I recently updated my SSL keys. Several servers are accessed by keys from a few devices. A common authorized_hosts file was created as a template. This post covers the generation and use of SSL keys.
(more…)Category: System Administration
Posts related to system administration. Mostly applicable to Linux distributions, mostly Ubuntu/Debian and OpenWrt; see tags.
HTTP2 on Apache2
HTTP2 allows web servers to serve multiple content streams on the same connection. This can reduce server and network load. I have updated my Ubuntu Apache servers to enable HTTP2.
After installing the latest Ubuntu release, I needed to redo the switch to the event Multi-Processing Module (MPM) and switch PHP content delivery back to the
(more…)php-fpmdaemon. I had to repeat the process I originally used as documented here.Banner message for ssh
Using a pre-authentication banner with ssh can verify identification before a password is entered. This can help prevent leaking passwords. Banners are simple to configure but often disabled in the default configuration.
(more…)Securing Content with Headers
There are a number of methods to attach a web site and its viewers’ browsers. Many of these have simple fixes that can be applied in the Apache configuration file. This article presents some of the headers that can be applied
(more…)fail2ban non-root startup
fail2ban runs as root by default. This is unnecessary for its functionality, other than to alter firewall rules. The firewall rules can be safely done, using sudo to enable the required calls. The Debian/Ubuntu init.d file has provisions to start fail2ban as a non-root user, but newer releases use systemd to start and stop the process. This requires a different procedure. This procedure is for my servers which use Shorewall to maintain the firewall. I will document my process for configuring fail2ban in another post. First, create the user as a system user with a group(s) required to read the logs. Fail2ban does not need a shell. The home directory is set like similar system users on Ubuntu systems.
This procedure is for my servers which use Shorewall to maintain the firewall. I will document my process for configuring fail2ban in another post.
First, create the user fail2ban as a system user with the group(s) required to read the logs. Fail2ban does not need a shell. The home directory is set like similar system users on Ubuntu systems.useradd --system --no-create-home --home-dir /var/lib/fail2ban \ --groups adm,www-data --shell /usr/sbin/nologin fail2banIf you are using an init.d script to start fail2ban, set the user in /etc/default/fail2ban. This file is not used by the systemd. If you are using systemd, there is no need to alter the /etc/default/fail2ban file.
If you are using systemd to start fail2ban, create the systemd file /etc/systemd/system/fail2ban.service.d/override.conf. If you are not using Shorewall, omit or edit the [Unit] section.
[Service] User=fail2ban Group=adm Run ExecStartPre with root-permission PermissionsStartOnly=true ExecStartPre=/bin/chown -R fail2ban:adm /var/run/fail2ban [Unit] Requires=shorewall.service After=shorewall.service
Create a sudoers file for fail2ban such as /etc/sudoers.d/fail2ban Ensure required operations are included in the Cmnd_Alias definition. This file is configured to use Shorewall and includes all the actions that could be called. If your sudoers configuration does not use an include directory, add the rules to your sudoers file, or enable the use of an include directory.
Sudoer rules for fail2ban User_Alias FAIL2BAN = fail2ban Cmnd_Alias FAIL2BAN = /sbin/shorewall allow, /sbin/shorewall6 allow, \ /sbin/shorewall logdrop, /sbin/shorewall6 logdrop, \ /sbin/shorewall drop, /sbin/shorewall6 drop, \ /sbin/shorewall logreject, /sbin/shorewall6 logreject, \ /sbin/shorewall reject, /sbin/shorewall6 reject \ /sbin/shorewall blacklist, /sbin/shorewall6 blacklist FAIL2BAN ALL = NOPASSWD: FAIL2BAN # EOFChange the ownership of existing files.
chown -R fail2ban /var/log/fail2ban* /var/lib/fail2ban
Finally, stop and restart fail2ban, check for the fail2ban process, and check your fail2ban log for errors
systemctl stop fail2ban systemctl start fail2ban ps -fu fail2ban tail -60 /var/log/fail2ban.log | less
If you are using logrotate or a similar application to rotate logs, edit the configuration to create new logs owned by the fail2ban user id.
WordPress SSH2 configuration
Instead of the packaged WordPress I run the version provided by WordPress. It is installed using a different userid from the userid the webserver runs as. To enable updates from the Admin Dashboard, I enabled sftp (ssh). This is how I did it.
(more…)init.d for Non-root Processes
When installing third-party applications, they often default to running as root. The server applications for TeamSite/LiveSite are among those. I have applied a simple modification to the init.d scripts that start them as a non-root user. It also allows the scripts to be run by members of an administration group via sudo. This approach applies to other applications.
(more…)Geo blocking with tcpwrappers
I recently had an issue with frequent login attempts against one of my services. These were almost all from countries that should not be accessing my service. To resolve the issue I implemented geo-blocking with TCP Wrappers. This is how I went about geo-blocking connections.
(more…)Shell Scriptlets
This post will be continually developed. I recently designed some solutions to solve some issues with init.d
(more…)Securing TLS
A StackExchange question on using HAProxy’s capture feature to pass data from TCP mode to HTTP mode prompted me to update my SSL configuration. This was intended to get an A+ rating from SSL Labs by sending non-SNI capable clients to a server with weaker ciphers. This was to enable clients on WinXP/IE8, Java 6, and an old Android version to connect. I found a solution without having to have two sets of ciphers and handling traffic in both the TCP mode and HTTP mode. I then optimized my settings to a minimal list of cipher specifications.
(more…)