What is server hardening?
Server hardening means removing what a server does not need and tightening what is left: its accounts, its SSH settings and its file modes. It matters because a forgotten account or a loose setting is often how a break-in starts.
A small shop kept an old account for a supplier who left a year ago. It had no password check, and the server let root log in over the network. A scan found it before any attacker did. The fix took five minutes.
By the end of this lesson
Note
I can find weak accounts, SSH settings and file modes on a server, and fix them.
Key words
| Word | What it means | Example |
|---|---|---|
| Hardening | removing what a server does not need, so there is less to attack | |
| Account | a name the system lets sign in, with its own rights | |
| File mode | three digits that say who may read, write and run a file | 640 |
| World-writable | a file that every user on the machine may change | |
| SSH | the tool that lets you sign in to a server over a network | |
| Setting | one line in a configuration file, a name and a value |
The cells students fill in are left blank in this preview.
List the accounts, then ask who needs each
You cannot protect an account you do not know about. So hardening starts with a list.
Ordinary people have an account number of 1000 or more, called the UID. Root has UID 0, and only root should have it.
List the ordinary accounts and their shells
awk -F: '$3 >= 1000 && $3 < 65534 {print $1, $7}' /etc/passwdShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Which accounts have UID 0?
awk -F: '$3 == 0 {print $1}' /etc/passwdShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Reading the two lists
The first Run prints one line for each ordinary account: its name and its login shell, such as /bin/bash. Ask of every line, does a person still need this?
The second Run prints one word, root. A second name there would be a second root, and a reason to start an incident.
File modes say who may do what
Every file has a mode of three digits: the owner, the group and everybody else. Each digit adds 4 to read, 2 to write and 1 to run.
The account list is public, so it may be read by all. The file with the password hashes must not be.
Show the mode and owner of two files
stat -c '%a %U:%G %n' /etc/passwd /etc/shadowShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Count the accounts with an empty password
sudo awk -F: '$2 == "" {print $1}' /etc/shadow | wc -lShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Worked example: what four modes mean
| Mode | Owner | Group | Everybody else |
|---|---|---|---|
| 644 | read and write | read | read |
| 640 | read and write | read | nothing |
| 2770 | read, write and enter | read, write and enter | nothing |
| 777 | everything | everything | everything, so world-writable |
The cells students fill in are left blank in this preview.
What the terminal printed
The stat Run printed two lines: 644 root:root /etc/passwd and 640 root:shadow /etc/shadow. Anyone may read the account list. Only root and the shadow group may read the hashes.
The count Run printed 0. Any other number is an account that anyone could sign in to with no password.
SSH is a door, settings are the lock
The SSH server reads a settings file. Three of its lines decide most of the risk: may root sign in, may a password be used, and may a password be empty.
You will practise on a copy in your own folder. The real file is never touched, so nobody is locked out.
Write a weak practice file
printf 'PermitRootLogin yes\nPasswordAuthentication yes\nPermitEmptyPasswords no\n' > sshd-practice.confShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Find the two weak lines
grep -E '^(PermitRootLogin|PasswordAuthentication) yes' sshd-practice.confShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Fix both with sed
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/; s/^PasswordAuthentication yes/PasswordAuthentication no/' sshd-practice.confShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Check the file again
grep -E '^(PermitRootLogin|PasswordAuthentication)' sshd-practice.confShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Why the first value matters
The first Run of the group found two lines. After the fix, both say no. People then sign in with a key, not a password, and nobody signs in as root.
One more rule: the SSH server uses the first value it finds for a setting. A weak line above a safe one wins.
See which line counts
printf 'PermitRootLogin no\nPermitRootLogin yes\n' | grep -m1 '^PermitRootLogin'Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A common mistake
Warning
Many people think the last line of a settings file wins, so they add the safe line at the bottom. For the SSH server the first line wins, and the weak one above is still in force. Edit the line that is there. Do not add a second one.
Delete the practice file
rm sshd-practice.confShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Going further: the lab's own folder
After you finish the lab's task 2, run ls -ld /srv/projects and stat -c '%a %U:%G %n' /srv/projects. Say in one sentence who may enter it, and which digit keeps everybody else out.
The lab's check marks the user, the folder, the cron job and the service. It does not mark this lesson. The assignment above is its checked task.