#################################################################################################
Network Time Protocol (NTP) is a TCP/IP protocol for synchronizing time over a network.
1. First, synchronize the server's time with any Internet time server using the
ntpdate command:
$ ntpdate -s ntp.ubuntu.com
2. To install ntpd, enter the following command in the terminal:
$ sudo apt-get install ntp
Sometimes, the NTP daemon refuses to work if the time difference between local time and
central time is too big. To avoid this problem, we have synchronized the local time and central
time before installing ntpd. As ntpd and ntpdate both use the same UDP port, 123, the
ntpdate command will not work when the ntpd service is in use.
A central DHCP server can be configured to provide NTP settings to all DHCP clients. For this
to work, your clients should also be configured to query NTP details from DHCP. A DHCP client
configuration on Ubuntu already contains the query for network time servers.
#####################################################################################################
Install HAProxy:
Load balancing can be implemented at OSI Layer 4,
that is, at TCP or UDP protocol levels, or at Layer 7, that is, application level with HTTP, SMTP,
and DNS protocols.
#########################################################################################################3
IP defines the
rules for IP addressing and routing packets over network and provides an identity IP address
to each host on the network.
New Linux kernel provides a tool called sysctl that can be used to
modify kernel parameters at runtime without recompiling the entire kernel. We can use
sysctl to modify and TCP/IP parameters to match our needs.
If you successfully receive a response, then you have a working network connection.
If this does not work, then you can check the problem with the mtr command. This
command will display each router between your server and the destination server:
$ mtr -r -c 1 8.8.8.8
###########################################################################################################
VPN enables two or more systems to communicate privately and securely over the public
network or Internet. The network traffic is routed through the Internet, but is encrypted. You
can use VPN to set up a secure connection between two datacenters or to access office
resources from the leisure of your home.
The VPN service is also used to protect your online activities,
access location restricted contents,
and bypass restrictions imposed by your ISP.
VPN services are implemented with a number of different protocols, such as Point-to-Point
Tunneling Protocol (PPTP), Layer two tunneling protocol (L2TP), IPSec, and SSL.
OpenVPN is an open source SSL VPN solution and provides a wide range of configurations.
OpenVPN can be configured to use either TCP or UDP protocols. In this recipe, we will
set up OpenVPN with its default UDP port 1194.
When the OpenVPN service is started on the OpenVPN host, it creates a new virtual network interface,
a tun device named tun0 . On the client side, OpenVPN provides the client with tools that
configure the client with a similar setup by creating a tap device on the client's system.
Note that OpenVPN provides a web-based admin interface
to manage VPN clients. This is a commercial offering
that provides an easy-to-use admin interface to manage
OpenVPN settings and client certificates.
####################################################################################################################
It is said that the best way to improve server security is to reduce the attack surface.
Network Time Protocol (NTP) is a TCP/IP protocol for synchronizing time over a network.
1. First, synchronize the server's time with any Internet time server using the
ntpdate command:
$ ntpdate -s ntp.ubuntu.com
2. To install ntpd, enter the following command in the terminal:
$ sudo apt-get install ntp
Sometimes, the NTP daemon refuses to work if the time difference between local time and
central time is too big. To avoid this problem, we have synchronized the local time and central
time before installing ntpd. As ntpd and ntpdate both use the same UDP port, 123, the
ntpdate command will not work when the ntpd service is in use.
A central DHCP server can be configured to provide NTP settings to all DHCP clients. For this
to work, your clients should also be configured to query NTP details from DHCP. A DHCP client
configuration on Ubuntu already contains the query for network time servers.
#####################################################################################################
Install HAProxy:
Load balancing can be implemented at OSI Layer 4,
that is, at TCP or UDP protocol levels, or at Layer 7, that is, application level with HTTP, SMTP,
and DNS protocols.
#########################################################################################################3
IP defines the
rules for IP addressing and routing packets over network and provides an identity IP address
to each host on the network.
New Linux kernel provides a tool called sysctl that can be used to
modify kernel parameters at runtime without recompiling the entire kernel. We can use
sysctl to modify and TCP/IP parameters to match our needs.
If you successfully receive a response, then you have a working network connection.
If this does not work, then you can check the problem with the mtr command. This
command will display each router between your server and the destination server:
$ mtr -r -c 1 8.8.8.8
###########################################################################################################
VPN enables two or more systems to communicate privately and securely over the public
network or Internet. The network traffic is routed through the Internet, but is encrypted. You
can use VPN to set up a secure connection between two datacenters or to access office
resources from the leisure of your home.
The VPN service is also used to protect your online activities,
access location restricted contents,
and bypass restrictions imposed by your ISP.
VPN services are implemented with a number of different protocols, such as Point-to-Point
Tunneling Protocol (PPTP), Layer two tunneling protocol (L2TP), IPSec, and SSL.
OpenVPN is an open source SSL VPN solution and provides a wide range of configurations.
OpenVPN can be configured to use either TCP or UDP protocols. In this recipe, we will
set up OpenVPN with its default UDP port 1194.
When the OpenVPN service is started on the OpenVPN host, it creates a new virtual network interface,
a tun device named tun0 . On the client side, OpenVPN provides the client with tools that
configure the client with a similar setup by creating a tap device on the client's system.
Note that OpenVPN provides a web-based admin interface
to manage VPN clients. This is a commercial offering
that provides an easy-to-use admin interface to manage
OpenVPN settings and client certificates.
####################################################################################################################
It is said that the best way to improve server security is to reduce the attack surface.
One part of the attack surface is the number of open ports that are waiting for connection
to be established. It is always a good idea to block all unrequired ports.
Any traffic coming to these ports can be filtered, that is, allowed or blocked with the help of a
filtering system.
The Linux kernel provides a built-in packet filtering mechanism called netfilter, which is used
to filter the traffic coming in or going out of the system.
All modern Linux firewall systems use
netfilter under the hood. Iptables is a well-known and popular user interface to set up and
manage filtering rules for netfilter.
It is a complete firewall solution that is highly configurable
and highly flexible. However, iptables need effort on the user's part to master the firewall
setup. Various frontend tools have been developed to simplify the configuration of iptables.
UFW is among the most popular frontend solutions to manage iptables.
################################################
So you have installed minimal setup of Ubuntu, you have setup SSH with public key
authentication and disabled password authentication, and you have also allowed only single
non-root user to access the server. You also configured a firewall, spending an entire night
understanding the rules, and blocked everything except a few required ports. Now does this
mean that your server is secured and you are free to take a nice sound sleep? Nope.
Servers are exposed to the public network, and the SSH daemon itself, which is probably the
only service open, and can be vulnerable to attacks. If you monitor the application logs and
access logs, you can find repeated systematic login attempts that represent brute force attacks.
Fail2ban is a service that can help you monitor logs in real time and modify iptables rules to
block suspected IP addresses. It is an intrusion-prevention framework written in Python. It can
be set to monitor logs for SSH daemon and web servers. In this recipe, we will discuss how to
install and configure fail2ban.
##################################################################################################
Follow these steps to discuss Ubuntu security best practices:
1. Install updates from the Ubuntu repository. You can install all the available updates or
just select security updates, depending on your choice and requirement:
$ sudo apt-get update
$ sudo apt-get upgrade
2. Change the root password; set a strong and complex root password and note it down
somewhere. You are not going to use it every day:
$ sudo passwd
3. Add a new user account and set a strong password for it. You can skip this step if the
server has already set up a non-root account, like Ubuntu:
$ sudo adduser john
$ sudo passwd john
4. Add a new user to the Sudoers group:
$ sudo adduser john sudo
5. Enable the public key authentication over SSH and import your public key to
new user's authorized_keys file.
6. Restrict SSH logins:
1. Change the default SSH port:
port 2222
2. Disable root login over SSH:
PermitRootLogin no
3. Disable password authentication:
PasswordAuthentication no
4. Restrict users and allow IP address:
AllowUsers john@(your-ip) john@(other-ip)
7. Install fail2ban to protect against brute force attacks and set a new SSH port
in the fail2ban configuration:
$ sudo apt-get install fail2ban
8. Optionally, install UFW and allow your desired ports:
$ sudo ufw allow from <your-IP> to any port 22 proto tcp
$ sudo ufw allow 80/tcp
$ sudo ufw enable
9. Maintain periodic snapshots (full-disk backups) of your server. Many cloud
service providers offer basic snapshot tools.
10. Keep an eye on application and system logs. You may like to set up log-monitoring
scripts that will e-mail any unidentified log entry.
to be established. It is always a good idea to block all unrequired ports.
Any traffic coming to these ports can be filtered, that is, allowed or blocked with the help of a
filtering system.
The Linux kernel provides a built-in packet filtering mechanism called netfilter, which is used
to filter the traffic coming in or going out of the system.
All modern Linux firewall systems use
netfilter under the hood. Iptables is a well-known and popular user interface to set up and
manage filtering rules for netfilter.
It is a complete firewall solution that is highly configurable
and highly flexible. However, iptables need effort on the user's part to master the firewall
setup. Various frontend tools have been developed to simplify the configuration of iptables.
UFW is among the most popular frontend solutions to manage iptables.
################################################
So you have installed minimal setup of Ubuntu, you have setup SSH with public key
authentication and disabled password authentication, and you have also allowed only single
non-root user to access the server. You also configured a firewall, spending an entire night
understanding the rules, and blocked everything except a few required ports. Now does this
mean that your server is secured and you are free to take a nice sound sleep? Nope.
Servers are exposed to the public network, and the SSH daemon itself, which is probably the
only service open, and can be vulnerable to attacks. If you monitor the application logs and
access logs, you can find repeated systematic login attempts that represent brute force attacks.
Fail2ban is a service that can help you monitor logs in real time and modify iptables rules to
block suspected IP addresses. It is an intrusion-prevention framework written in Python. It can
be set to monitor logs for SSH daemon and web servers. In this recipe, we will discuss how to
install and configure fail2ban.
##################################################################################################
Follow these steps to discuss Ubuntu security best practices:
1. Install updates from the Ubuntu repository. You can install all the available updates or
just select security updates, depending on your choice and requirement:
$ sudo apt-get update
$ sudo apt-get upgrade
2. Change the root password; set a strong and complex root password and note it down
somewhere. You are not going to use it every day:
$ sudo passwd
3. Add a new user account and set a strong password for it. You can skip this step if the
server has already set up a non-root account, like Ubuntu:
$ sudo adduser john
$ sudo passwd john
4. Add a new user to the Sudoers group:
$ sudo adduser john sudo
5. Enable the public key authentication over SSH and import your public key to
new user's authorized_keys file.
6. Restrict SSH logins:
1. Change the default SSH port:
port 2222
2. Disable root login over SSH:
PermitRootLogin no
3. Disable password authentication:
PasswordAuthentication no
4. Restrict users and allow IP address:
AllowUsers john@(your-ip) john@(other-ip)
7. Install fail2ban to protect against brute force attacks and set a new SSH port
in the fail2ban configuration:
$ sudo apt-get install fail2ban
8. Optionally, install UFW and allow your desired ports:
$ sudo ufw allow from <your-IP> to any port 22 proto tcp
$ sudo ufw allow 80/tcp
$ sudo ufw enable
9. Maintain periodic snapshots (full-disk backups) of your server. Many cloud
service providers offer basic snapshot tools.
10. Keep an eye on application and system logs. You may like to set up log-monitoring
scripts that will e-mail any unidentified log entry.
$ sudo useradd -s <SHELL> -m -d <HomeDir> -g <Group> UserName
Where:
f f -s specifies default login shell for the user
f f -d sets the home directory for the user
f f -m creates a home directory if one does not already exist
f f -g specifies the default group name for the user
sudo adduser bob
You can set or change the user password with the following command:
$sudo passwd bob
username:passwd:uid:gid:full name:home_dir:shell
4. Now log in with user2 :
user1@ubuntu:~$ su user2
$ sudo usermod --expiredate 1 john # disable the user account john
$ sudo usermod --expiredate "" john # re-enable user account john
$ sudo usermod -e YYYY-MM-DD john # specify expiry date
$chown newuser filename
To change the owner as well as the group of file, use the following command:
$chown newuser:newgroup filename
You can skip changing owner and change only the group with the following command:
$chown :newgroup filename
$sudo adduser john
2. Make john a member of sudo group with the following command:
$sudo adduser username sudo
#usermanagement
Where:
f f -s specifies default login shell for the user
f f -d sets the home directory for the user
f f -m creates a home directory if one does not already exist
f f -g specifies the default group name for the user
sudo adduser bob
You can set or change the user password with the following command:
$sudo passwd bob
username:passwd:uid:gid:full name:home_dir:shell
4. Now log in with user2 :
user1@ubuntu:~$ su user2
$ sudo usermod --expiredate 1 john # disable the user account john
$ sudo usermod --expiredate "" john # re-enable user account john
$ sudo usermod -e YYYY-MM-DD john # specify expiry date
$chown newuser filename
To change the owner as well as the group of file, use the following command:
$chown newuser:newgroup filename
You can skip changing owner and change only the group with the following command:
$chown :newgroup filename
$sudo adduser john
2. Make john a member of sudo group with the following command:
$sudo adduser username sudo
#usermanagement
Nginx can be considered the next generation of web servers. Its development started to solve
the C10k problem, that is, handling ten thousand connections at a time. Apache, being a
process-driven model, has some limitations when handling multiple concurrent connections.
Nginx took advantage of the event-driven approach with asynchronous, non-blocking
connection handling algorithms. A new connection request is handled by a worker process
and placed in an event loop where they are continuously checked for events. The events are
processed asynchronously. This approach enables Nginx to run with a much lower memory
footprint and lower CPU use. It also eliminates the overload of starting a new process for a
new connection. A single worker process started by Nginx can handle thousands of concurrent
connections.
the C10k problem, that is, handling ten thousand connections at a time. Apache, being a
process-driven model, has some limitations when handling multiple concurrent connections.
Nginx took advantage of the event-driven approach with asynchronous, non-blocking
connection handling algorithms. A new connection request is handled by a worker process
and placed in an event loop where they are continuously checked for events. The events are
processed asynchronously. This approach enables Nginx to run with a much lower memory
footprint and lower CPU use. It also eliminates the overload of starting a new process for a
new connection. A single worker process started by Nginx can handle thousands of concurrent
connections.
If your business does have single points of failure, like many services on one host, backup and
recovery become critical.
recovery become critical.
Interfaces are generally in two major states—up and down. Interfaces that are up are active and can
be used to receive network traffic. Interfaces that are down are not connected to the network.
#networkInterface
be used to receive network traffic. Interfaces that are down are not connected to the network.
#networkInterface
What kinds of interfaces can you configure? Modern computer hosts nowadays can easily have more
than one network card (or network interface) and sometimes have many hundreds of IP addresses.
#networking
than one network card (or network interface) and sometimes have many hundreds of IP addresses.
#networking
An
interface can have many aliases, or you can bond or team two or more interfaces together to appear as one
interface.
#networkInterface
interface can have many aliases, or you can bond or team two or more interfaces together to appear as one
interface.
#networkInterface
Linux gives you the ability to have multiple IP addresses on a single interface. The interface uses the
same Mac address for all IP addresses.
#networkInterface
same Mac address for all IP addresses.
#networkInterface
A bonded, or teamed, interface consists of two or more network
interfaces appearing as a single interface. This can be used to provide greater fault tolerance or increased
bandwidth for the interface.
interfaces appearing as a single interface. This can be used to provide greater fault tolerance or increased
bandwidth for the interface.