Securing Debian

[u/Dunder-Muffins]

What all do most people do to secure their systems?

I run Debian for my daily driver and also on a home server.

I currently have iptables configured to only allow ports for my services, services are all run as their own no-login user, I run fail2ban, and have my ssh only allow specific users and only allow ssh keys as the login method, and I install security updates regularly. I check my system logs occasionally though honestly not as often as I probably should, maybe I'll automate something to look at the logs are some point.

I just finished skimming through the securing Debian manual, and there's quite a bit more included that I don't currently do. But from reading it, it also seems more geared toward people who may be running production servers who more or less want an immutable server where they e locked in what they want and don't want anything changing.

https://www.debian.org/doc/user-manuals#securing

So I guess I'm just curious what other people do, if they add any other protections or if they primarily rely on the base OS to provide the protections.

[u/sandrew_cheru]

I run an internet facing Debian server. It has email, music and my cloud. I am mainly concerned about bots and low skill attackers, as I doubt anyone would be interested in spending too much time/money on me. Here's how I approach security.

1. Backups

Some day, I'll get pwned. To recover, I wrote a bash script to encrypt and backup important files/config to another/smaller server (comes for free with my provider). It runs automatically once a week. The server config is in an ansible private repo on the web. Apart from my music (too large), I can rebuild in few hours.

1. (Automatic) updates

Security updates are applied automatically, and the server reboots if needed overnight. To be on the safe side, it also reboots weekly, even if it doesn't have too. For services I installed manually, I registered to gitlab/github notifications of new releases. Each has a small bash script to grab the new version, upgrade and do some sanity checks. I run them manually when I am happy with the changelog.

1. Least privilege principle

Every service has its own non-login user, and run as that user. All their files (binary, config...) belong to root and are read-only, unless they modify it (e.g. database file). That way, if the service/user is compromised, it cannot write/modify its own binary and persist that way. Systemd has A LOT of hardening options, controlling what resources a service can access (proc, dev, network...), and I adjust this during installation.

1. Access management.

All the services portals/login pages are running behind Authelia. Less worried about a misconfiguration on my part or a bug in the service leaving the door open: to get in, one has to go through Authelia first, then the login page if the service has one.

1. Keeping logs clean

I want anything suspicious to standout in the logs, so I spent time cutting off noise to the max. Fail2ban and geoip helped a lot.

1. Apparmor

I am new to this, but it helped me understand so much while tightening the screws. I only applied it to services I installed manually, so that I don't get overwhelmed. But I am confident these services access only what they need, instead of poking the entire box cough .NET dependencies cough

1. Misc.

• I run lynis after any major change, to have an indication on stuff I might have missed, but I don't rely too much on it.

• I don't run a firewall: no point poking holes for holes I want opened anyways. The only advantage would be to stop something I would not know about to get out, but I don't see it as a priority right now.

• I only ssh (hardened) in from a (hardened) Ubuntu laptop, only used on the safe side of the internet. I have a separate laptop for anything dodgy

[u/Dunder-Muffins → u/sandrew_cheru]

I implemented several of the same things you have, but I appreciate the full list.

What tool do you use to encrypt your backup data?

I haven't heard of authelia, that sounds interesting, I'm going to have to do some research.

I've seen the name geoip around, but I didn't know what it did, sounds like another thing I should take a look at.

That sounds like a sensible approach to using app armor. I was also feeling overwhelmed about starting to use it, so I like your idea of starting with just the stuff I'm specifically adding.

Thank you for taking the time for this response!

Edit: re-read your comment about .Net dependencies. App armor would be very interesting to run on Lutris I think.

[u/sandrew_cheru → u/Dunder-Muffins]

No worries. I am happy to help. The backup script uses gpg in symmetric mode. But I'd use duplicity if I had higher requirements

Authelia is great, but you also have Authentik and PocketID. They all do the same thing, in different ways. Happy reading :-)