1. SSH lockdown
- Disable root login:
PermitRootLogin no - Force key-only auth:
PasswordAuthentication no - Schimba portul default 22 → 2222 (reduce 99% scan zgomot)
- Fail2ban cu jail sshd (maxretry 3, bantime 24h)
- 2FA cu Google Authenticator (PAM module)
2. Firewall iptables / nftables
- Default DROP pe INPUT, ACCEPT doar pe porturile necesare
- GeoIP filtering: blocheaza tarile de unde NU ai trafic legitim
- Rate limiting per IP (limit-burst 10/min)
- Logging connection attempts in jurnal separat
3. CrowdSec (alternativa moderna la fail2ban)
Comunitate distribuita de threat intelligence. Detecteaza atacuri (SSH, HTTP, FTP) si sincronizeaza IP-uri rele global. Mai inteligent decat fail2ban static.
4. Automatic security updates
unattended-upgrades cu config strict pentru security only. Notificari email la upgrade-uri.
5. CIS Benchmark + Lynis audit
Ruleaza Lynis lunar: lynis audit system. Aim pentru hardening score > 80. Apply manual fixes pentru issue-urile high.
6. AppArmor / SELinux
Debian: AppArmor enabled by default. Profile pentru aplicatii sensibile (nginx, mysql).
7. File integrity monitoring
AIDE sau Tripwire — alertare la modificari binare critice.
8. Centralized logging
Trimite syslog la SIEM Wazuh / Graylog. Retentie 90 zile minim pentru audit forensic.
Comenzi de baza
Cateva comenzi concrete cu care incepi hardening-ul imediat:
# SSH lockdown + fail2ban (comenzi reale)
sudo sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo systemctl reload ssh
sudo apt -y install fail2ban unattended-upgrades
sudo systemctl enable --now fail2ban
sudo lynis audit system # scor de hardeningHardening kernel (sysctl)
Cateva setari sysctl care reduc suprafata de atac la nivel de retea si kernel:
cat >/etc/sysctl.d/99-hardening.conf <<'EOF'
net.ipv4.conf.all.rp_filter=1
net.ipv4.tcp_syncookies=1
net.ipv4.conf.all.accept_redirects=0
net.ipv4.conf.all.accept_source_route=0
kernel.randomize_va_space=2
kernel.kptr_restrict=2
fs.protected_hardlinks=1
fs.protected_symlinks=1
EOF
sysctl --systemIntegritate fisiere (AIDE) + audit (auditd)
Initializezi baza AIDE si pui reguli auditd pentru fisierele critice:
apt -y install aide auditd
aideinit && mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db
aide --check # ruleaza zilnic din cron
# audit pe fisiere sensibile
auditctl -w /etc/passwd -p wa -k identity
auditctl -w /etc/ssh/sshd_config -p wa -k sshd
ausearch -k identity | tailAppArmor: profil in enforce
Izolezi un serviciu cu AppArmor in mod enforce:
apt -y install apparmor-utils
aa-status # ce profile sunt incarcate
aa-enforce /etc/apparmor.d/usr.sbin.nginx
aa-logprof # ajustezi din denials reale
journalctl -k | grep apparmor='DENIED'2FA la SSH + update-uri automate
Adaugi cod TOTP la SSH si pornesti update-urile de securitate automate:
apt -y install libpam-google-authenticator unattended-upgrades
google-authenticator # ca user: scanezi QR in app
# /etc/pam.d/sshd: auth required pam_google_authenticator.so
# /etc/ssh/sshd_config: AuthenticationMethods publickey,keyboard-interactive
dpkg-reconfigure -plow unattended-upgrades
systemctl reload ssh