | title }} -description: +title: { { replace .TranslationBaseName "-" " " | title } } +description: "" tags: [""] author: "ahmza" -date: {{ .Date }} +date: { { .Date } } draft: true weight: featureimage: lastmod: --- -## **Introduction** +## Introduction -## **Conclusion** +## Conclusion diff --git a/content/posts/hardening-linux/hardening-linux.md b/content/posts/hardening-linux/hardening-linux.md new file mode 100644 index 0000000..b46ef80 --- /dev/null +++ b/content/posts/hardening-linux/hardening-linux.md @@ -0,0 +1,113 @@ +--- +title: Hardening Linux - An Update to Securing SSH +description: "A Guide to Making Linux a Little more secure" +tags: ["Linux", "Ubuntu"] +author: "ahmza" +date: 2025-06-05T15:34:10+01:00 +draft: true +weight: +featureimage: +lastmod: +--- + +--- +{{< alert icon="fire" >}} +> - This Guide assumes a Linux -> Linux SSH Session +> - Please take care with production systems +> - I take no responsibility for misconfigured systems and lockouts +> - Try in a VM first and thank me later :) +> - My Commands will be for Ubuntu Server 24.04 +{{< /alert >}} + +--- + +## Introduction +This guide will go over the basic steps of hardening a Linux machine with a +focus on remote access. The reason this is important is because when we begin to +expose services to the internet and make them publicly accessible then that means +anyone can probe around. + +There are better ways around this especially if you are the only user, or If +your users dont mind taking an extra step before being able to access your +resources. If you have not heard of _Overlay Networks_ before they're similar to +VPNs however do not need any open ports as they use NAT Punching AKA Hole +Punching. + +Check out my post on [Tailscale](https://blog.ahmza.com/posts/no-more-port-forwarding/) + +regardless, it's always a good idea to implement good security practice so +follow along and get your remote systems secure !! + +## Initial Steps + +Before we get into the meat and potatos of this guide, it would be a good idea +to go over the following steps, especially if you are configuring a new install. + +### Software Updates +Software updates are key for security as they will often include security +patches. Depending on your flavour of Linux this command will vary. + +```bash +sudo apt update && sudo apt upgrade +``` +{{< alert "bell" >}} +If you do not expect to be logging into this remote machine very often it may be +a good idea to [setup automatic updates](https://blog.ahmza.com/posts/setting-up-automatic-updates) +however if you want more control then using [Ansible to update Remote Machines](https://blog.ahmza.com/posts/ansible-to-manage-remote-servers) +would be a better option. +{{< /alert >}} + +### User Accounts +It's not a good idea to continue to use a root account after install, it's much +more secure to setup another user account with sudo access. The reason is the +root account has complete control over the system, where a user account is more +restricted by default. As well as this logging is more granular with different +user accounts. + +The following command will allow you to create a new user, it will also ask you +some questions about user information however the only required fields are the +username and password if you want one. + +```bash +adduser username +``` + +now we can add our newly created user to the sudo group to give admin permissions + +``` bash +usermod -aG sudo username +``` + +{{< alert "bell" >}} +Remember to replace username with your desired username +{{< /alert >}} + +you can now logout of root and log back in as your user. Further action on the +server should now be executed from this user account. + +## Creating SSH Keys +Now that you have your own user account, we can create an SSH key for it. An SSH +Key is a Public and Private key pair which allow client and server to +authenticate using Public Key cryptography. Public Key cryptography is much +harder to crack compared to a password, as well as this we no longer need to +send passwords across networks which can be at risk of interception. + +SSH can also be more convenient once you set up ssh-agent which will be covered +later in the guide, with password authentication you need to enter a password +everytime, however with ssh-agent you can enter your ssh-key password once and +it remains unlocked for the remainder of the session. + +{{< alert "fire" >}} +**IMPORTANT:** **NEVER** share your private ssh key ... it's private for a reason. +{{< /alert >}} + +By running the following command you will create an ssh-key !! +```bash +ssh-keygen -t ed25519 -C NameYourKey +``` +- `-t` - specifies the type of cryptographic algorithm we will use +- `-C` - notice it's capital, A name for your ssh keys. I usually give them the +hostname of the local machine + +## Conclusion + diff --git a/go.mod b/go.mod index 14959a1..5c24c5e 100644 --- a/go.mod +++ b/go.mod @@ -2,4 +2,4 @@ module github.com/ahmzaa/blog-ahmza-com go 1.24.3 -require github.com/nunocoracao/blowfish/v2 v2.85.1 // indirect +require github.com/nunocoracao/blowfish/v2 v2.86.0 // indirect