Welcome to LeviFREE's Blog

1. Accounts and Permissions#

1. Create a new regular ops user, disable direct root connections.
2. Give the ops user minimal sudo privileges.
3. Delete unnecessary system accounts and close unused login shells.

1
adduser levi
2
usermod -aG sudo levi
3
passwd -l root

2. Minimal SSH Exposure#

Edit /etc/ssh/sshd_config:

1
PermitRootLogin no
2
PasswordAuthentication no
3
PubkeyAuthentication yes
4
ChallengeResponseAuthentication no
5
MaxAuthTries 3
6
LoginGraceTime 20

Before restarting, be sure to open a new terminal to test and confirm you can log in with keys, then execute:

1
sudo systemctl restart sshd

3. Firewall Whitelisting#

Deny incoming by default, only allow necessary ports (e.g., 22/80/443).

1
sudo ufw default deny incoming
2
sudo ufw default allow outgoing
3
sudo ufw allow 22/tcp
4
sudo ufw allow 80/tcp
5
sudo ufw allow 443/tcp
6
sudo ufw enable

4. Automatic Security Updates#

• Debian/Ubuntu: Enable unattended-upgrades.
• RHEL-based: Enable dnf-automatic update policy.

The core goal is to reduce the “known vulnerability window.”

5. Login Failure Protection#

Install Fail2ban to block brute-force source IPs.

1
sudo apt install fail2ban -y
2
sudo systemctl enable --now fail2ban

It is recommended to at least enable the sshd jail and set a reasonable ban duration.

6. Service Minimization#

Execute a service inventory check once:

1
sudo ss -tulpen
2
sudo systemctl list-unit-files --type=service

Any public listening port that you “don’t know why it exists” should be disabled first, then verified.

7. Logs and Auditing#

Ensure at least:

• SSH login logs are traceable.
• Sudo operations are traceable.
• System logs are rotated periodically.

It is recommended to retain the last 30-90 days of security logs for tracing anomalies.

8. Backup and Recovery Drills#

Security isn’t just about “preventing intrusions”; it also includes “recoverability.”

• Configure daily snapshots or off-site backups.
• Do a recovery drill at least once a month.
• Backup content must include the site, database, certificates, and critical configurations.

Common Mistakes#

1. Turning off password login first, configuring keys later, resulting in locking yourself out.
2. Changing too many firewall rules at once, accidentally blocking port 22.
3. Only doing backups but never doing recovery verification.

Summary#

Completing the baseline before deploying your business will elevate your server’s risk resistance by an order of magnitude. For personal sites, these 12 items already cover the vast majority of common attack surfaces.