Web Application Setup - Server Security

September 2, 2019 • webapp server ubuntu digitalocean

Optimizing Ubuntu Server

Services and programs you can likely kill:

This was taken from this site

BASICS

Killing these didn’t impact the system at all when I tested:

... sudo apt remove snapd -y --purge
... sudo apt remove lxcfs -y --purge
... sudo apt remove policykit-1 -y --purge
... 
... sudo apt remove lvm2 -y --purge
... sudo apt remove at -y --purge
... sudo apt remove mdadm -y --purge
... sudo apt remove open-iscsi -y --purge
... sudo apt remove accountsservice -y --purge

EXTREME

I did not test these, but were listed as extreme possibilities.

... sudo apt remove dbus -y --purge
... sudo apt remove rsyslog -y --purge
... sudo apt remove acpid -y --purge
... sudo systemctl stop cron && sudo systemctl disable cron
... sudo rm /etc/systemd/system/getty.target.wants/getty@tty1.service
... sudo rm /lib/systemd/system/getty@.service

Securing Ubuntu Server

Install fail2ban

Install:


... sudo apt-get update
... sudo apt-get fail2ban

Change SSH Port

Update sshd_config
```
... vim /etc/ssh/sshd_config
```
Change Port 22 to a different port that is less than 1024. Example Port 666
Update firewall:
```
... sudo ufw allow 666
```
Update fail2ban jail.local:
```
[sshd]
enabled = true
port = 666
```
Restart ssh:
```
... sudo systemctl restart ssh
```
Restart fail2ban:
```
... sudo systemctl restart fail2ban
```

Install nmap

Install
```
... sudo apt-get install nmap
```
Run a ping scan for open ports:
```
... nmap -v -sT localhost
```
Run a SYN SYN Stealth Scan:
```
... sudo nmap -v -sS localhost
```

Install rootkit checkers

Install rkhunter and chkrootkit:

... sudo apt-get install rkhunter chkrootkit

Run check with chkrootkit:
```
... sudo chkrootkit
```

Run check with rkhunter:

... sudo rkhunter --update
... sudo rkhunter --propupd
... sudo rkhunter --check

reboot the server:

... sudo systemctl reboot