Ubuntu Server - Installation

Step	√	To Do
		Preparation
1		Install server image
2		Change default shell
3		Disable AppArmor and APPort
		System Update
4		Update with the latest updates
5		Configure automatic updates
6		Configure network time protocol (NTP)
		Process Hardening
7		Restrict core dumps
8		Enable randomized virtual memory region placement
		OS Hardening
9		Remove legacy services (e.g., telnetserver, rsh, rlogin, rcp, ypserv, ypbind, tftp, tftp-server, talk, talkserver)
10		Disable or remove server services that are not going to be utilized (e.g., FTP, DNS, LDAP, SMB, DHCP, NFS, SNMP, etc.)
		Network Security and Firewall Configuration
11		Firewall configuration
		Remote Administration Via SSH
12		Set SSH protocol to 2
13		Disable SSH root login
14		Set SSH permitemptypasswords to no
		System Integrity and Intrusion Detection
14		Install and configure Fail2Ban
15		Install and configure AIDE
		Anti-Virus Considerations
16		Install and enable anti-virus software
17		Configure daily scan

Preparation

Server Image Installation

Browse to konsoleH and log in at Admin level
Select or search for your Self-Managed server in the Hosting Service tab
Select Linux Install under Recovery Tools from the left-hand menu
Select the distribution of the installation that you wish to activate
Select Activate on the top right-hand side
Reboot your server within 10 minutes via the RMM / IPMI device
During the server startup process, you have the option to reconfigure your RAID (TruServ Commerce only) via the RAID controller bios.
The server will boot into the OS installation environment you selected in step 4
Follow the onscreen prompts to install your OS and configure your disks and partition layout
Once the install is complete your server will reboot into your installed OS and will be accessible
Access your server with the user(s) configured via SSH (some Linux distributions do not allow root logins by default over SSH).

Preparation

Change the Default Shell

/bin/sh is a symlink to /bin/dash, however we need /bin/bash, not /bin/dash

To change do the following

Run the command below

dpkg-reconfigure dash
At the prompt type

No

Preparation

Disable AppArmor And Apport

Disable AppArmor and Apport

Both AppArmor and Apport can can be safely disabled. They cause more problems than solving them

Disable AppArmor

Run the below commands one after the other

service apparmor stop
update-rc.d -f apparmor remove
apt-get remove apparmor apparmor-utils

Disable Apport

Run the command below to disable Apport

systemctl disable apport.service

System Update

Update With The Latest Updates

Updating the server with the latest updates

Adding additional repositories

Enable any additional and necessary software repositories by editing /etc/apt/sources.list

Open /etc/apt/sources.list
==========================

vi /etc/apt/sources.list

Enable repository by removing the # sign i.e.
=============================================

#deb http://de.archive.ubuntu.com/ubuntu/ xenial main restricted

to

deb http://de.archive.ubuntu.com/ubuntu/ xenial main restricted

Updating the server

Run the below commands one after the other, accepting the prompts

apt-get update

apt-get upgrade

System Update

Configure Automatic Updates

Setting up automatic updates

Installing unattended-upgrades package

Install unattended-upgrades package

apt-get install unattended-upgrades

Configuring unattended-upgrades

Edit /etc/apt/apt.conf.d/50unattended-upgrades and adjust the following

Unattended-Upgrade::Allowed-Origins {
        "${distro_id}:${distro_codename}";
        "${distro_id}:${distro_codename}-security";
//      "${distro_id}:${distro_codename}-updates";
//      "${distro_id}:${distro_codename}-proposed";
//      "${distro_id}:${distro_codename}-backports";
};

Enable automatic updates

Edit /etc/apt/apt.conf.d/20auto-upgrades and set the appropriate apt configuration options

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::AutocleanInterval "7";
APT::Periodic::Unattended-Upgrade "1";

System Update

Configure Network Time Protocol (NTP)

Network Time Protocol (NTP) configuration

Synchronize the system clock with the command below

apt-get -y install ntp ntpdate

Process Hardening

Restrict Core Dumps

Restricting Core Dumps

Add the below to the end of /etc/security/limits.conf

root hard core 0
Add the below to /etc/sysctl.d/60-own.conf

fs.suid_dumpable=0
Lastly, add the below to /etc/systemd/system.conf

DumpCore=no

Process Hardening

Enable Randomized Virtual Memory Region Placement

Randomized virtual memory region placement

Add the below line to /etc/sysctl.conf

kernel.randomize_va_space = 2

OS Hardening

Remove Legacy Services

The removal of legacy services

Check for legacy services

To check for legacy services, use the command the below

chkconfig --list

You should get an output similar to

Disable legacy services

Confirm the necessity of the service and disable if not necessary with the below command

chkconfig "service name" off

I.e to disable netconsole
=========================

chkconfig netconsole off

OS Hardening

Disable Or Remove Server Services

Disable or remove server services that are not going to be utilized (e.g. FTP, DNS, LDAP, SMB, DHCP, NFS, SNMP, etc.)

Display a list of services available

To display a list of services available use the command the below

systemctl -t service

This will display something similar to

Disable unnecessary services

Stop and turn OFF auto-start services not needed

systemctl stop "service name"
systemctl disable "service name"

I.e. to stop and disable the Postfix service
============================================

systemctl stop postfix
systemctl disable postfix

Network Security and Firewall Configuration

Firewall Configuration

Installing and configuring UFW (Uncomplicated Firewall)

Add sudo in front of the commands if you are using a normal account with sudo privileges

Installing UFW

Use the command below to ensure that UFW is installed

apt-get install ufw

Setting up default policies

Use the commands the below to set/reset the firewall policies to default

ufw default deny incoming
ufw default allow outgoing

These commands set the defaults to deny incoming and allow outgoing connections

Allowing SSH connections

Allow SSH connections with the following command

ufw allow ssh

Enabling UFW

To enable UFW, use this command

ufw enable

You will receive a warning that says the command may disrupt existing SSH connections. We already set up a firewall rule that allows SSH connections, so it should be fine to continue. Respond to the prompt with y

Allowing other connections (examples)

Specific services

ufw allow http

Specific ports

ufw allow 80

Port ranges

ufw allow 6000:6007/tcp
ufw allow 6000:6007/udp

Denying connections

Denying services
================

ufw deny http

Denying a port
============

ufw deny 80

Checking UFW Status and Rules

ufw status verbose

The output should look similar to

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere

Remote Administration Via SSH

Set SSH Protocol To 2

Set SSH protocol to 2

SSH has two protocols it may use, protocol 1 and protocol 2. The older protocol 1 is less secure and should be disabled unless you know that you specifically require it.

Open the sshd config
vi /etc/ssh/sshd_config
Add or amend as shown below
# Protocol 2,1 Protocol 2
Restart the sshd service
systemctl restart sshd.service

Remote Administration Via SSH

Disable SSH Root Login

Disabling SSH root login will add an extra layer of security. It would be more secure to brute force
attacks or in case your password is stolen.

Create a non-root user

adduser username
passwd username
Open the ssh configuration file with your editor.

vi /etc/ssh/sshd_config
Add the line “PermitRootLogin no.” Or uncomment the line "#PermitRootLogin yes" and
change yes to no.

#LoginGraceTime 2m
#PermitRootLogin yes
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10
PermitRootLogin no
Save and exit the file.
Restart the ssh service

systemctl restart sshd.service

Remote Administration Via SSH

Set SSH permitemptypasswords to no

Open the ssh configuration file with your editor.

vi /etc/ssh/sshd_config
Add or amend as shown below

PermitEmptyPasswords no
Restart the sshd service

systemctl restart sshd.service

System Integrity and Intrusion Detection

Install And Configure Fail2Ban

Add sudo in front of the commands if you are using a normal account with sudo privileges

Installation

Run the command below to install Fail2Ban

apt-get install fail2ban -y

Configuration

Copy the “jail.conf” file and re-save it with the name “jail.local”

cp -pf /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
Edit the jail.local and add your local IP address onto the ignoreip line

[DEFAULT]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1

# Override /etc/fail2ban/jail.d/00-firewalld.conf:
banaction = iptables-multiport

# "bantime" is the number of seconds that a host is banned.
bantime  = 600

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime  = 600

# "maxretry" is the number of failures before a host get banned.
maxretry = 5

Add a jail file to protect SSH access

Create a new file called sshd.local

touch /etc/fail2ban/jail.d/sshd.local && chmod +x /etc/fail2ban/jail.d/sshd.local
Edit the file and add the lines below

vi /etc/fail2ban/jail.d/sshd.local

Add these lines to the file
===========================

[sshd]
enabled = true
port = ssh
#action = firewallcmd-ipset
logpath = %(sshd_log)s
maxretry = 5
bantime = 86400

Enable and start the FAIL2BAN service

Run the following commands to enable and start the Fail2Ban service

systemctl enable fail2ban
systemctl start fail2ban

System Integrity and Intrusion Detection

Install And Configure AIDE

Add sudo in front of the commands if you are using a normal account with sudo privileges

Install and configure Host Based IDS (Intrusion Detection System) "AIDE"

Install AIDE

apt-get install aide -y
Configure AIDE and initialize database. It's possible to use AIDE with default config but if you'd like to customize settings, change configuration file like follows. Setting rules are written near 26-84 lines, refer to them.
Execute checking

[root@dlp ~]# aide --check
# if thete is no unmatch, it displayed "Okay"

AIDE, version 0.15.1

### All files match AIDE database. Looks okay!

# try to change a file and check again
[root@dlp ~]# chmod 640 /root/anaconda-ks.cfg
[root@dlp ~]# aide --check
# detected differences like follows
AIDE 0.15.1 found differences between database and filesystem!!
Start timestamp: 2015-06-17 19:55:20

Summary:
  Total number of files:        39039
  Added files:                  0
  Removed files:                0
  Changed files:                1


---------------------------------------------------
Changed files:
---------------------------------------------------

changed: /root/anaconda-ks.cfg

---------------------------------------------------
Detailed information about changes:
---------------------------------------------------


File: /root/anaconda-ks.cfg
 Perm     : -rw-------                       , -rw-r-----
 Ctime    : 2015-05-24 02:22:04              , 2015-06-19 11:55:15
 ACL      : old = A:
----
user::rw-
group::---
other::---
----
                  D: <NONE>
            new = A:
----
user::rw-
group::r--
other::---
----
                  D: <NONE>

Update AIDE database

If there is no ploblem even if some differences are detected, then update database like follows

[root@dlp ~]# aide --update
AIDE 0.15.1 found differences between database and filesystem!!
Start timestamp: 2015-06-17 19:56:31

Summary:
  Total number of files:        39039
  Added files:                  0
  Removed files:                0
  Changed files:                1


---------------------------------------------------
Changed files:
---------------------------------------------------

changed: /root/anaconda-ks.cfg
.....
.....

# update database
[root@dlp ~]# cp -p /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

Add Cron job and email logs

Add in Cron if check regulary. Log file [/var/log/aide/aide.log] is updated every time and if there is no difference, it is updated with zero byte, so if you's like to save log files, it needs to create a shell script or send results via email or others

# for example, add daily check in Crontab and send results via email

[root@dlp ~]# vi /etc/cron.d/aide
00 01 * * * /usr/sbin/aide --update | mail -s 'Daily Check by AIDE' root

Anti-Virus Considerations

Install And Enable Anti-Virus Software

Installation of ClamAV

Execute the command below to install Clamav and a tool to send email notifications

apt-get update && apt-get install clamav clamav-freshclam heirloom-mailx
Enable FreshClam for automatic virus definitions updates

service ClamAV-freshclam start
Do a manual update of the virus definition

freshclam -v

Anti-Virus Considerations

Configure Daily Scan

Configure ClamAV for daily scans

Create and edit the file clamscan_daily in the folder /etc/cron.daily

Create clamscan_daily
=====================

vi /etc/cron.daily

=====================================
Add below to file changing the option

EMAIL_FROM="from email address";
EMAIL_TO="to email address";
DIRTOSCAN="list of directories";

as required
=====================================

#!/bin/bash
LOGFILE="/var/log/clamav/clamav-$(date +'%Y-%m-%d').log";
EMAIL_MSG="Please see the log file attached.";
EMAIL_FROM="from email address";
EMAIL_TO="to email address";
DIRTOSCAN="list of directories";

for S in ${DIRTOSCAN}; do
 DIRSIZE=$(du -sh "$S" 2>/dev/null | cut -f1);

 echo "Starting a daily scan of "$S" directory.
 Amount of data to be scanned is "$DIRSIZE".";

 clamscan -ri "$S" >> "$LOGFILE";

 # get the value of "Infected lines"
 MALWARE=$(tail "$LOGFILE"|grep Infected|cut -d" " -f3);

 # if the value is not equal to zero, send an email with the log file attached
 if [ "$MALWARE" -ne "0" ];then
 # using heirloom-mailx below
 echo "$EMAIL_MSG"|mail -a "$LOGFILE" -s "Malware Found" -r "$EMAIL_FROM" "$EMAIL_TO";
 fi
done

exit 0

Ubuntu Server - Installation

Server Install Checklist

Server

Server Checklist

Preparation

System Update

Process Hardening

OS Hardening

Network Security and Firewall Configuration

Remote Administration Via SSH

System Integrity and Intrusion Detection

Anti-Virus Considerations

Preparation

Server Image Installation

Server Image Installation

Change the Default Shell

Change the Default Shell

Disable AppArmor And Apport

Disable AppArmor and Apport

Disable AppArmor

Disable Apport

System Update

Update With The Latest Updates

Updating the server with the latest updates

Adding additional repositories

Updating the server

Configure Automatic Updates

Setting up automatic updates

Installing unattended-upgrades package

Configuring unattended-upgrades

Enable automatic updates

Configure Network Time Protocol (NTP)

Network Time Protocol (NTP) configuration

Process Hardening

Restrict Core Dumps

Restricting Core Dumps

Enable Randomized Virtual Memory Region Placement

Randomized virtual memory region placement

OS Hardening

Remove Legacy Services

The removal of legacy services

Check for legacy services

Disable legacy services

Disable Or Remove Server Services

Disable or remove server services that are not going to be utilized (e.g. FTP, DNS, LDAP, SMB, DHCP, NFS, SNMP, etc.)

Display a list of services available

Disable unnecessary services

Network Security and Firewall Configuration

Firewall Configuration

Installing and configuring UFW (Uncomplicated Firewall)

Installing UFW

Setting up default policies

Allowing SSH connections

Enabling UFW

Allowing other connections (examples)

Specific services

Specific ports

Port ranges

Denying connections

Checking UFW Status and Rules

Remote Administration Via SSH

Set SSH Protocol To 2

Set SSH protocol to 2

Disable SSH Root Login

Disabling root login via SSH

Set SSH permitemptypasswords to no

Set SSH permitemptypasswords to no

System Integrity and Intrusion Detection

Install And Configure Fail2Ban

Installation

Configuration

Add a jail file to protect SSH access

Enable and start the FAIL2BAN service

Install And Configure AIDE

Install and configure Host Based IDS (Intrusion Detection System) "AIDE"

Update AIDE database

Add Cron job and email logs

Anti-Virus Considerations

Install And Enable Anti-Virus Software

Installation of ClamAV