How to Secure Your Linux Server from Emerging Cyber Attacks

February 13, 2023 by , in Blog Linux

In today’s world, cybersecurity has become a crucial factor in safeguarding online assets against emerging cyber threats. This is especially true for Linux servers, which are often targeted by cybercriminals due to their popularity and widespread use.

In this blog post, we will cover seven essential tips for securing your Linux server against cyber attacks. These tips include installing the latest security updates, configuring firewalls, using strong passwords, enabling two-factor authentication, configuring security settings, using encryption, and regularly backing up your data.

With cybersecurity threats on the rise, it’s essential to take proactive measures to ensure the safety and security of your online assets, and these tips can help you do just that. So, whether you’re a Linux server administrator, a small business owner, or an individual user, prioritize cybersecurity and take all necessary steps to keep your online assets safe and secure.

Let’s discuss some essential steps that can be taken to secure a Linux server against cyber threats.

  1. Keep Your Software Up to Date – One of the most important things you can do to protect your Linux server is to keep your software up to date. This includes the operating system, applications, and any other tools or services that are running on your server. By keeping everything up to date, you can ensure that any vulnerabilities or weaknesses in your system are addressed promptly and effectively.
  2. Use a Firewall – A firewall is a software or hardware tool to control network traffic and block unauthorized access to your server. By configuring a firewall, you can prevent hackers and other malicious actors from gaining access to your system, and you can also limit the amount of traffic that is allowed to enter and exit your network.
  3. Use Strong Passwords – Strong passwords are another essential step in securing your Linux server. Using a combination of letters, numbers, and special characters, you can create passwords that are difficult to guess or crack. You should also consider using a password manager to keep track of your passwords and ensure they are unique and secure.
  4. Enable Two-Factor Authentication – Two-factor authentication is a security feature that requires users to provide two forms of identification before they can access a system. This can include a password and a code sent to their phone or email. By enabling two-factor authentication on your Linux server, you can add an extra layer of security and protect against unauthorized access.
  5. Configure Security Settings – Configuring security settings on your Linux server is another important step in securing it against cyber threats. This includes things like disabling unnecessary services, limiting user access, and setting up logging and monitoring tools to track the activity on your system. By configuring these settings, you can make it more difficult for hackers to gain access to your system, and you can also detect and respond to security incidents more quickly.
  6. Use Encryption – Encryption is another important step in securing your Linux server. Encryption is the process of encoding information so only authorized parties can access it. Encryption can protect sensitive data and ensure that it is not accessible to hackers or other unauthorized users.
  7. Regularly Backup Your Data – Regularly backing up your data is an essential step in securing your Linux server. By creating backups of your important data, you can protect against data loss due to cyber-attacks or other incidents. You should consider using an off-site backup service to ensure that your data is protected even if your server is compromised.

 

Analysis of authentication log files in an operating system. Ssh connection through a terminal to test intrusion in an operating system. Two terminal sessions open for comparison

Keep Your Software Up to Date

There are several reasons why keeping your software up to date is an important step in securing your Linux server against emerging cybersecurity threats:

  1. Security vulnerabilities: Software vulnerabilities are discovered on a regular basis, and the longer you use an outdated version of a software, the more vulnerable you are to these vulnerabilities. Attackers can exploit these vulnerabilities to gain unauthorized access to your server, steal your data, or launch a DDoS attack.
  2. Bug fixes: Updating your software is also important for fixing bugs and improving the stability of your system. Bugs can cause your server to crash, corrupt your data, or cause other issues that can lead to downtime.
  3. Performance: Newer versions of software often include performance improvements that can help your server run faster and more efficiently. This can be especially important for servers that are handling a large amount of traffic or data.
  4. Compatibility: Keeping your software up to date ensures that it is compatible with other software and hardware on your system. Outdated software can cause compatibility issues that can lead to downtime and other issues.
  5. Compliance: In some industries, such as healthcare and finance, there are regulations that require organizations to keep their software up to date. Failure to comply with these regulations can result in fines and other penalties.

It’s important to regularly check for updates and apply them as soon as possible to keep your server secure and running smoothly. As such, here are detailed instructions on how to keep your Linux software up to date on the major Linux distributions:

Debian/Ubuntu

To update your Debian or Ubuntu Linux server, open a terminal window and run the following command:

sudo apt-get update && sudo apt-get upgrade

This will update the package lists and then upgrade any installed packages to the latest version. If you want to upgrade the distribution to the latest version, use the following command instead:

sudo do-release-upgrade

This will prompt you to upgrade your distribution to the latest version. Also, read How to Enable Unattended Upgrades on Ubuntu/Debian.

CentOS/RHEL/Fedora

To update your CentOS, RHEL, or Fedora Linux server, open a terminal window and run the following command:

sudo dnf update

This will update all installed packages to the latest version. If you are using an older version of CentOS or RHEL, you may need to enable the EPEL repository to get the latest versions of some packages. Also, read Enable Automatic Updates – Fedora/Red Hat + Bonus Tip.

Arch Linux

To update your Arch Linux server, open a terminal window and run the following command:

sudo pacman -Syu

This will update all installed packages to the latest version.

SUSE/OpenSUSE

To update your SUSE or OpenSUSE Linux server, open a terminal window and run the following command:

sudo zypper update

This will update all installed packages to the latest version.

 

An abstract design of a terminal display, warning about a cyber attack.

Use a Firewall

Using a firewall is an essential part of securing your Linux server against emerging cybersecurity threats. Here are some reasons why using a firewall is important:

  1. Protection against network attacks: A firewall helps protect your server from network-based attacks by controlling the flow of traffic to and from your server. It can prevent unauthorized access to your server and block malicious traffic, such as denial-of-service (DoS) attacks.
  2. Control access to services: With a firewall, you can control which services are accessible from the outside world. For example, you can allow traffic on port 80 for web traffic while blocking traffic on port 22 for SSH access. This helps to minimize the attack surface of your server.
  3. Restrict access to specific IPs or networks: You can use a firewall to restrict access to your server to specific IP addresses or networks. This is useful if you only want to allow access from trusted sources, such as your office network or a specific IP address.
  4. Monitor network activity: A firewall can also be used to monitor network activity and log incoming and outgoing traffic. This can help you identify suspicious activity and take corrective action before it becomes a security issue.
  5. Compliance: In some industries, such as healthcare and finance, some regulations require organizations to use a firewall to protect sensitive data. Compliance with these regulations is important to avoid fines and other penalties.

It is important to configure your firewall properly and keep it up to date to ensure the maximum level of protection. here are detailed instructions on how to use a firewall on the major Linux distributions:

Debian/Ubuntu

Debian and Ubuntu use the UFW (Uncomplicated Firewall) by default. To enable and configure UFW, open a terminal window and run the following commands:

sudo apt-get update
sudo apt-get install ufw
sudo ufw enable

To allow incoming traffic for specific ports, use the following command:

sudo ufw allow <port>/<protocol>

For example, to allow incoming SSH traffic, use the following command:

sudo ufw allow 22/tcp

To block incoming traffic for specific ports, use the following command:

sudo ufw deny <port>/<protocol>

For example, to block incoming HTTP traffic, use the following command:

sudo ufw deny 80/tcp

CentOS/RHEL/Fedora

CentOS, RHEL, and Fedora use the firewalld firewall by default. To enable and configure firewalld, open a terminal window and run the following commands:

sudo systemctl start firewalld
sudo systemctl enable firewalld

To allow incoming traffic for specific ports, use the following command:

sudo firewall-cmd --zone=public --add-port=<port>/<protocol> --permanent

For example, to allow incoming SSH traffic, use the following command:

sudo firewall-cmd --zone=public --add-port=22/tcp --permanent

To block incoming traffic for specific ports, use the following command:

sudo firewall-cmd --zone=public --remove-port=<port>/<protocol> --permanent

For example, to block incoming HTTP traffic, use the following command:

sudo firewall-cmd --zone=public --remove-port=80/tcp --permanent

Arch Linux

Arch Linux uses the firewalld firewall by default. To enable and configure firewalld, open a terminal window and run the following commands:

sudo pacman -S firewalld
sudo systemctl start firewalld
sudo systemctl enable firewalld

To allow incoming traffic for specific ports, use the following command:

sudo firewall-cmd --zone=public --add-port=<port>/<protocol> --permanent

For example, to allow incoming SSH traffic, use the following command:

sudo firewall-cmd --zone=public --add-port=22/tcp --permanent

To block incoming traffic for specific ports, use the following command:

sudo firewall-cmd --zone=public --remove-port=<port>/<protocol> --permanent

For example, to block incoming HTTP traffic, use the following command:

sudo firewall-cmd --zone=public --remove-port=80/tcp --permanent

SUSE/OpenSUSE

To set up a firewall on a SUSE or OpenSUSE Linux server, you can use the SuSEfirewall2 tool. Open a terminal window and run the following command to install SuSEfirewall2:

sudo zypper install SuSEfirewall2

Once SuSEfirewall2 is installed, you can enable it with the following command:

sudo systemctl enable SuSEfirewall

Also see, en.opensuse.org/SuSEfirewall2

 

Use Strong Passwords

Passwords are the primary line of defense against unauthorized access, and a weak password can easily be guessed or cracked by attackers using automated tools. Here are some reasons why using strong passwords is crucial for server security:

  1. Password cracking: Attackers can use various methods to crack weak passwords, including brute-force attacks, dictionary attacks, and rainbow table attacks. If your password is too short or too simple, it can be cracked in a matter of minutes, giving the attacker unrestricted access to your server.
  2. Password reuse: Many users tend to reuse the same password across multiple accounts, making it easier for attackers to gain access to multiple systems with just one compromised password. By using unique and strong passwords for each account, you can prevent this type of attack.
  3. Social engineering: Attackers can use social engineering tactics to trick users into revealing their passwords. For example, they may send phishing emails or create fake login pages that look like legitimate ones. Strong passwords make it harder for attackers to guess or obtain them through social engineering.
  4. Compliance requirements: Many regulatory frameworks require organizations to use strong passwords and enforce password policies. Failing to comply with these requirements can result in fines, legal action, or damage to the organization’s reputation.

Overall, using strong passwords is a simple yet effective way to improve the security of your Linux server. It’s important to choose passwords that are long, complex, and unique to each account and to change them regularly to prevent them from being compromised. By following good password practices, you can reduce the risk of unauthorized access to your server and protect your data and resources from cyber threats.

On all major Linux distros you can use ‘pwgen’. Pwgen is a small command-line utility that is available on Linux systems. It is used to generate random, strong passwords that can be used to secure user accounts, system services, and other resources on a Linux server.

Pwgen generates passwords that are difficult to guess or crack using a combination of random characters, numbers, and symbols. It allows users to specify the password length, the type of characters to include, and the number of passwords to generate. Pwgen can also be used to generate passphrases, which are longer and more complex passwords that are made up of multiple words.

To use pwgen on Linux, you can simply open a terminal window and type the “pwgen” command, followed by any parameters or options you want to use. For example, to generate a 10-character password with no symbols, you can type:

pwgen 10 -A

The generated password will be displayed on the screen, and you can copy and paste it as needed.

Personally, I use this command which I’ve found easy to remember:

pwgen -sync 16 4

 

Enabling two-factor authentication (2FA)

2FA is a security mechanism that requires users to provide two forms of authentication before accessing a system, application, or resource. Typically, this involves something the user knows (such as a password) and something the user has (such as a physical token or mobile device).

Here are some reasons why enabling 2FA is important for server security:

  1. Stronger authentication: 2FA provides a more robust form of authentication than passwords alone, making it harder for attackers to gain unauthorized access to your server. Even if an attacker manages to steal or crack a user’s password, they will still need the second factor to access the system.
  2. Protection against phishing and social engineering: 2FA can help protect against phishing and social engineering attacks, which are often used to trick users into revealing their passwords or other sensitive information. Even if a user falls for a phishing scam and enters their password into a fake login page, the attacker will still need the second factor to access the system.
  3. Compliance requirements: Many regulatory frameworks require organizations to implement 2FA for certain types of accounts or systems. Failing to comply with these requirements can result in fines, legal action, or damage to the organization’s reputation.
  4. Convenience: While 2FA adds an extra step to the authentication process, many modern 2FA solutions are designed to be user-friendly and easy to use. In many cases, users can quickly and easily authenticate using a mobile app or hardware token, without needing to remember complex passwords.

Overall, enabling 2FA is a simple yet effective way to improve the security of your Linux server. There are many 2FA solutions available, including time-based one-time passwords (TOTP), biometric authentication, and hardware tokens. By implementing 2FA, you can reduce the risk of unauthorized access to your server and protect your data and resources from cyber threats.

A useful guide for setting up Google Authenticator on Linux can be found in the Arch Linux WiKi. The steps outlined in the guide can be adapted for use on other major Linux distributions.

 

Analysis of authentication log files in an operating system. Ssh connection through a terminal to test intrusion in an operating system

Configure Security Settings

Configuring security settings is an essential step in securing your Linux server against emerging cybersecurity threats. Here are some reasons why it’s important:

  1. Reducing attack surface: By configuring security settings, you can reduce the attack surface of your server, making it less vulnerable to cyber threats. This involves disabling unnecessary services and ports, setting up firewalls, and restricting access to critical system resources.
  2. Enhancing system performance: Configuring security settings can also help improve the performance and stability of your server. By disabling unused services and limiting access to system resources, you can free up system resources and reduce the risk of system crashes or other performance issues.
  3. Meeting compliance requirements: Many regulatory frameworks require organizations to implement certain security controls to protect sensitive data and resources. By configuring security settings, you can help meet these compliance requirements and avoid costly fines and legal action.
  4. Protecting against common attacks: Configuring security settings can also help protect against common types of cyber attacks, such as denial-of-service (DoS) attacks, brute-force attacks, and malware infections. This involves setting up firewalls and intrusion detection systems, using strong encryption, and keeping software and systems up-to-date with the latest security patches.

Overall, configuring security settings is a critical step in securing your Linux server against cybersecurity threats. By taking the time to implement the right security controls and best practices, you can reduce the risk of data breaches, system downtime, and other security incidents and protect your valuable data and resources.

 

Use Encryption

Encryption is an important step in securing your Linux server against emerging cybersecurity threats. Here are some reasons why it’s important:

  1. Protecting sensitive data: Encryption helps protect sensitive data from being accessed by unauthorized users. This is particularly important for data that is transmitted over a network or stored on the server, such as login credentials, financial information, and personal data.
  2. Meeting compliance requirements: Many regulatory frameworks require organizations to use encryption to protect sensitive data. By using encryption, you can help meet these compliance requirements and avoid costly fines and legal action.
  3. Preventing data breaches: Encryption makes it much more difficult for cybercriminals to steal sensitive data, even if they manage to gain access to the server. This reduces the risk of data breaches, which can cause significant damage to your organization’s reputation and finances.
  4. Keeping data secure during transmission: Encryption helps keep data secure while it is being transmitted over a network. This is particularly important for organizations that handle sensitive data, such as credit card numbers, medical records, or personal information.
  5. Protecting against insider threats: Encryption can also help protect against insider threats by making it more difficult for employees or other users to access specific or sensitive data without authorization.

Here are some steps to follow to implement encryption on your server:

  1. Identify the sensitive data: Identify the data that needs to be encrypted. This may include login credentials, financial data, and personal information.
  2. Choose the appropriate encryption method: Choose the appropriate encryption method based on the data that needs to be protected. Common encryption methods include SSL/TLS, disk encryption, and file-level encryption.
  3. Data-at-rest_encryption – wiki.archlinux.org/title/Data-at-rest_encryption
  4. Use strong encryption algorithms: Use strong encryption algorithms, such as AES, to ensure that the data is securely encrypted. Avoid using weaker encryption methods, such as DES or RC4, which attackers can easily crack.
  5. Regularly update encryption keys: Regularly update the encryption keys to ensure that the data remains securely encrypted. This helps protect against attacks that attempt to crack the encryption by brute force.

 

Regularly Backup Your Data

Regularly backing up your data is essential to ensure business continuity and protect your organization from data loss or cyber-attacks. Here are some more details on why it’s so important:

  1. Protecting against data loss: Data loss can be caused by various factors, including hardware failure, natural disasters, and human error. If you don’t have a backup of your data, you risk losing all of it. Regular backups help ensure that you can quickly recover from data loss and minimize the impact on your business.
  2. Recovering from cyber attacks: Cyber attacks, such as ransomware or malware infections, can encrypt your data or damage your systems. Regular backups allow you to restore your systems and data to a previous state, which can be critical in preventing data loss and ensuring business continuity.
  3. Meeting compliance requirements: Many regulatory frameworks, such as GDPR or HIPAA, require organizations to have a backup and disaster recovery plan in place. Regular backups help ensure that you meet these requirements and can avoid costly fines and legal action.
  4. Protecting against insider threats: Insider threats, such as employee error or malicious intent, can result in data loss or damage. Regular backups can help protect against these threats by allowing you to restore your systems and data to a previous state.
  5. Ensuring business continuity: Business continuity is essential to maintain operations and minimize the impact on your customers and employees. Regular backups help ensure that your business can continue operating in the event of a disaster or cybersecurity incident.

To ensure that your backups are effective, follow these best practices:

  1. Choose a backup solution that meets your needs: Choose a backup solution that’s appropriate for the size and complexity of your environment. There are a variety of backup solutions available, from simple file-based backups to more complex solutions that include system images and incremental backups.
  2. Determine the frequency of backups: Determine how often you need to back up your data based on the criticality of the data and the frequency of changes. Most organizations back up data daily or weekly, but more critical data may require more frequent backups.
  3. Test backups regularly: Regularly test your backups to ensure that they are effective and can be used to restore your systems and data. This includes testing the restore process, verifying the data integrity, and validating the backups are up-to-date.
  4. Store backups off-site: Store backups in a secure, off-site location to protect against natural disasters or physical damage. This can be in the cloud or in a separate physical location.

By following these best practices and regularly backing up your data, you can protect your organization from data loss, recover from cyber attacks, meet compliance requirements, protect against insider threats, and ensure business continuity.

 

Conclusion

With cyber-attacks becoming more sophisticated and prevalent, it’s imperative to take necessary precautions to safeguard your online assets from cyber threats.

Securing a Linux server against emerging cyber threats requires a multi-layered approach. Following the steps outlined in this post, you can protect your server against cyber attacks and ensure that your data and systems are secure.

Remember to keep all software up to date, use a firewall, use strong passwords and two-factor authentication, configure server security settings, use encryption, and regularly back up your data. With these steps in place, you can be confident that your Linux server is well-protected and secure!

Tags: , , , ,

Discussion

  1. I am guilty of putting off updates and I really shouldn’t. I always make sure to use and make use of safety nets like 2FA and using long password strings but I know not updating on time is a risk. I have to get better at that and not put it off so often.

  2. Something you should never risk is security on your server. It doesn’t matter if it is Linux or not! I am always preaching this to people I work with. Even my boss is guilty of disregarding things.

    This is a great and handy guide, especially for beginners. Thank you for including different commands per distro as well.

  3. sudo do-release-upgrade

    Never Heard of that method, I always use apt-get dist-upgrade to do that. But I also run testing so when testing becomes stable and the new testing comes out I get moved to that.

  4. It’s pretty useful. The do-release-upgrade command performs the following steps:

    1. Checks the current release of Ubuntu and determines if a new release is available.
    2. If a new release is available, it downloads the necessary files for the upgrade.
    3. It prompts the user to confirm that they want to proceed with the upgrade.
    4. It begins the upgrade process, which involves installing the new release packages and updating the system configuration.
    5. Finally, it reboots the system to complete the upgrade process.

    During the upgrade process, do-release-upgrade will also provide information about configuration changes that may be required or any packages that may be removed or installed as part of the upgrade.

1 more reply



Top ↑