0

noticed some ssh attempts to login to my server, did some research and configured fail2ban for my server which is working great, also set up mail notification as soon as user is blocked. i have noticed quite a few notification for users blocked, each with different IP. i am sure these are all automated and not like a physical user sitting there trying to brute force my server, my question is how can i make the server more secure? i have disabled the root account and there is only 1 named account on the server i am using with root privileges to maintain the server. i configured ssh keys previously but disabled this again because i am scared i will lock myself out of my server as i am the only one managing it. any suggestions would be appreciated.

  • 1
    This can be controversial, but you could move ssh to a different port. I did that, and it cut the automated attacks down to basically zero. You set this up by configuring your router to forward the port you choose to port 22 on your server. – Organic Marble Oct 28 '16 at 13:24
  • 1
    that sure did the trick, i didn't have any attempts on my server since ports changed. thank you! – Jan Peeter Nov 1 '16 at 8:31
1

I believe Lynis is probably the answer you are looking for.

It is easy to install and run. It will audit your system and provide a score out of 100 along with specific suggestions on how to better secure your operating system:

https://cisofy.com/lynis/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.