How to Protect Your Server From Hackers
Tags: linux, tutorial, security, webdev
Published: 2019-03-27 13:07:41

---
title: How to Protect Your Server From Hackers
published: true
description: How to protect you VPS from the ha
tags: linux,tutorial,security,webdev
---

This post was originally posted in [my personal blog](https://vkolesov.com/protected-your-server.html).

<p>It is not a hard deal to make your server secure, but when a lot of routines comes, It is possible to forget to do this. In my case, ssh server was hacked in two weeks after I bought it. One morning my mail had a couple of the abuses from third-side people said "something" on my server tried to hack their servers. So, I should solve the problem quickly. 
</p>
<p>
<h2>How to find the vulnerability</h2>
In my case it was simple. I executed next command
<pre><code class="bash">cat /var/log/auth.log |  grep Accepted</code></pre> 
and it returns me a list of  successful authorization to my server. From the all returned lines I found one IP that is not my own. So, In my case, the SSH was a source of vulnerability.
</p>
<p>
<h2>How to protect server</h2>
Briefly about what I needed to do immediately after buying the server.
<ul>
<li>update && upgrade the all packages on the server;</li>
<li >Install <i><strong>ufw</strong></i> -  plain firewall;</li>
<li >close all server's ports besides SSH, HTTP(s) ports;</li>
<li >Install and config <i><strong>fail2ban</strong></i> utility. It helps  to analyze the /var/log/auth.log and ban some IPs if they make some wrong activity;</li>
<li>change sshd config to accept the authorization only by private key.</li>
</ul>
</p><p>
<h2>What to do?</h2>
If you were hacked, your server is infected, and you need to know how to research and clean it. The best way - recreating the VPS. That was my case. I had the server at hetzner. From their dashboard, it is possible to recreate (drop and create new) VPS with the same IP in one click. So, I did. After that on my local PC, was generated SSH keys with an ssh-keygen utility (is a part of standard OpenSSH package). The command bellow same for Linux and MacOS.
<pre><code class="bash">ssh-keygen</code></pre> 
It creates the pairs of keys in the ~/.ssh directory. After that running
<pre><code class="bash"> ssh-copy-id you_user@your_server_id</code></pre> 
will upload your "just created" public key to the server. Next step, log in to the server and edit the  config file for sshd:
<pre><code class="bash">nano /etc/ssh/sshd_config</code></pre> 
In the config  make changes for PasswordAuthentication variable
<pre><code class="ini">PasswordAuthentication no</code></pre> 

This instruction close the possibility to connect with the password (only connection with private key accepted)
</p><p>
<h2>Installing and tuning ufw and fail2ban</h2>
I used ubuntu on server, so installation is 
<pre><code class="bash">apt install ufw fail2ban</code></pre> 
next step open only ssh, https port on server so:
<pre><code class="bash">ufw allow ssh
ufw allow 80
ufw allow 443
</code></pre> 
and enable the ufw:
<pre><code class="bash">ufw enable</code></pre> 
Next step is configuring the fail2ban utility
<pre><code class="bash"># make a copy of default config (this copy will overload default params according to manual)
cp  /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
nano /etc/fail2ban/jail.local
</code></pre> 
in there find <i><strong>"banaction = "</strong></i>  and set <i><strong>ufw</strong></i>  as a value. After that reload fail2ban
<pre><code class="bash">fail2ban-client reload</code></pre> 
According to this simple config, any three wrong attempts from particular IP get to access to ssh port will ban this IP for 10 minutes. Personally, I changed the ban time for 7 days.
How to check the status:
<pre><code class="bash">fail2ban-client status sshd</code></pre> 
will return in my case
<pre><code class="bash">
Status for the jail: sshd
|- Filter
|  |- Currently failed:	1
|  |- Total failed:	6
|  `- File list:	/var/log/auth.log
`- Actions
   |- Currently banned:	1
   |- Total banned:	2
   `- Banned IP list:	187.109.168.150
</code></pre> 
You can see, that one IP already blocked by the firewall. Same things possible to see with ufw report:
<pre><code class="bash">ufw status
Status: active

To                         Action      From
--                         ------      ----
Anywhere                   REJECT      187.109.168.150           
80/tcp                     ALLOW       Anywhere                  
22                         ALLOW       Anywhere                  
443                        ALLOW       Anywhere           </code></pre> 


The fail2ban can be configured to send reports to your email if some IP has been banned. 
<p>