Essential Security Hardening Steps for Your CentOS VPS

#### Prerequisites Before you begin, ensure you have: - A CentOS VPS (This guide is tested with CentOS 8) - A user account with sudo privileges - Basic familiarity with the command line #### Step 1: Update Your System Keeping your system up-to-date is crucial for security. Start by updating all packages: ```bash sudo dnf update -y ``` #### Step 2: Create a New User Avoid using the root account for daily tasks. Create a new user and grant them sudo privileges: ```bash sudo adduser new_username sudo passwd new_username sudo usermod -aG wheel new_username ``` Replace `new_username` with your desired username. #### Step 3: Secure SSH **Disable root login and change the SSH port to reduce brute-force attack risks.** Open the SSH configuration file: ```bash sudo nano /etc/ssh/sshd_config ``` Find and modify these lines: ``` #Port 22 #PermitRootLogin yes ``` Uncomment and change them to: ``` Port 2222 PermitRootLogin no ``` Save and exit the file, then restart SSH: ```bash sudo systemctl restart sshd ``` **Allow the new SSH port in your firewall settings:** ```bash sudo firewall-cmd --permanent --add-port=2222/tcp sudo firewall-cmd --reload ``` **Use SSH key authentication for added security:** Generate an SSH key pair on your local machine: ```bash ssh-keygen -t rsa -b 2048 ``` Copy the public key to your VPS: ```bash ssh-copy-id -i ~/.ssh/id_rsa.pub your_username@your_server_ip ``` Edit the SSH configuration file to disable password authentication: ```bash sudo nano /etc/ssh/sshd_config ``` Set `PasswordAuthentication` to `no`: ```plaintext PasswordAuthentication no ``` Save and exit the file, then restart SSH: ```bash sudo systemctl restart sshd ``` #### Step 4: Configure the Firewall Enable and configure `firewalld` to manage your firewall settings: Start and enable `firewalld`: ```bash sudo systemctl start firewalld sudo systemctl enable firewalld ``` Allow essential services: ```bash sudo firewall-cmd --permanent --add-service=ssh sudo firewall-cmd --permanent --add-service=http sudo firewall-cmd --permanent --add-service=https sudo firewall-cmd --reload ``` #### Step 5: Install Fail2Ban Fail2Ban helps protect your server from brute-force attacks: ```bash sudo dnf install epel-release -y sudo dnf install fail2ban -y ``` Start and enable Fail2Ban: ```bash sudo systemctl start fail2ban sudo systemctl enable fail2ban ``` Configure Fail2Ban by editing its main configuration file: ```bash sudo nano /etc/fail2ban/jail.local ``` Add the following content: ```plaintext [DEFAULT] bantime = 3600 findtime = 600 maxretry = 5 [sshd] enabled = true port = 2222 ``` Save and exit the file, then restart Fail2Ban: ```bash sudo systemctl restart fail2ban ``` #### Step 6: Install and Configure SELinux Security-Enhanced Linux (SELinux) provides an additional layer of security: Check the status of SELinux: ```bash sestatus ``` If SELinux is not enabled, edit the configuration file: ```bash sudo nano /etc/selinux/config ``` Ensure the following line reads: ```plaintext SELINUX=enforcing ``` Save and exit the file, then reboot your system: ```bash sudo reboot ``` #### Step 7: Set Up Automatic Updates Enable automatic updates to ensure your system is always up-to-date: Install `dnf-automatic`: ```bash sudo dnf install dnf-automatic -y ``` Enable and start the timer: ```bash sudo systemctl enable --now dnf-automatic.timer ``` #### Step 8: Monitor Your System Use tools like `auditd` to monitor and log security-related events: Install `auditd`: ```bash sudo dnf install audit -y ``` Start and enable `auditd`: ```bash sudo systemctl start auditd sudo systemctl enable auditd ``` #### Step 9: Configure Logwatch Logwatch provides detailed reports on your server's logs: Install Logwatch: ```bash sudo dnf install logwatch -y ``` Configure Logwatch to send daily email reports: Edit the Logwatch configuration file: ```bash sudo nano /etc/cron.daily/0logwatch ``` Ensure it includes: ```plaintext #!/bin/bash /usr/sbin/logwatch --output mail --mailto your_email@example.com --detail high ``` Replace `your_email@example.com` with your actual email address. Save and exit the file. #### Conclusion By following these essential security hardening steps, you have significantly improved the security posture of your CentOS VPS. Regularly review and update your security settings to stay protected against emerging threats. **Additional Resources:** - **CentOS Documentation:** [https://www.centos.org/docs/](https://www.centos.org/docs/) - **SELinux Documentation:** [https://selinuxproject.org/page/Main_Page](https://selinuxproject.org/page/Main_Page) - **Fail2Ban Documentation:** [https://www.fail2ban.org/wiki/index.php/Main_Page](https://www.fail2ban.org/wiki/index.php/Main_Page)