Check list security for feminist servers - Revision history

Ooooo: /* Fail2ban */

2021-04-14T18:31:06Z

Fail2ban

← Older revision		Revision as of 18:31, 14 April 2021
Line 60:		Line 60:


	* sudo cat /var/log/fail2ban.log \| grep '~~Ban~~'		* sudo cat /var/log/fail2ban.log \| grep 'ban'
	->> ver que ips has sido baneadas		->> ver que ips has sido baneadas

Ooooo: /* ssh-server config */

2021-04-14T18:27:36Z

ssh-server config

← Older revision		Revision as of 18:27, 14 April 2021
Line 92:		Line 92:

	== ssh-server config ==		== ssh-server config ==
	* Hacer una copia de seguridad de la conf/Make a security back up copy of the conf~~: cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bk~~		* cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bk
	* ~~Para ver que conexiones por ssh se han establecido/To see what connections have been achievd by SSH:~~ ss -n -o state established '( dport = :22 or sport = :22 )'		--> Hacer una copia de seguridad de la conf

			--> Make a security back up copy of the conf


			* ss -n -o state established '( dport = :22 or sport = :22 )'
			--> Para ver que conexiones por ssh se han establecido

			--> To see what connections have been achievd by SSH


	* Revisar/Review: /etc/ssh/sshd_config		* Revisar/Review: /etc/ssh/sshd_config

Line 109:		Line 119:

	UsePAM no		UsePAM no

	X11Forwarding no		X11Forwarding no

Line 135:		Line 145:
	ChallengeResponseAuthentication no -> tiene que estar a no/should be as no		ChallengeResponseAuthentication no -> tiene que estar a no/should be as no

	* Cambiar Port 22XX - acordarse de abrir el firewall y poner el nuevo puerto en fail2ban/Change Port 22XX - remember to open the firewall and put new port in fail2ban		*
	* Para checkear si la configuracion esta bien, antes de reiniciar/ For checking th configuration is fine before restarting: sshd -t		--> Cambiar Port 22XX - acordarse de abrir el firewall y poner el nuevo puerto en fail2ban
	* Para aplicar cambios/For applying changes: ~~service sshd restart~~
			--> Change Port 22XX - remember to open the firewall and put new port in fail2ban


			* sshd -t
			--> Para checkear si la configuracion esta bien, antes de reiniciar

			--> For checking th configuration is fine before restarting


			* service sshd restart
			--> Para aplicar cambios

			--> For applying changes:

	== Configuracion security Debian server ==		== Configuracion security Debian server ==

Ooooo: /* Fail2ban */

2021-04-14T18:23:58Z

Fail2ban

← Older revision		Revision as of 18:23, 14 April 2021
Line 26:		Line 26:

	->> define the rule with regular expression in the filter		->> define the rule with regular expression in the filter


	* regex		* regex
Line 31:		Line 32:

	= frequent expression		= frequent expression


	* /etc/fail2ban/filter.d/		* /etc/fail2ban/filter.d/
Line 36:		Line 38:

	->> the filters are here		->> the filters are here


	*		*
Line 49:		Line 52:

	->> The filters are written with regular expressions from Python that establishes rules that will start a specific action from the IP that is creating the act. The "tupla" (rule, action) or (filter, action) is called “Jail”and it is what determines the penalisation of a malign host.		->> The filters are written with regular expressions from Python that establishes rules that will start a specific action from the IP that is creating the act. The "tupla" (rule, action) or (filter, action) is called “Jail”and it is what determines the penalisation of a malign host.


	* /var/log/fail2ban.log		* /var/log/fail2ban.log
Line 54:		Line 58:

	->> you can see the logs of fail2ban		->> you can see the logs of fail2ban


	* sudo cat /var/log/fail2ban.log \| grep 'Ban'		* sudo cat /var/log/fail2ban.log \| grep 'Ban'
Line 59:		Line 64:

	->> you can see the banned ips		->> you can see the banned ips


	* fail2ban-client status ssh		* fail2ban-client status ssh
Line 64:		Line 70:

	->> Review the jails		->> Review the jails


	* sudo iptables -L -n \| awk '$1=="REJECT" && $4!="0.0.0.0/0"'		* sudo iptables -L -n \| awk '$1=="REJECT" && $4!="0.0.0.0/0"'
Line 69:		Line 76:

	->> Another nice way of seeing it		->> Another nice way of seeing it


	* fail2ban-client status		* fail2ban-client status
Line 74:		Line 82:

	->> to see the fail2ban status and the activated jails		->> to see the fail2ban status and the activated jails


	* fail2ban-client reload sshd		* fail2ban-client reload sshd

Ooooo: /* Fail2ban */

2021-04-14T18:22:54Z

Fail2ban

← Older revision		Revision as of 18:22, 14 April 2021
Line 31:		Line 31:

	= frequent expression		= frequent expression


	* /etc/fail2ban/filter.d/		* /etc/fail2ban/filter.d/
Line 40:		Line 39:
	*		*
	->> es necesario crear filtros para que fail2ban las utilice para luego ejecutar acciones		->> es necesario crear filtros para que fail2ban las utilice para luego ejecutar acciones

	->> It is necessary to create filters so that fail2ban can use them for executing actions		->> It is necessary to create filters so that fail2ban can use them for executing actions

	->> Actualmente fail2ban establece filtros para Apache, sshd, qmail, vsftpd, lighttpd, Postfix y Courier Mail Server/		->> Actualmente fail2ban establece filtros para Apache, sshd, qmail, vsftpd, lighttpd, Postfix y Courier Mail Server

	->> Actually fail2ban can create filters for Apache, sshd, qmail, vsftpd, lighttpd, Postfix y Courier Mail Server		->> Actually fail2ban can create filters for Apache, sshd, qmail, vsftpd, lighttpd, Postfix y Courier Mail Server

	->> Los filtros son escritos con expresiones regulares de Python que establecen la regla que hará disparar una determinada acción sobre la IP que origina el hecho. La tupla (regla, acción) o (filtro, acción) es llamado “Jail” o “prisión”, y es lo que determina la penalización a un host maligno		->> Los filtros son escritos con expresiones regulares de Python que establecen la regla que hará disparar una determinada acción sobre la IP que origina el hecho. La tupla (regla, acción) o (filtro, acción) es llamado “Jail” o “prisión”, y es lo que determina la penalización a un host maligno

	->> The filters are written with regular expressions from Python that establishes rules that will start a specific action from the IP that is creating the act. The "tupla" (rule, action) or (filter, action) is called “Jail”and it is what determines the penalisation of a malign host.		->> The filters are written with regular expressions from Python that establishes rules that will start a specific action from the IP that is creating the act. The "tupla" (rule, action) or (filter, action) is called “Jail”and it is what determines the penalisation of a malign host.

	* /var/log/fail2ban.log		* /var/log/fail2ban.log
	->> Los logs de fail2ban se pueden ver		->> Los logs de fail2ban se pueden ver

	->> you can see the logs of fail2ban		->> you can see the logs of fail2ban

	* sudo cat /var/log/fail2ban.log \| grep 'Ban'		* sudo cat /var/log/fail2ban.log \| grep 'Ban'
	->> ver que ips has sido baneadas		->> ver que ips has sido baneadas

	->> you can see the banned ips		->> you can see the banned ips

	* fail2ban-client status ssh		* fail2ban-client status ssh
	->> Revisarlas por jails		->> Revisarlas por jails

	->> Review the jails		->> Review the jails

	* sudo iptables -L -n \| awk '$1=="REJECT" && $4!="0.0.0.0/0"'		* sudo iptables -L -n \| awk '$1=="REJECT" && $4!="0.0.0.0/0"'
	->> Otra manera guay de verlo es/		->> Otra manera guay de verlo es
	->> Another nice way of seeing it:
			->> Another nice way of seeing it

	* fail2ban-client status		* fail2ban-client status
	->> Para ver el estado de fail2ban y las jaulas activadas		->> Para ver el estado de fail2ban y las jaulas activadas

	->> to see the fail2ban status and the activated jails		->> to see the fail2ban status and the activated jails

	* fail2ban-client reload sshd		* fail2ban-client reload sshd
	Para reiniciar la configuracion de una jaula		->> Para reiniciar la configuracion de una jaula
	for restarting the config of a jail
			->> for restarting the config of a jail

	[https://serverfault.com/questions/841183/how-to-show-all-banned-ip-with-fail2ban\| More info here]		[https://serverfault.com/questions/841183/how-to-show-all-banned-ip-with-fail2ban\| More info here]

Ooooo: /* Fail2ban */

2021-04-14T18:21:48Z

Fail2ban

← Older revision		Revision as of 18:21, 14 April 2021
Line 24:		Line 24:
	* failregex = fail reg ex		* failregex = fail reg ex
	->> define la regla con expresiones regulares en el filtro		->> define la regla con expresiones regulares en el filtro

	->> define the rule with regular expression in the filter		->> define the rule with regular expression in the filter

	* regex		* regex
	= expresión regular		= expresión regular

	= frequent expression		= frequent expression

Line 33:		Line 35:
	* /etc/fail2ban/filter.d/		* /etc/fail2ban/filter.d/
	->> los filtros están aqui		->> los filtros están aqui

	->> the filters are here		->> the filters are here

Ooooo: /* Fail2ban */

2021-04-14T18:21:22Z

Fail2ban

← Older revision		Revision as of 18:21, 14 April 2021
Line 30:		Line 30:
	= frequent expression		= frequent expression

	* los filtros están en/the filters are in: /etc/fail2ban/filter.d/

	* ~~es necesario crear filtros para que~~ fail2ban ~~las utilice para luego ejecutar acciones~~/		* /etc/fail2ban/filter.d/
	~~It is necessary to create~~ filters ~~so that fail2ban can use them for executing actions~~		->> los filtros están aqui
			->> the filters are here

	* ~~Actualmente~~ fail2ban ~~establece filtros~~ para ~~Apache, sshd, qmail, vsftpd, lighttpd, Postfix y Courier Mail Server/~~		*
	~~Actually~~ fail2ban can ~~create filters~~ for ~~Apache, sshd, qmail, vsftpd, lighttpd, Postfix y Courier Mail Server~~		->> es necesario crear filtros para que fail2ban las utilice para luego ejecutar acciones
			->> It is necessary to create filters so that fail2ban can use them for executing actions

	* Los filtros ~~son escritos con expresiones regulares de Python que establecen la regla que hará disparar una determinada acción sobre la IP que origina el hecho. La tupla (regla~~, ~~acción) o (filtro~~, ~~acción) es llamado “Jail” o “prisión”~~, y ~~es lo que determina la penalización a un host maligno~~/		->> Actualmente fail2ban establece filtros para Apache, sshd, qmail, vsftpd, lighttpd, Postfix y Courier Mail Server/
	~~The~~ filters ~~are written with regular expressions from Python that establishes rules that will start a specific action from the IP that is creating the act. The "tupla" (rule~~, ~~action) or (filter~~, ~~action) is called “Jail”and it is what determines the penalisation of a malign host.~~		->> Actually fail2ban can create filters for Apache, sshd, qmail, vsftpd, lighttpd, Postfix y Courier Mail Server

	* Los ~~logs~~ de ~~fail2ban se pueden ver en~~		->> Los filtros son escritos con expresiones regulares de Python que establecen la regla que hará disparar una determinada acción sobre la IP que origina el hecho. La tupla (regla, acción) o (filtro, acción) es llamado “Jail” o “prisión”, y es lo que determina la penalización a un host maligno
	~~you can see~~ the ~~logs~~ of ~~fail2ban here:~~		->> The filters are written with regular expressions from Python that establishes rules that will start a specific action from the IP that is creating the act. The "tupla" (rule, action) or (filter, action) is called “Jail”and it is what determines the penalisation of a malign host.
	~~/var/log/fail2ban~~.~~log~~

	* ~~Para ver que ips has sido baneadas/~~		* /var/log/fail2ban.log
	~~you can see the banned ips here:~~		->> Los logs de fail2ban se pueden ver
	~~sudo cat~~ /var/log/fail2ban.log ~~\| grep 'Ban'~~		->> you can see the logs of fail2ban

	* ~~Revisarlas por jails~~/		* sudo cat /var/log/fail2ban.log \| grep 'Ban'
	or you can ~~review~~ the ~~jails here:~~		->> ver que ips has sido baneadas
	~~fail2ban-client status ssh~~		->> you can see the banned ips

	* ~~Otra manera guay de verlo es/~~		* fail2ban-client status ssh
	~~Another nice way of seeing it:~~		->> Revisarlas por jails
	~~sudo iptables -L~~ -~~n \| awk '$1=="REJECT" && $4!="0.0.0.0/0"'~~		->> Review the jails

	* ~~Para ver el estado~~ de ~~fail2ban y las jaulas activadas~~/		* sudo iptables -L -n \| awk '$1=="REJECT" && $4!="0.0.0.0/0"'
	~~to see the fail2ban status and the activated jails~~:		->> Otra manera guay de verlo es/
	~~fail2ban-client status~~		->> Another nice way of seeing it:

	* Para reiniciar la configuracion de una jaula/		* fail2ban-client status
	for restarting the config of a jail:		->> Para ver el estado de fail2ban y las jaulas activadas
	~~fail2ban-client reload sshd~~		->> to see the fail2ban status and the activated jails

			* fail2ban-client reload sshd
			Para reiniciar la configuracion de una jaula
			for restarting the config of a jail

	[https://serverfault.com/questions/841183/how-to-show-all-banned-ip-with-fail2ban\| More info here]		[https://serverfault.com/questions/841183/how-to-show-all-banned-ip-with-fail2ban\| More info here]

Ooooo: /* Fail2ban */

2021-04-14T18:15:43Z

Fail2ban

← Older revision		Revision as of 18:15, 14 April 2021
Line 22:		Line 22:
	== Fail2ban ==		== Fail2ban ==

	* failregex = fail reg ex ->> define la regla con expresiones regulares en el filtro/define the rule with regular expression in the filter		* failregex = fail reg ex
	* regex = expresión regular/frequent expression		->> define la regla con expresiones regulares en el filtro
			->> define the rule with regular expression in the filter

			* regex
			= expresión regular
			= frequent expression

	* los filtros están en/the filters are in: /etc/fail2ban/filter.d/		* los filtros están en/the filters are in: /etc/fail2ban/filter.d/
	* es necesario crear filtros para que fail2ban las utilice para luego ejecutar acciones/It is necessary to create filters so that fail2ban can use them for executing actions
	* Actualmente fail2ban establece filtros para Apache, sshd, qmail, vsftpd, lighttpd, Postfix y Courier Mail Server/Actually fail2ban can create filters for Apache, sshd, qmail, vsftpd, lighttpd, Postfix y Courier Mail Server		* es necesario crear filtros para que fail2ban las utilice para luego ejecutar acciones/
	* Los filtros son escritos con expresiones regulares de Python que establecen la regla que hará disparar una determinada acción sobre la IP que origina el hecho. La tupla (regla, acción) o (filtro, acción) es llamado “Jail” o “prisión”, y es lo que determina la penalización a un host maligno/The filters are written with regular expressions from Python that establishes rules that will start a specific action from the IP that is creating the act. The "tupla" (rule, action) or (filter, action) is called “Jail”and it is what determines the penalisation of a malign host.		It is necessary to create filters so that fail2ban can use them for executing actions
	* Los logs de fail2ban se pueden ver en/you can see the logs of fail2ban here: /var/log/fail2ban.log
	* Para ver que ips has sido baneadas/you can see the banned ips here: sudo cat /var/log/fail2ban.log \| grep 'Ban'		* Actualmente fail2ban establece filtros para Apache, sshd, qmail, vsftpd, lighttpd, Postfix y Courier Mail Server/
	* Revisarlas por jails/or you can review the jails here: fail2ban-client status ssh		Actually fail2ban can create filters for Apache, sshd, qmail, vsftpd, lighttpd, Postfix y Courier Mail Server
	* Otra manera guay de verlo es/Another nice way of seeing it: sudo iptables -L -n \| awk '$1=="REJECT" && $4!="0.0.0.0/0"'
	* Para ver el estado de fail2ban y las jaulas activadas/to see the fail2ban status and the activated jails: fail2ban-client status		* Los filtros son escritos con expresiones regulares de Python que establecen la regla que hará disparar una determinada acción sobre la IP que origina el hecho. La tupla (regla, acción) o (filtro, acción) es llamado “Jail” o “prisión”, y es lo que determina la penalización a un host maligno/
	* Para reiniciar la configuracion de una jaula/fo restarting the config of a jail: fail2ban-client reload sshd		The filters are written with regular expressions from Python that establishes rules that will start a specific action from the IP that is creating the act. The "tupla" (rule, action) or (filter, action) is called “Jail”and it is what determines the penalisation of a malign host.

			* Los logs de fail2ban se pueden ver en
			you can see the logs of fail2ban here:
			/var/log/fail2ban.log

			* Para ver que ips has sido baneadas/
			you can see the banned ips here:
			sudo cat /var/log/fail2ban.log \| grep 'Ban'

			* Revisarlas por jails/
			or you can review the jails here:
			fail2ban-client status ssh

			* Otra manera guay de verlo es/
			Another nice way of seeing it:
			sudo iptables -L -n \| awk '$1=="REJECT" && $4!="0.0.0.0/0"'

			* Para ver el estado de fail2ban y las jaulas activadas/
			to see the fail2ban status and the activated jails:
			fail2ban-client status

			* Para reiniciar la configuracion de una jaula/
			for restarting the config of a jail:
			fail2ban-client reload sshd

	[https://serverfault.com/questions/841183/how-to-show-all-banned-ip-with-fail2ban\| More info here]		[https://serverfault.com/questions/841183/how-to-show-all-banned-ip-with-fail2ban\| More info here]

Spideralex at 16:57, 3 October 2020

2020-10-03T16:57:34Z

← Older revision		Revision as of 16:57, 3 October 2020
Line 17:		Line 17:
	* Logging: Logwatch + Configure what to log and what not		* Logging: Logwatch + Configure what to log and what not
	* Security for containers depending on the service		* Security for containers depending on the service

			[https://labekka.red/servidoras-feministas/2019/10/09/fanzine-parte-4.html More info en Parte IV - Securicemos nuestra servidora web por La Bekka]

	== Fail2ban ==		== Fail2ban ==

Spideralex: /* Configuracion security Debian server */

2020-10-03T16:55:23Z

Configuracion security Debian server

← Older revision		Revision as of 16:55, 3 October 2020
Line 85:		Line 85:
	== Configuracion security Debian server ==		== Configuracion security Debian server ==

	* limit the access to ssh-key connections		* Limita el acceso/limit the access to ssh-key connections
			* Copia tu llave al servidor/Copy your key to the server: > ssh-copy-id -i user@server
			* Cambiar la configuración para solo permitir conexiones con ssh-keys/Change the configuration for only allowing conections with ssh-keys: nano /etc/ssh/sshd_config

	~~copiar tu llave al servidor~~:		Modify or add the following line: PasswordAuthentication no
	~~> ssh-copy-id -i user@server~~

	~~Cambiar la configuracion para solo permitir conexiones con~~ ssh~~-keys~~		* change the port for ssh
			* use fail2ban (Which jails are important to enable? sshd, I've seen you have much more! )

	~~> nano /etc/ssh/sshd_config~~		* change the info of the server Apache is giving with ServerTokens and ServerSignature

	~~Modify or add the following line~~		Open up /etc/apache2/conf.d/security
	~~> PasswordAuthentication no~~

	* change the port for ssh		Set ServerTokens OS to Prod

	* use fail2ban (Which jails are important to ~~enable? sshd, I've seen you have much more! )~~		Turn ServerSignature to Off

	* change the info of the server Apache is giving with ServerTokens and ServerSignature
	~~Open up /etc/apache2/conf.d/security~~
	~~Set ServerTokens OS to Prod.~~
	~~Turn ServerSignature to Off.~~
	Restart Apache web server.		Restart Apache web server.

Line 110:		Line 107:

	* iptables enabled (together with fail2ban)		* iptables enabled (together with fail2ban)

	* what more? network wrappers?

Spideralex: /* ssh-server config */

2020-10-03T16:52:41Z

ssh-server config

← Older revision		Revision as of 16:52, 3 October 2020
Line 74:		Line 74:
	* Por buscar/To look for:		* Por buscar/To look for:
	PrintMotd no --> esto te muestra el mensaje de inicio/this shows you the message at the beginning		PrintMotd no --> esto te muestra el mensaje de inicio/this shows you the message at the beginning

	AcceptEnv LANG LC_* lo dejo por defecto/Let it by default		AcceptEnv LANG LC_* lo dejo por defecto/Let it by default

	ChallengeResponseAuthentication no -> tiene que estar a no/should be as no		ChallengeResponseAuthentication no -> tiene que estar a no/should be as no

	* Cambiar Port 22XX - acordarse de abrir el firewall y poner el nuevo puerto en fail2ban/Change Port 22XX - remember to open the firewall and put new port in fail2ban		* Cambiar Port 22XX - acordarse de abrir el firewall y poner el nuevo puerto en fail2ban/Change Port 22XX - remember to open the firewall and put new port in fail2ban
	* Para checkear si la configuracion esta bien, antes de reiniciar/ For checking th configuration is fine before restarting: sshd -t		* Para checkear si la configuracion esta bien, antes de reiniciar/ For checking th configuration is fine before restarting: sshd -t