Security Setup - Starfish

This guide walks through securing your server with SSH hardening and Fail2Ban. You will:

1. SSH configuration

Edit the SSH daemon configuration:

nano /etc/ssh/sshd_config

Tip

Common security settings include changing the default port, disabling root login, and enabling public key authentication only.

Disable SSH socket if enabled:

systemctl stop ssh.socket
systemctl disable ssh.socket

Restart SSH service to apply changes:

systemctl restart ssh

Edit the SSH configuration file:

nano /etc/ssh/sshd_config.d/*.conf

Add or modify these settings:

PubkeyAuthentication yes
PasswordAuthentication no
PermitRootLogin prohibit-password

Important

Set up public key authentication before disabling password authentication so you don't lock yourself out.

Check that SSH is running correctly:

systemctl status ssh

sudo apt update
sudo apt install fail2ban -y

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Warning

Do not copy jail.conf. Keep custom configuration minimal and place it in jail.local or jail.d/*.conf.

Create or edit the local configuration file:

sudo nano /etc/fail2ban/jail.local

Minimal recommended configuration:

[DEFAULT]
bantime  = 365d
findtime = 10m
maxretry = 5

Explanation:

On Debian-based systems, the SSH jail is already enabled by default via the distro configuration, so no extra SSH configuration is needed here.

sudo systemctl restart fail2ban

Verify your Fail2Ban installation with these commands:

Check overall status:

sudo fail2ban-client status

Expected output should include at least sshd in the jail list.

Check specific jail details:

sudo fail2ban-client status sshd

Monitor logs in real-time:

sudo tail -f /var/log/fail2ban.log

Check service status:

systemctl status fail2ban