I am going to try and set up Ghostpi, but opening my Pi up to the web could be hazardous. What should I do to secure my Pi and protect my home network?
This is an older question, but always a good one to ask. In addition to the advice already provided, I recommend some additional steps.
Based on observing login attempts against default user accounts (e.g. pi), I like to configure ssh to only allow specific users or groups, and limit those to pubkey authentication:
sudo addgroup --system sshusers sudo adduser <username> sudo adduser <username> sshusers sudo adduser <username> sudo # Good idea to add this user to other necessary groups (e.g. netdev)
Configure ssh to disable root login and disable password authentication from outside networks:
sudo vi /etc/ssh/sshd_config Port <non-default port> PermitRootLogin no AllowGroups sshusers # global option no password auth PasswordAuthentication no # permit password from rfc1918 private range for local configuration # Tune this for your local addresses Match Address 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 PasswordAuthentication yes
After creating a new user with sudo access, I log in using that account and emasculate and disable the user pi account without deleting it in case I need it later:
sudo visudo #pi ALL=(ALL) NOPASSWD: ALL sudo passwd --lock pi sudo usermod --expiredate 1 pi
sudo apt-get install fail2ban sudo vi /etc/fail2ban/jail.conf [ssh] enabled = true port = <non-default port> filter = sshd
To get email notifications of fail2ban actions (requires outbound email setup) modify:
destemail = <your email address>
Configure unattended security updates:
sudo apt-get install unattended-upgrades
To get email notifications of update actions (requires outbound email setup) modify:
sudo vi /etc/apt/apt.conf.d/50unattended-upgrades Unattended-Upgrade::Mail "<your email address>";
The Linux security structure is fairly robust, as most commands implemented are on a user level and to move to sudo (admin level) usually requires a password, assuming you keep the RPI up to date and maybe use a strong password, and make sure you do some research on some basic firewalls (if you are really worried), including VPN tunnels if you are worried about being monitored (I suggest looking up tor on the RPI on ada fruit forums) you should be fine, but if this is for a commercial network i'd strongly suggest purchasing either a hardware router firewall or looking into differing hardware security options as corporations are more prone to hack attacks then the average homeowner.
Hope this helps mate and take it easy :)
Some points to consider:
- Keep system up-to-date (manually, by script, cron-apt, ...)
- Disallow ssh root login (etc/ssh/sshd_config)
- Change default ssh port
- Block unused ports (firewall, iptables)
- Use some kind of intrusion prevention system (fail2ban)
- Which webserver to choose (nginx/apache)? configuration issues with webserver?
I have my Pi running a web server but I just put it behind a separate firewall and only have port 80 (and SSH on a non-standard port) forwarded to the Pi. Via sudo, rsync is allowed to run as root but can only run a specific rsync command. All logins are done via SSH keys and when I get some time I plan to figure out how to disable password logins all together.