Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm wanting to get my firewall on my new webserver to be as secure as it needs to be. After I did research for iptables, I came across UFW (Uncomplicated FireWall). This looks like a better way for me to setup a firewall on Ubuntu Server 10 LTS and seeing that it's part of the install, it seems to make sense.

My server will have Nginx, FastCGI and MySQL on it. I also want to be allow SSH access (obviously). So I'm curious to know exactly how I should set up UFW and is there anything else I need to take into consideration? After doing research, I found an article that explains it this way:

# turn on ufw
ufw enable
# log all activity (you'll be glad you have this later)
ufw logging on
# allow port 80 for tcp (web stuff)
ufw allow 80/tcp
# allow our ssh port
ufw allow 5555
# deny everything else
ufw default deny
# open the ssh config file and edit the port number from 22 to 5555, ctrl-x to exit
nano /etc/ssh/sshd_config
# restart ssh (don't forget to ssh with port 5555, not 22 from now on)
/etc/init.d/ssh reload

This all seems to make sense to me. But is it all correct? I want to back this up with any other opinions or advice to ensure I do this right on my server.

Many thanks!

share|improve this question
    
If you've not already done this, I'd suggest disabling password authentication in sshd_config and use key pairs for passwordless authentication. I've all but eliminated any brute force SSH attempts that are logged against my webservers by doing this. –  gravyface Dec 3 '10 at 20:11
    
Take a look into Config Server Firewall too. It's by far the easiest and featured-filled firewall that I've used. :) –  Taylor Jasko Nov 7 '12 at 7:33
    
Wouldn't it make sense to limit the access to port 80 as well ? ufw allow 80/tcp => ufw allow 80/tcp –  Florian Didron Sep 5 '13 at 9:13
add comment

2 Answers

Use the ufw limit [PORT] instead of ufw allow [PORT] so you can prevent brute force attacks.

   ufw supports connection rate limiting, which is useful  for  protecting
   against  brute-force  login attacks. ufw will deny connections if an IP
   address has attempted to initiate 6 or more connections in the last  30
   seconds.

Below is how I would setup ufw firewall using your rules.

First Change SSH Port in: /etc/ssh/sshd_config

Then Reload configuration: /etc/init.d/ssh reload

Then: ufw default deny

Then: ufw logging on

Then: ufw limit 5555

Then: ufw allow 80/tcp

Once you have all your rules setup enable ufw: ufw enable

share|improve this answer
add comment

I'd be very careful about firewalling off SSH without knowing exactly what you're doing - it might be worth trying to SSH it off for a certain network to begin with to test. I don't know how fast LFW takes effect or if it affects established connections, but if it does with immediate effect then you should definitely change the port number of SSH before you firewall off the one you're currently using to connect.

share|improve this answer
    
@james-lawrie I'm not sure I understand this. Isn't UFW merely an interface to iptables? As far as I'm aware it merely is a more user friendly front end to the underlining iptables, but is essential iptables underneath? If I'm setting the correct things in UFW, then iptables will be set as if I modified the iptables myself? help.ubuntu.com/community/UFW –  littlejim84 Aug 11 '10 at 7:49
    
Yes, but change the ssh port first, test if it works, then turn on ufw or iptables firewall, so you don't get locked out. –  Jure1873 Oct 7 '12 at 8:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.