1. Switch to Root and Install sudo

Become root:
su

Install sudo:
apt install sudo

Reboot:
sudo reboot

Verify sudo:
sudo -V

2. User and Group Management

Create a new user:
sudo adduser <login>

Create a new group:
sudo addgroup user42

Check group list:
getent group user42

Add a user to a group:
sudo adduser <username> <groupname>

Example:
sudo adduser gemartin user42
sudo adduser gemartin sudo

Verify membership:
getent group sudo
getent group user42

3. Install and Verify OpenSSH Server

Install:
sudo apt install openssh-server

Check SSH status:
sudo service ssh status

4. SSH Configuration Hardening

4.1 Modify /etc/ssh/sshd_config (Server-side)

Become root:
su

Open config:
nano /etc/ssh/sshd_config

Change SSH port:
Find: %red%#Port 22%%
Replace: %green%Port 4242%%

Disable root login:
Find: %red%#PermitRootLogin prohibit-password%%
Replace: %green%PermitRootLogin no%%

Save and exit.

4.2 Modify /etc/ssh/ssh_config (Client-side)

Open client config:
nano /etc/ssh/ssh_config

Change port:
Find: %red%#Port 22%%
Replace: %green%Port 4242%%

Save and exit.

5. Restart and Verify SSH Service

Restart SSH:
sudo service ssh restart

Check status:
sudo service ssh status

6. Install UFW package

sudo apt install ufw
sudo ufw enable

7. Allow SSH Port in Firewall

sudo ufw allow 4242
sudo ufw status

8. Sudo Policies

Create config file + log directory:
touch /etc/sudoers.d/sudo_config
mkdir /var/log/sudo
nano /etc/sudoers.d/sudo_config

Add these lines:

Defaults passwd_tries=3
User gets only 3 attempts.

Defaults badpass_message="Custom error message"
Shown on wrong password.

Defaults logfile="/var/log/sudo/sudo_config"
Logs sudo failures.

Defaults log_input, log_output
Records command input/output.

Defaults iolog_dir="/var/log/sudo"
Directory for I/O logs.

Defaults requiretty
Requires sudo in a terminal.

Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"
Allowed PATH for sudo.


View the main sudo log:
sudo cat /var/log/sudo/sudo_config


9. Password Policy

9.1 Password aging

Open:
nano /etc/login.defs

Set:
PASS_MAX_DAYS 30
PASS_MIN_DAYS 2
PASS_WARN_AGE 7

9.2 Password complexity

Install module:
sudo apt install libpam-pwquality

Edit file:
nano /etc/pam.d/common-password

Add rule:
minlen=10 ucredit=-1 dcredit=-1 lcredit=-1 maxrepeat=3 reject_username difok=7 enforce_for_root

Meaning:
minlen=10 Minimum length
ucredit=-1 Requires uppercase
dcredit=-1 Requires number
lcredit=-1 Requires lowercase
maxrepeat=3 Prevents repetition
reject_username Blocks username
difok=7 Must differ by 7 chars
enforce_for_root Applies to root

9.2 Crontab

sudo crontab -u root -e

@reboot sleep 30 && /usr/local/bin/monitoring.sh
*/10 * * * * sh /usr/local/bin/monitoring.sh
* * * * * sh /usr/local/bin/monitoring.sh


Created by

aben-sal
https://profile-v3.intra.42.fr/users/aben-sal


Edit

Pub: 12 Dec 2025 14:58 UTC

Edit: 16 Dec 2025 10:50 UTC

Views: 35