3

By default, Ubuntu Server is not very secure:

  1. Automatic security updates are not enabled
  2. The 'ufw' firewall is not enabled
  3. SSH key-based logins have to be explicitly created
  4. and so on...

For my own personal use, I have followed guides such as http://hardenubuntu.com/ to turn on unattended-upgrades, install fail2ban, etc. But now I am running a business in the cloud and don't want to repeat all these steps manually every time I spin up a new instance. Is there an Ubuntu distro/variant that comes with "production-ready" security and doesn't need to be manually hardened? Solutions using configuration management tools (Chef, Puppet, Ansible, etc) will also work.

And if there is NOT such a thing, why not?

10
  • 2
    And if there is NOT such a thing, why not? For the obvious reason that nobody bothered to. You could.
    – muru
    Dec 6 '15 at 19:48
  • I could. But if I'm the ONLY person who sees this as a huge, unfilled niche... I'm probably approaching something wrong. Dec 6 '15 at 19:53
  • I don't use half those things lol. Tyy RHEL + kickstart
    – Panther
    Dec 6 '15 at 19:57
  • 1
    @WilliamHilton The Security Team has to establish a balance. Consider: an offline server used for internal storage only not connected to outside lines can't get the updates automatically. 'ufw' being enabled automatically defeats the purpose of out of the box functions - you have to still configure the firewall. Key auth can't be set up on install - how would you add the key if the person adding it is offsite?
    – Thomas Ward
    Dec 6 '15 at 21:47
  • To some extend there's also admin responsibility. System administrator can decide by themselves what to harden , what to leave like it is. Dec 6 '15 at 22:48
5

If you're looking for these features you need to use the Ubuntu Cloud image instead of the traditional server image.

  1. Security updates are turned on by default and new images are published every few weeks with the updates rolled in.
  2. In cloud environments the networking is usually restricted out of the box, but if you want to use ufw you can turn it on.
  3. The cloud images only accept login via ssh, you can use cloud-init to create/use whatever keys as well as user data if you'd like: https://help.ubuntu.com/community/CloudInit

From your comments it looks like you want to automate your deployment with Ansible. Ansible and cloud-init is a popular pattern in the cloud, there are lots of guides on how to do that, here's one as a start:

Here are a bunch of examples of configuration for cloud-init that you can use to derive custom configs of your own:

6
  • +1 to here, though I didn't point at the cloud images 'cause I forgot about them AND because they talk about the installer images, not necessarily Cloud setups.
    – Thomas Ward
    Dec 7 '15 at 0:51
  • Hmm. The Cloud Images are definitely what I want! Unfortunately, Digital Ocean doesn't support uploading custom images. I'm not sure what image Digital Ocean uses as their basis, maybe it is Ubuntu Cloud images. I guess I'll just roll my own provisioning to set up security. Dec 7 '15 at 1:03
  • @WilliamHilton They probably use a customized image for their purposes. But note that SSH isn't enabled by default in standard server images (except for cloud images and VPS-geared images), etc. and if SSH were key-auth-on-setup you couldn't configure it :p
    – Thomas Ward
    Dec 7 '15 at 1:08
  • 1
    You wouldn't use a custom image on DO, you'd use cloud init to make all the changes you want to the stock image, here's an example: digitalocean.com/community/tutorials/… Dec 7 '15 at 1:09
  • except for cloud images and VPS-geared images See my original question, "But now I am running a business in the cloud and don't want to repeat all these steps manually every time I spin up a new instance." :) Dec 7 '15 at 2:45
2

There is no such version of the Server installer, nor the Desktop installers, because it would be detrimental to administration to have something 'completely locked down' upon installation.

As I understand it, this is because the delicate balance of "Ease of Setup/Use" and "Lock It All Down" is a very delicate one.

As I understand it...

  • The system doesn't enable automatic updates automatically because to do so could compromise stability.
  • Enabling ufw automatically is annoying to sysadmins who want things to 'work out of the box' and then want to lock down the firewall rules after things work the way they want (this is MOST security-centric server administrators, by thew ay).
  • Forcing keys to be generated immediately upon installation is a no-no, because setting up such keys usually needs the other system to generate them first. To enforce key auth immediately would likely block the ability to set up that type of key authentication.

Consider also that Security is an ongoing process - starting with a relatively 'okay' setup and then locking down things accordingly with your security policy needs and such is a better approach than having something totally locked down and then having to 'remove' security constraints as time goes forward.

There is also a configuration process - consider that if we as sysadmins have to break down security on a machine just to set it up and then re-secure it, it saves time to go the opposite direction - configure the systems first, then lock it down. This is the typical approach to administration/security...

Note that I am not a member of the Ubuntu Security Team, but this is the most likely reason for the approach in place now, using your specific examples here.

2
  • I just feel like this caters to one-off types of "server installs" rather than to those of us making dynamic cloud-based systems where the server is just another "app" that gets created and destroyed as needed. I just want a good starting image for running my provisioning scripts. Dec 7 '15 at 0:48
  • @WilliamHilton So create your own image. Set up a system to the requirements you have, and then use that as the cloud image for your provisioning. I would NOT suggest the creation of a hardened installer image, especially for cloud applications, because of the nature of those applications and systems. If you have specialized needs, create your own image. Good security practice in organizations is approached the same way. Or, use the Official Cloud Images, rather than the standard installer images.
    – Thomas Ward
    Dec 7 '15 at 0:49
1

Automatic security updates are not enabled

Automatic security updates are not generally seen as a good practice for a production environment because they can result in unexpected downtime. In a production environment you'd schedule updates so you can notify users/clients and deal with the rare scenario where an update breaks configuration.

The 'ufw' firewall is not enabled

In most cases you need to manually set up a firewall like ufw; it is not usually possible to have an "automatically" configured firewall that provides significant benefit.

The benefit from a system level firewall like ufw is to limit the ability of rogue processes, or even known processes, to communicate with the outside world. Each person's definition of which processes should be able to communicate with the outside world will be different. If an automatically configured firewall was too conservative, this would create headaches when users install software and want that software to be able to access the internet.

SSH key-based logins have to be explicitly created

I can't think of a mechanism where the remote user (client) could be securely given a private key by an automated process. Also, it would need to somehow verify that the client machine received the private key before turning off password based login.

4
  • This is NOT a debate about defaults. This is a query about how to configure Ubuntu server automatically. (See cloud image discussion in comments above.) Dec 7 '15 at 2:40
  • Perhaps you could update your question to clarify this. Dec 7 '15 at 2:46
  • Your question appears to be criticising Ubuntu for not setting up any of this as a default, and then goes on to ask why there is no other flavor/derivative of Ubuntu that does have these as defaults. My answer doesn't address the "other derivatives" part, but it did address why these aren't the defaults and why they would not be possible, or would be a bad idea. If you specifically did not want to answers to talk about the defaults, I'd have thought you'd write the question differently. Dec 7 '15 at 2:57
  • Fair enough. I just felt like everyone was jumping to defend Ubuntu rather than actually help me. There are actually several mechanisms whereby SSH keys can be automatically generated. Digital Ocean does it via cloud-init. Vagrant does it by automatically logging in, making a new keypair and downloading the private key, logging out, logging in with the new private key, and disabling password auth. Dec 7 '15 at 3:03
1

Server environments are not for out of box deployment as they can vary greatly. The base settings that Ubuntu server comes with need to be customized for different environments. So disabling or enabling services, firewalls etc. are all subject to the need of the deployment. UFW and Key based logins are one such aspect that need to be created as per needs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.