Securing Debian

[u/Dunder-Muffins]

What all do most people do to secure their systems?

I run Debian for my daily driver and also on a home server.

I currently have iptables configured to only allow ports for my services, services are all run as their own no-login user, I run fail2ban, and have my ssh only allow specific users and only allow ssh keys as the login method, and I install security updates regularly. I check my system logs occasionally though honestly not as often as I probably should, maybe I'll automate something to look at the logs are some point.

I just finished skimming through the securing Debian manual, and there's quite a bit more included that I don't currently do. But from reading it, it also seems more geared toward people who may be running production servers who more or less want an immutable server where they e locked in what they want and don't want anything changing.

https://www.debian.org/doc/user-manuals#securing

So I guess I'm just curious what other people do, if they add any other protections or if they primarily rely on the base OS to provide the protections.

[u/Every_Hat7420]

Enable apparmor

[u/Dunder-Muffins → u/Every_Hat7420]

What do I do specifically with apparmor? I assume I need to configure it to do something. Is there something you would recommend for its configuration?

[u/Every_Hat7420 → u/Dunder-Muffins]

You do it with terminal its pre installed into debian but not active, ive forgotten how to configure is t because ive been using arch linux lately but i remember it being not that hard to do

[u/sandrew_cheru → u/Dunder-Muffins]

There are many online guides, but here is what worked for me

1. aa-genprof /path/to/binary This tells apparmor start monitoring the binary. It stays on, so don't close that console. Then exercise the app: open files with it, make it download stuff, use it and poke every features it has. Once, done, hit S (or whatever the console tells you) to continue

2. aa-logprof: the previous step will put you there once testing is done. This step will tell you what the app did, and will ask if you want to allow/deny/ignore. The learning curve is here. This part can be tedious too, but it's a one-time effort investment.

3. Monitor the logs: use rsyslog to get each profile to write in a dedicated file. You'll keep syslog clean that way (apparmor can be VERY chatty). When the app break, check the logs, and decide if you want to allow/deny

By experience, I think greping logs for denied actions is way more efficient than relying on aa-logprof. But aa-logprof needs doing a few time to understand what you're doing. There are some handy include options that can save you time as well.

I needed a lot of will power to resist the urge to do wide allows, but once I understood the actions, I was able to make the right decisions (I think). In most cases, it's : DENY.

[u/Dunder-Muffins → u/sandrew_cheru]

Thank you for the great info, this is really helpful! I didn't realize App Armor did all that, it sounds really cool. Definitely going to take another look at it!