From 4203f21813c6410b5e1f1b46fa4726b27bf4e47a Mon Sep 17 00:00:00 2001 From: ahmza Date: Thu, 5 Jun 2025 23:57:27 +0100 Subject: [PATCH 1/6] who knows From 526f36669fe6401f59b950e8723576307dfb750c Mon Sep 17 00:00:00 2001 From: ahmza Date: Thu, 5 Jun 2025 14:58:36 +0100 Subject: [PATCH 2/6] Adding a new post about Hardening Linux Systems and SSH --- archetypes/posts.md | 18 +-- .../posts/hardening-linux/hardening-linux.md | 113 ++++++++++++++++++ go.mod | 4 +- 3 files changed, 125 insertions(+), 10 deletions(-) create mode 100644 content/posts/hardening-linux/hardening-linux.md diff --git a/archetypes/posts.md b/archetypes/posts.md index abb2353..8728163 100644 --- a/archetypes/posts.md +++ b/archetypes/posts.md @@ -1,14 +1,16 @@ --- title: {{ replace .TranslationBaseName "-" " " | title }} -date: {{ .Date }} -author: "ahmza" -draft: true -weight: - -tags: [""] description: "" +tags: [""] +author: "ahmza" +date: {{ .Date }} +draft: true +weight: +featureimage: +lastmod: --- -## **Introduction** +## Introduction + +## Conclusion -## **Conclusion** diff --git a/content/posts/hardening-linux/hardening-linux.md b/content/posts/hardening-linux/hardening-linux.md new file mode 100644 index 0000000..b46ef80 --- /dev/null +++ b/content/posts/hardening-linux/hardening-linux.md @@ -0,0 +1,113 @@ +--- +title: Hardening Linux - An Update to Securing SSH +description: "A Guide to Making Linux a Little more secure" +tags: ["Linux", "Ubuntu"] +author: "ahmza" +date: 2025-06-05T15:34:10+01:00 +draft: true +weight: +featureimage: +lastmod: +--- + +--- +{{< alert icon="fire" >}} +> - This Guide assumes a Linux -> Linux SSH Session +> - Please take care with production systems +> - I take no responsibility for misconfigured systems and lockouts +> - Try in a VM first and thank me later :) +> - My Commands will be for Ubuntu Server 24.04 +{{< /alert >}} + +--- + +## Introduction +This guide will go over the basic steps of hardening a Linux machine with a +focus on remote access. The reason this is important is because when we begin to +expose services to the internet and make them publicly accessible then that means +anyone can probe around. + +There are better ways around this especially if you are the only user, or If +your users dont mind taking an extra step before being able to access your +resources. If you have not heard of _Overlay Networks_ before they're similar to +VPNs however do not need any open ports as they use NAT Punching AKA Hole +Punching. + +Check out my post on [Tailscale](https://blog.ahmza.com/posts/no-more-port-forwarding/) + +regardless, it's always a good idea to implement good security practice so +follow along and get your remote systems secure !! + +## Initial Steps + +Before we get into the meat and potatos of this guide, it would be a good idea +to go over the following steps, especially if you are configuring a new install. + +### Software Updates +Software updates are key for security as they will often include security +patches. Depending on your flavour of Linux this command will vary. + +```bash +sudo apt update && sudo apt upgrade +``` +{{< alert "bell" >}} +If you do not expect to be logging into this remote machine very often it may be +a good idea to [setup automatic updates](https://blog.ahmza.com/posts/setting-up-automatic-updates) +however if you want more control then using [Ansible to update Remote Machines](https://blog.ahmza.com/posts/ansible-to-manage-remote-servers) +would be a better option. +{{< /alert >}} + +### User Accounts +It's not a good idea to continue to use a root account after install, it's much +more secure to setup another user account with sudo access. The reason is the +root account has complete control over the system, where a user account is more +restricted by default. As well as this logging is more granular with different +user accounts. + +The following command will allow you to create a new user, it will also ask you +some questions about user information however the only required fields are the +username and password if you want one. + +```bash +adduser username +``` + +now we can add our newly created user to the sudo group to give admin permissions + +``` bash +usermod -aG sudo username +``` + +{{< alert "bell" >}} +Remember to replace username with your desired username +{{< /alert >}} + +you can now logout of root and log back in as your user. Further action on the +server should now be executed from this user account. + +## Creating SSH Keys +Now that you have your own user account, we can create an SSH key for it. An SSH +Key is a Public and Private key pair which allow client and server to +authenticate using Public Key cryptography. Public Key cryptography is much +harder to crack compared to a password, as well as this we no longer need to +send passwords across networks which can be at risk of interception. + +SSH can also be more convenient once you set up ssh-agent which will be covered +later in the guide, with password authentication you need to enter a password +everytime, however with ssh-agent you can enter your ssh-key password once and +it remains unlocked for the remainder of the session. + +{{< alert "fire" >}} +**IMPORTANT:** **NEVER** share your private ssh key ... it's private for a reason. +{{< /alert >}} + +By running the following command you will create an ssh-key !! +```bash +ssh-keygen -t ed25519 -C NameYourKey +``` +- `-t` - specifies the type of cryptographic algorithm we will use +- `-C` - notice it's capital, A name for your ssh keys. I usually give them the +hostname of the local machine + +## Conclusion + diff --git a/go.mod b/go.mod index 72f1f82..cb64502 100644 --- a/go.mod +++ b/go.mod @@ -1,5 +1,5 @@ module github.com/ahmzaa/blog-ahmza-com -go 1.23.6 +go 1.24.2 -require github.com/nunocoracao/blowfish/v2 v2.82.0 // indirect +require github.com/nunocoracao/blowfish/v2 v2.86.0 // indirect From ae8b7a7439637f8f6664dec202f3297bfe8a8d68 Mon Sep 17 00:00:00 2001 From: ahmza Date: Thu, 5 Jun 2025 23:42:35 +0100 Subject: [PATCH 3/6] changed the tailscale version in the gh action --- .github/workflows/build-docker-images.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-docker-images.yml b/.github/workflows/build-docker-images.yml index 096b6d0..df827d5 100644 --- a/.github/workflows/build-docker-images.yml +++ b/.github/workflows/build-docker-images.yml @@ -51,14 +51,14 @@ jobs: steps: - name: Tailscale - uses: tailscale/github-action@v2 + uses: tailscale/github-action@v3 with: oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }} oauth-secret: ${{ secrets.TS_OAUTH_SECRET }} tags: tag:prod-ahmza-blog - name: deploy - uses: appleboy/ssh-action@v1.2.0 + uses: appleboy/ssh-action@v1 with: host: ${{ secrets.SSH_HOST }} username: ${{ secrets.SSH_USER }} From e57acb2fc5c1ddb68cf3f6124e4914d881587609 Mon Sep 17 00:00:00 2001 From: ahmza Date: Fri, 6 Jun 2025 00:18:26 +0100 Subject: [PATCH 4/6] changed ver of drone-ssh --- .github/workflows/build-docker-images.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build-docker-images.yml b/.github/workflows/build-docker-images.yml index df827d5..9dca61c 100644 --- a/.github/workflows/build-docker-images.yml +++ b/.github/workflows/build-docker-images.yml @@ -58,7 +58,7 @@ jobs: tags: tag:prod-ahmza-blog - name: deploy - uses: appleboy/ssh-action@v1 + uses: appleboy/ssh-action@v1.2.2 with: host: ${{ secrets.SSH_HOST }} username: ${{ secrets.SSH_USER }} From 4385ec04f0a438ddc8f56f8b85ea27882e40076a Mon Sep 17 00:00:00 2001 From: ahmza Date: Fri, 6 Jun 2025 00:37:03 +0100 Subject: [PATCH 5/6] ing tailscale ssh instead of keys --- .github/workflows/build-docker-images.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-docker-images.yml b/.github/workflows/build-docker-images.yml index 9dca61c..ad8631a 100644 --- a/.github/workflows/build-docker-images.yml +++ b/.github/workflows/build-docker-images.yml @@ -55,13 +55,14 @@ jobs: with: oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }} oauth-secret: ${{ secrets.TS_OAUTH_SECRET }} - tags: tag:prod-ahmza-blog + tags: tag:ci + version: 1.80.0 - - name: deploy + - name: Deploy to Cluster uses: appleboy/ssh-action@v1.2.2 with: host: ${{ secrets.SSH_HOST }} username: ${{ secrets.SSH_USER }} - key: ${{ secrets.SSH_KEY }} + password: "tailscale" port: ${{ secrets.SSH_PORT }} script: 'kubectl rollout restart deployment blog-deploy -n blog' From cc8e11ca01859bfab8cab8664598813a62529eff Mon Sep 17 00:00:00 2001 From: ahmza Date: Fri, 6 Jun 2025 00:59:05 +0100 Subject: [PATCH 6/6] moved back to ssh key as it was giving auth error --- .github/workflows/build-docker-images.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build-docker-images.yml b/.github/workflows/build-docker-images.yml index ad8631a..765691b 100644 --- a/.github/workflows/build-docker-images.yml +++ b/.github/workflows/build-docker-images.yml @@ -63,6 +63,6 @@ jobs: with: host: ${{ secrets.SSH_HOST }} username: ${{ secrets.SSH_USER }} - password: "tailscale" + key: ${{ secrets.SSH_KEY }} port: ${{ secrets.SSH_PORT }} script: 'kubectl rollout restart deployment blog-deploy -n blog'