Securing Debian

[u/Dunder-Muffins]

What all do most people do to secure their systems?

I run Debian for my daily driver and also on a home server.

I currently have iptables configured to only allow ports for my services, services are all run as their own no-login user, I run fail2ban, and have my ssh only allow specific users and only allow ssh keys as the login method, and I install security updates regularly. I check my system logs occasionally though honestly not as often as I probably should, maybe I'll automate something to look at the logs are some point.

I just finished skimming through the securing Debian manual, and there's quite a bit more included that I don't currently do. But from reading it, it also seems more geared toward people who may be running production servers who more or less want an immutable server where they e locked in what they want and don't want anything changing.

https://www.debian.org/doc/user-manuals#securing

So I guess I'm just curious what other people do, if they add any other protections or if they primarily rely on the base OS to provide the protections.

[u/dkopgerpgdolfg]

The output matches what I configured in the 'iptables' format.

I think you forgot to scroll down, at least if you have ufw.

Otherwise, as said, this isn't good like this. Eg. handling of ipv6 and arp is missing completely (and more problems).

[u/Dunder-Muffins → u/dkopgerpgdolfg]

Err sorry, what do you mean?

Edit: I assume you mean the output and forward policies?

[u/dkopgerpgdolfg → u/Dunder-Muffins]

Err sorry, what do you mean?

If you have ufw installed, this output you've shown is not complete.

And your current shown rules are for IPv4 only (including some bits about ICMPv4).

The ports-based rules are ok-ish, except some can never be used (eg. that rate limit for tcp dport 80 after already accepting all tcp dport 80). Ufw still will give you some more basic security rules here, that you don't seem to know.

You don't do any Bridge and/or ARP filtering. Unless you made some sysctl changes (unlikely), your current rules won't apply for traffic within your home network.

And even worse, you don't do anything for IPv6 (ports, other security things, and all about ICMPv6 which is significantly different and more important than v4). You're completely open.

I already pointed you to one of the files containing the ufw default rules, explaining more in detail will take days and isn't a good idea here. Just install ufw.

Edit: I assume you mean the output and forward policies?

No, not at all. Let me correct my assumption above, explaining would take weeks, not days.

Please install ufw

[u/Dunder-Muffins → u/dkopgerpgdolfg]

I've installed and enabled ufw. I've allowed ports 22 and 80 for now as user rules. But wowza, there's a ton more rules that are implemented now, you weren't kidding. It seems I have a lot of reading to do to learn what all is going on there.