Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm on a fresh VPS with Ubuntu Server 12.04. I wanted to ask you the good practices to apply to enhance security over a stock Ubuntu-server.

This is what I did up to now: I added Google Authenticator to SSH, then I created a new user (whom I'll use instead of 'root' for SSH & SFTP access) which I added to my /etc/sudoers list below 'root', so now it's:

 # User privilege specification
 root     ALL=(ALL:ALL) ALL
 new_user ALL=(ALL:ALL) ALL

Then I edited sshd_config and set PermitRootLogin to 'no'. Then restarted the ssh service.

Is this ok? There are a few things I'd like to ask you though:

1) What's the sense of adding a new (sudoer) user whilst the root user still exist (ok it can't access with root privilege but it's still there..)? 2) System files are owned by 'root'.. I want to use my new_user to access via SFTP but with it I can't edit those files!! Should I mass-CHMOD 'em so that new_user has write perms too? What's the good practice on this?

Thanks in advance, I hope you'll tell me if I did something wrong and/or other ways to secure the system. :)

share|improve this question

2 Answers 2

up vote 4 down vote accepted

That's a good start.

The new_user account would gain elevated privileges with the 'sudo' command. This requires the new_user's password be entered when prompted (and it remembers for a short period of time, so it's not every time you use it) and is thus more secure than a regular root account that always has elevated privileges.

To view a root-owned log file, you would run sudo less /var/log/foo and then enter the new_user account's password.

To disable the 'root' account, you can use the passwd command.

sudo passwd -d root

This will delete the password. If you only wish to disable the account and wish to be able reinstate it if necessary, the -l and -u options will lock and unlock the account, respectively.

share|improve this answer
    
Ok but what should I do with the "default" root user? Isn't more secure to deny him some operations (or even remove him from sudoers)? Otherwise it's the same if I used 'root' (with PermitRootLogin set to 'no') instead of new_user.. am I wrong? –  MultiformeIngegno Sep 22 '12 at 16:14
    
Sure. Added that to the answer. The 'passwd' command is actually great for that stuff. –  Magellan Sep 22 '12 at 16:23
    
Last question: are there downsides on disabling root account? For example I run nginx, php5-fpm, mysql, exim4, etc.. would they be affected? I think no because they use their own users.. anyway.. :) –  MultiformeIngegno Sep 22 '12 at 16:30
    
There may be depending on your config, but the service users for nginx, mysql, etc. are exactly how you mitigate those issues. Those services should be running under service-specific users. Ubuntu doesn't have an enabled root user by default, and that OS works just fine with only 'sudo' and service-oriented system users. –  Magellan Sep 22 '12 at 19:07

you may be also interested in changing ssh port, changing authorized IP range in iptables, not using sudo and use a very strong password for root.

share|improve this answer
2  
a) Security by Obscurity Isn't. b) IPs can be spoofed. c) Sudo is far better than running root for everything. d) If a local account is compromised, it's easier to limit damage if they can't get to a root user. –  Magellan Sep 23 '12 at 5:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.