Once you start running/administering your own server, live on the internet, you really need to think about securing access to it. In this post, Im going to look at the different ways that you can achieve this and the pros and cons of each of these
Firstly lets think about what it is that we are trying to prevent and what we it is that we are not trying to prevent. For this discussion I’m going to assume the server that we are running is a simple webserver hosting a blog. So therefore we want the world to be able to view our blog but not to be able to log on to the server and perfrom admin tasks.
We wil assume that the webserver listens on the standard web ports of 80 & 443, that it connects to a mysql server on the same box (running on 3306) and the we administer the box via SSH, again on the standard port – port 22.
Firstly lets take care of the low hanging fruit. MySQL will, by default, bind to the servers live IP address and so expose port 3306 to the world. (by default it wont allow remote logins but its still a port that is exposed that we dont need to have exposed). Opening the config file for MySQL (/etc/my.conf) we can simply use this line “bind-address=127.0.0.1” and restart the service to make it bind to the loopback instead. (We will assume that you did this before you setup your blog software and so the blog software was configured to use 127.0.0.1 as well)
Good, so thats one port now taken care of. This just leaves the web ports (80 & 443) and ssh open to the world (port 22).
The next thing we need to decide is just exactly how secure we want to be – remember the is an inverse relationship between ease of use and great security; its always a trade off.
We may decide that this is only our blog, that we have a regular off site backup of the database and so we arent really too concerned about security. If this is the case we could probably stop right here, making sure that we
- Use a strong root password
- keep the webserver up to date with latest patches
- keep the blog software up to date with the latest patches
Pros – very little work to setup. Can admin from anywhere, doesnt require additional software (ssh keys)
Cons – you are exposing port 22 to the world and could potentialy be at risk to a zeroday attack or someone just guessing/bruteforcing your password
We may decide that doing a little more to secure remote access is worthy investment, but we dont want to go crazy. Here are some of the things we could do
Limited range of IPs allowed – Use a firewall (IPTables typically) to only allow a few IP addresses access to port 22. This assumes you will always connect from one of these IPs and never need to admin the box from anywhere else
Automated, proactive, blocking of rouge IPs – If we need to make sure that we can admin the box from anywhere (lets say we travel a lot and dont wont to limit access down to a few IPs) we could use tools that watch for, and react to, brute force password atempts.
The two programs I would recommend here are Fail2ban which looks at your logs and if it sees a certain number of failed password attempts will add a firewall rule to block the source IP and DenyHosts which does a similar job but instead of adding a firewall rule, the source IP is added to /etc/hosts.deny. The nice thing about Deny Hosts is that it gives you the ability to sync your entries with other peoples. Lets face it, if someone is brute forcing your box, they are almost certainly doing it to soemone elses as well. There is nothing stopping you using both Fail2ban and DenyHosts at the same time for a belt and braces approach.
Pros – this is much more secure, you have heavily restricted the number of users pounding on your box, while allowing yourself the ability to admin the box
Cons – takes a little more work to setup and you could potentially lock your own IP address out if you are not careful
Higher Security Approach
So we have decided that security of our box is very important and so we are going to go put extra affort into securing it.
Limit to SSH Keys only – we can disable the ability to logon using a username and password full stop, limiting it to SSH Keys only. This means that even though the port may be open to the world, its imune to password brute forcing. You could combine this with the “Restricting Access” approach if you want to go the extra step.
Pros – you have elimated the attackers ability to bruteforce/guess your password, drastically reducing your exposure to a breach
Cons – requires that you have with you the coresponding SSH key when you need to access your server
No matter what, you just arent comfortable with the admin port being visable, you want to retain the ability to remotle admin the box but you dont even want people to be able to see or connect to the admin port. Sound impossible? Not so, we can use one of these two methods to make this happen.
First off is Port Knocking. This means that port 22 is totally firewalled off until the box receives a certain sequence of packets to a predefined set of ports – so maybe the sequence is tcp/6880, udp/3399, tcp/8881 – if the box receives these packets in this sequence then it will open port 22 to the source address for a limited time – at which point you connect.
The downside of this for the ultra paranoid is that if someone sniffs the network at the same time that you send the sequence, then they know you sequence and could replay them and enable visibility to port 22 for themselves. This is where the second approach comes in – SPA
SPA or single pack authentication evolved from port knocking. It addresses the weaknesses (capture and replay) and adds some functionality. In a nutshell you send a single packet to your server with an encrypted payload that describes what you want to do. So for example you may say that you want to enable port 22 on server x and port 2222 on server y – this request is encrypted and sent to the server. The server receives the SPA packet and, if you have used the correct password to encrypt it, decrypts the contents and acts on them. It is imune to a replay attack as the the contents of the packet have a timestamp included in the encrypted payload. I really like this approach and use it to gain access to my home network.
The software I use to do this is called FWKnop and more information can be found here
Pros – you are as secure as is humanly possible, it doesnt get more secure than this unless you disconnect it from the internet and bury it in a bunker
Cons – you need to have the client software installed on the machine you want to admin from, in order to send the SPA packet
if you feel I have missed anyting off, made mistakes or just want to let me know about your methods of securing remote access – please use the comments box to give me your feedback
Next we should probably think about installing a HIDS but I will save that for a future post