Background: 15 years of experience in software and apparently spoiled because it was already set up correctly.

Been practicing doing my own servers, published a test site and 24 hours later, root was compromised.

Rolled back to the backup before I made it public and now I have a security checklist.

  • Refurbished Refurbisher@lemmy.sdf.org
    link
    fedilink
    arrow-up
    4
    ·
    edit-2
    2 days ago

    How do I whitelist password logins? I only disabled password logins in SSHd and set it to only use a key.

    I also like to disable root login by setting its default shell to nologin, that way, it’s only accessible via sudo or doas. I think there’s a better way of doing it, which is how Debian does it by default when not setting a root password, but I’m not sure how to configure that manually, or even what they do.

    • Oisteink@feddit.nl
      link
      fedilink
      arrow-up
      3
      ·
      edit-2
      2 days ago

      To whitelist password logins in ssh you can match username and give them yes after you set no (for all). But i see no reason for password logons in ssh, console is safe enough (for me).

    • Oisteink@feddit.nl
      link
      fedilink
      arrow-up
      3
      ·
      2 days ago

      Right - so console/tty login is restricted by pam and its settings. So disabling ssh root logins means you can still log in as root there.

      To lock root you can use passwd -l

      If locking root I would keep root shell so i could sudo to root.

      So my normal setup would be to create my admin user with sudo rights, set «PasswordAuthentication no» in sshd config and lock root with «sudo passwd -l root» Remember to add a pubkey to admin users authorizedkeys, and give it a secure but typable password

      My root is now only available through sudo, and i can use password on console. Instead of locking root you can give it secure typable password. This way root can log in from console so you dont need sudo for root access from console.

      It boils down to what you like and what risks you take compared to usable system. You can always recover a locked root account if you have access to single-user-mode or a live cd . Disk encryption makes livecd a difficult option.