3

I am going to try and set up Ghostpi, but opening my Pi up to the web could be hazardous. What should I do to secure my Pi and protect my home network?

2

This is an older question, but always a good one to ask. In addition to the advice already provided, I recommend some additional steps.

Based on observing login attempts against default user accounts (e.g. pi), I like to configure ssh to only allow specific users or groups, and limit those to pubkey authentication:

sudo addgroup --system sshusers
sudo adduser <username> 
sudo adduser <username> sshusers
sudo adduser <username> sudo
# Good idea to add this user to other necessary groups (e.g. netdev)

Configure ssh to disable root login and disable password authentication from outside networks:

sudo vi /etc/ssh/sshd_config
Port <non-default port>
PermitRootLogin no
AllowGroups sshusers
# global option no password auth 
PasswordAuthentication no
# permit password from rfc1918 private range for local configuration
# Tune this for your local addresses
Match Address 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
 PasswordAuthentication yes

After creating a new user with sudo access, I log in using that account and emasculate and disable the user pi account without deleting it in case I need it later:

sudo visudo
#pi ALL=(ALL) NOPASSWD: ALL

sudo passwd --lock pi
sudo usermod --expiredate 1 pi

Configure fail2ban

sudo apt-get install fail2ban
sudo vi /etc/fail2ban/jail.conf
[ssh]
enabled  = true
port     = <non-default port>
filter   = sshd

To get email notifications of fail2ban actions (requires outbound email setup) modify:

destemail = <your email address>

Configure unattended security updates:

sudo apt-get install unattended-upgrades

To get email notifications of update actions (requires outbound email setup) modify:

sudo vi /etc/apt/apt.conf.d/50unattended-upgrades
Unattended-Upgrade::Mail "<your email address>";
1

The Linux security structure is fairly robust, as most commands implemented are on a user level and to move to sudo (admin level) usually requires a password, assuming you keep the RPI up to date and maybe use a strong password, and make sure you do some research on some basic firewalls (if you are really worried), including VPN tunnels if you are worried about being monitored (I suggest looking up tor on the RPI on ada fruit forums) you should be fine, but if this is for a commercial network i'd strongly suggest purchasing either a hardware router firewall or looking into differing hardware security options as corporations are more prone to hack attacks then the average homeowner.

Hope this helps mate and take it easy :)

1

Some points to consider:

  • Keep system up-to-date (manually, by script, cron-apt, ...)
  • Disallow ssh root login (etc/ssh/sshd_config)
  • Change default ssh port
  • Block unused ports (firewall, iptables)
  • Use some kind of intrusion prevention system (fail2ban)
  • Which webserver to choose (nginx/apache)? configuration issues with webserver?
  • 1
    It gout auto pushed because there is no answser. Your answer is good, except using Apache in general for public sites nowadays is bad. Better use nginx instead. Fail2Ban is great, but also change the SSH port to something obscure because bots hammer it. – Piotr Kula Nov 7 '14 at 11:53
0

I have my Pi running a web server but I just put it behind a separate firewall and only have port 80 (and SSH on a non-standard port) forwarded to the Pi. Via sudo, rsync is allowed to run as root but can only run a specific rsync command. All logins are done via SSH keys and when I get some time I plan to figure out how to disable password logins all together.

  • You've restricted rsync, but can root still log in directly? – bobstro Jul 2 '15 at 4:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.