1. Switch to Root and Install sudo
Become root:
su
Install sudo:
apt install sudo
Reboot:
sudo reboot
Verify sudo:
sudo -V
2. User and Group Management
Create a new user:
sudo adduser <login>
Create a new group:
sudo addgroup user42
Check group list:
getent group user42
Add a user to a group:
sudo adduser <username> <groupname>
Example:
sudo adduser gemartin user42
sudo adduser gemartin sudo
Verify membership:
getent group sudo
getent group user42
3. Install and Verify OpenSSH Server
Install:
sudo apt install openssh-server
Check SSH status:
sudo service ssh status
4. SSH Configuration Hardening
4.1 Modify /etc/ssh/sshd_config (Server-side)
Become root:
su
Open config:
nano /etc/ssh/sshd_config
Change SSH port:
Find: %red%#Port 22%%
Replace: %green%Port 4242%%
Disable root login:
Find: %red%#PermitRootLogin prohibit-password%%
Replace: %green%PermitRootLogin no%%
Save and exit.
4.2 Modify /etc/ssh/ssh_config (Client-side)
Open client config:
nano /etc/ssh/ssh_config
Change port:
Find: %red%#Port 22%%
Replace: %green%Port 4242%%
Save and exit.
5. Restart and Verify SSH Service
Restart SSH:
sudo service ssh restart
Check status:
sudo service ssh status
6. Install UFW package
sudo apt install ufw
sudo ufw enable
7. Allow SSH Port in Firewall
sudo ufw allow 4242
sudo ufw status
8. Sudo Policies
Create config file + log directory:
touch /etc/sudoers.d/sudo_config
mkdir /var/log/sudo
nano /etc/sudoers.d/sudo_config
Add these lines:
Defaults passwd_tries=3
User gets only 3 attempts.
Defaults badpass_message="Custom error message"
Shown on wrong password.
Defaults logfile="/var/log/sudo/sudo_config"
Logs sudo failures.
Defaults log_input, log_output
Records command input/output.
Defaults iolog_dir="/var/log/sudo"
Directory for I/O logs.
Defaults requiretty
Requires sudo in a terminal.
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"
Allowed PATH for sudo.
View the main sudo log:
sudo cat /var/log/sudo/sudo_config
9. Password Policy
9.1 Password aging
Open:
nano /etc/login.defs
Set:
PASS_MAX_DAYS 30
PASS_MIN_DAYS 2
PASS_WARN_AGE 7
9.2 Password complexity
Install module:
sudo apt install libpam-pwquality
Edit file:
nano /etc/pam.d/common-password
Add rule:
minlen=10 ucredit=-1 dcredit=-1 lcredit=-1 maxrepeat=3 reject_username difok=7 enforce_for_root
Meaning:
minlen=10 Minimum length
ucredit=-1 Requires uppercase
dcredit=-1 Requires number
lcredit=-1 Requires lowercase
maxrepeat=3 Prevents repetition
reject_username Blocks username
difok=7 Must differ by 7 chars
enforce_for_root Applies to root
9.2 Crontab
sudo crontab -u root -e
@reboot sleep 30 && /usr/local/bin/monitoring.sh
*/10 * * * * sh /usr/local/bin/monitoring.sh
* * * * * sh /usr/local/bin/monitoring.sh
Created by
aben-sal
https://profile-v3.intra.42.fr/users/aben-sal