ltsOver9000

# Live log: ``` watch -n 1 tail -n 50 /var/log/auth.log ```

# View successful login attempts ``` last ```

# Custom rolled commands ``` # /security logs # general logs /w watch llogs # live logs ```

# Locking down SSH Server

## Whitelist and Blacklist IP addresses Stop SSH service first!

``` sudo systemctl disable ssh.service # and sudo systemctl stop ssh.service ```

to start: ``` sudo systemctl enable ssh.service # and sudo systemctl start ssh.service ```

Check for password attempts: ``` # grep “Failed password” /var/log/auth.log ``` and ``` cat /var/log/auth.log ```

###Restrict IP address (whitelist): ``` sudo nano /etc/hosts.allow ``` and add the following lines to allow the whitelisted IP blocks to your public SSH. ``` sshd: 192.168.x.x/32, … ```

###(Blacklist): ``` sudo nano /etc/hosts.deny ``` and add the following lines to deny all SSH connections to your public SSH port

``` sshd: ALL ```

1. https://www.tecmint.com/find-failed-ssh-login-attempts-in-linux/#:~:text=Each%20attempt%20to%20login%20to,cat%20command%20or%20grep%20command.
2. https://cloudcone.com/docs/article/how-to-restrict-ssh-access-only-to-specific-ips/

## Whitelist user names for login ``` sudo nano /etc/ssh/sshd_config ``` and add: ``` AllowUsers userName ```

1. https://www.oreilly.com/library/view/linux-security-cookbook/0596003919/ch03s14.html#:~:text=Discussion,listed%20cannot%20receive%20SSH%20connections.&text=means%20%E2%80%9Callow%20the%20remote%20system,to%20my%20local%20account%20user%20.%E2%80%9D

## Fail2Ban

https://blog.mypapit.net/2011/07/how-to-secure-ssh-server-from-brute-force-and-ddos-with-fail2ban-ubuntu.html

### Step 1 ``` sudo apt-get install fail2ban ``` ### Step 2: Setting up Fail2ban Next, you need to configure fail2ban by creating a copy of ‘jail.conf’ to ‘jail.local’ ``` cd /etc/fail2ban sudo cp jail.conf jail.local ```

### Step 3 Edit fail2ban configuration file using your favorite text-edito (I personally use ‘nano’) ``` sudo nano /etc/fail2ban/jail.local ``` You can set IP address for fail2ban to ignore, IP addresses can be separated by space.

Bantime is the duration of time that you want fail2ban to block suspicious attempt, the value is in seconds Maxretry is the number of failed attempts before fail2ban block the IP-address, in this case 3600 means 1-hour ban

``` # “ignoreip” can be an IP address, a CIDR mask or a DNS host ignoreip = 127.0.0.1 192.168.1.1 bantime = 3600 maxretry = 3 ```

### Step 4 Find ssh configuration under [ssh] heading, and enable it.

``` [ssh] enabled = true port = ssh filter = sshd logpath = /var/log/auth.log maxretry = 3 ``` Similarly, you can also enable [ssh-dos] protection by changing the enabled value to “enabled = true”

``` [ssh-ddos] enabled = true port = ssh filter = sshd-ddos logpath = /var/log/auth.log maxretry = 2 ``` ### Step 5 After all is done, you may save the file, and (re)start the fail2ban service ``` sudo /etc/init.d/fail2ban restart ```