Securing a Fresh CentOS 7 Server

Securing the I.T infrastructure is essential to protect us or our data.
I don’t say this is the best way to secure CentOS 7 server, even the most hardened CentOS 7 can be breached, if I have miss-configured or I’m wrong, please let me know.
Password
- Use a minimum password length of 12 to 14 characters, if permitted.
- Include lowercase and uppercase alphabetic characters, numbers, and symbols.
- Avoid character repetition, keyboard patterns, dictionary words, letter or number sequences, usernames, relative or pet names, romantic links etc.
- Avoid using information that is or might become publicly associated with the user or the account.
Keep the system updated
[root@localhost ~]# yum update -y
Users
Let’s create a new user.
[root@localhost ~]# useradd robert00421
[root@localhost ~]# passwd robert00421
Changing password for user robert00421.
New password:
Retype new password:
Give SUDO permission to the user.
[root@localhost ~]# visudo
Add the line after the line root ALL=(ALL:ALL) ALL:
robert00421 ALL=(ALL) ALL
SSH
modify the configuration file.
[root@localhost ~]# vi /etc/ssh/ssh_config
Use a non-standard port.
Port 2494
Disable SSH root access.
#PermitRootLogin yes
#PasswordAuthentication no
Limit maximum authentication tries.
#LoginGraceTime 5m
#MaxAuthTries 3
Create an SSH banner.
[root@localhost ~]# vi ssh_banner
Create a banner according to your standard.
Add the following lines.
WARNING: Unauthorized access to this system is forbidden and will be
prosecuted by law. By accessing this system, you agree that your actions
may be monitored if unauthorized usage is suspected.
And change the banner path.
[root@localhost ~]# vi /etc/ssh/ssh_config
#Banner /root/ssh_banner
Modify the MOTD.
[root@localhost ~]# vi /etc/motd
Add the following lines.
WARNING: Unauthorized access to this system is forbidden and will be
prosecuted by law. By accessing this system, you agree that your actions
may be monitored if unauthorized usage is suspected.
Limit SSH users logins.
[root@localhost ~]# echo "AllowUsers admin robert00421" >> /etc/ssh/sshd_config
Allow the SSH new port to the firewall.
[root@localhost ~]# firewall-cmd --add-port 2494/tcp
success
[root@localhost ~]# firewall-cmd --add-port 2494/tcp --permanent
success
Restart SSH daemon.
[root@localhost ~]# systemctl restart sshd
Fail2ban
Install the fail2band.
[root@localhost ~]# yum install epel-release -y
[root@localhost ~]# yum install fail2ban -y
Make a copy of the jail.conf file and save it with the name jail.local
[root@localhost ~]# cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
Create a *.local file according to your organization standard.
[root@localhost ~]# vi /etc/fail2ban/jail.d/sshd.local
Add the following lines.
[sshd]
enabled = true
port = ssh
#action = firewallcmd-ipset
logpath = %(sshd_log)s
maxretry = 5
bantime = 86400
Restart fail2ban services.
[root@localhost ~]# systemctl restart fail2ban
Check the status of fail2ban jails.
[root@localhost jail.d]# fail2ban-client status
Status
|- Number of jail: 1
`- Jail list: sshd
Networking
Turn off IPV6.
[root@localhost ~]# sysctl -w net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.all.disable_ipv6 = 1
[root@localhost ~]# sysctl -w net.ipv6.conf.default.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6 = 1
To make settings effective.
sysctl -p
Turn off IPV6.
[root@localhost ~]# vi /etc/sysconfig/network
Add the following lines.
NETWORKING_IPV6=no
IPV6INIT=no
Ignore ICMP or broadcast request.
[root@localhost ~]# vi /etc/sysctl.conf
Add the following lines.
Ignore ICMP request:
net.ipv4.icmp_echo_ignore_all = 1
Ignore Broadcast request:
net.ipv4.icmp_echo_ignore_broadcasts = 1
Firewalling
Accept all incoming SSH.
[root@localhost ~]# iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 2494-j ACCEPT
Drop all incoming SSH.
[root@localhost ~]# iptables -A INPUT -p tcp --dport 2494-j DROP
Save the changes.
[root@localhost ~]# iptables-save
then reboot.
[root@localhost ~]# reboot
I don’t mention all other things that need to secure, because my goal on this blog is to secure fresh install CentOS 7 server and no services running yet.
Thanks for reading, if I’m wrong please let me know by sending me an email on canarerobertjohn@gmail.com