# Security

import {
  fail2banConfig,
  sudoersConfig,
  ufwSysctl,
  unattendedUpgradesConfig,
} from "@/lib/mdx-constants";
Linux Security is a critical aspect of maintaining a secure and stable server or personal environment. This page provides a comprehensive guide on key security practices to harden a Linux system, reduce vulnerabilities and protect against common threats. By following these best practices, you can ensure that your system is well-defended from unauthorized access, malware and potential exploits.

---

## unattended-upgrades

Ensure your Linux system is automatically updated with security patches. Unattended Upgrades enables automatic installation of critical updates without manual intervention, ensuring your system stays secure against newly discovered vulnerabilities.

1. ### Install

   ```sh
   sudo apt install unattended-upgrades -y
   ```

2. ### Open config

   ```sh
   sudo nano /etc/apt/apt.conf.d/20auto-upgrades
   ```

3. ### Modify config

   ```sh title="/etc/apt/apt.conf.d/20auto-upgrades"
   # Update below:
   APT::Periodic::Enable "1";
   APT::Periodic::Update-Package-Lists "1";
   APT::Periodic::Download-Upgradeable-Packages "1";
   APT::Periodic::Unattended-Upgrade "1";
   APT::Periodic::AutocleanInterval "1";
   APT::Periodic::Verbose "2";
   ```

4. ### Verify

   ```sh
   sudo unattended-upgrades -d
   ```

---

## Require password for sudo

Require users to authenticate with a password before using sudo privileges. This simple change adds an extra layer of protection by preventing unauthorized users or scripts from executing commands with elevated privileges.

1. ### Open config

   ```sh
   sudo visudo -f /etc/sudoers.d/010_{{USERNAME_VAR}}-nopasswd
   ```

2. ### Modify config

   ```sh title="/etc/sudoers.d/010_{{USERNAME_VAR}}-nopasswd"
   # Comment out line below to require password for sudo (recommended)
   {USERNAME_VAR} ALL=(ALL) NOPASSWD: ALL
   ```

---

## fail2ban

Install and configure Fail2Ban to protect your server from brute-force attacks. Fail2Ban monitors log files for suspicious activity and blocks IPs that repeatedly fail authentication, preventing attackers from gaining access.

1. ### Install fail2ban

   ```sh
   sudo apt install fail2ban -y
   ```

2. ### Open config

   ```sh
   sudo nano /etc/fail2ban/jail.local
   ```

3. ### Modify config (optional)

   ```toml title="/etc/fail2ban/jail.local"
   [DEFAULT]
   bantime.increment = true
   bantime.factor = 1
   bantime.maxtime = 5w

   [sshd]
   enabled = true
   port = ssh
   filter = sshd
   backend = systemd
   maxretry = 3
   findtime = 600
   bantime = 3600
   ignoreip = 127.0.0.1/8 ::1 {{SUBNET_VAR}}
   ```

4. ### Restart service

   ```sh
   sudo systemctl restart fail2ban
   ```

5. ### Check status

   ```sh
   sudo fail2ban-client status sshd
   ```

---

## ufw firewall

A firewall is your first line of defense against unauthorized access. Installing and configuring a firewall like UFW or iptables ensures that only trusted traffic is allowed to reach your system, reducing exposure to external threats.

1.  ### Install

    ```sh
    sudo apt install ufw -y
    ```

2.  ### Deny incoming

    ```sh
    sudo ufw default deny incoming
    ```

3.  ### Allow outgoing

    ```sh
    sudo ufw default allow outgoing
    ```

4.  ### Allow SSH

    Replace port number if your SSH port is different.

    ```sh
    sudo ufw allow 22/tcp
    ```

5.  ### Tailscale (optional)

    

   1. #### Allow routed traffic

             Required for exit node/subnet routing.

             ```sh
             sudo ufw route allow in on tailscale0
             ```

   2. #### Allow Tailscale network

             Allow everything coming in from your Tailscale network.

             ```sh
             sudo ufw allow in on tailscale0
             ```

   3. #### Tailscale performance (optional)

             Helps Tailscale make direct “peer-to-peer” connections.

             ```sh
             sudo ufw allow 41641/udp
             ```

   4. #### Enable packet forwarding

             Tell the kernel to allow packets to be routed through the server. Open the UFW sysctl configuration:

             ```sh
             sudo nano /etc/ufw/sysctl.conf
             ```

             Uncomment the following line:

             ```sh title="/etc/ufw/sysctl.conf"
             net/ipv4/ip_forward=1
             net/ipv6/conf/default/forwarding=1
             ```

6.  ### AdGuard Home (optional)

    Allow local network devices to send DNS queries to AdGuard Home.

    ```sh
    sudo ufw allow from {{SUBNET_VAR}} to any port 53
    ```

7.  ### Samba (optional)

    Allow Samba UDP ports (NetBIOS).

    ```sh
    sudo ufw allow from {{SUBNET_VAR}} to any port 137,138 proto udp
    ```

    Allow Samba TCP ports (SMB).

    ```sh
    sudo ufw allow from {{SUBNET_VAR}} to any port 139,445 proto tcp
    ```

8.  ### Allow web access (optional)

    Required for web server (e.g., Nginx Proxy Manager, Caddy).

    ```sh
    sudo ufw allow 80,443/tcp
    ```

9.  ### Add custom rule (optional)

    ```sh
    sudo ufw allow from {{SERVER_IP_VAR}} port $PORT_NUMBER
    ```

10. ### Enable ufw

    ```sh
    sudo ufw enable
    ```

11. ### Reload ufw

    ```sh
    sudo ufw reload
    ```

12. ### Check status

    ```sh
    sudo ufw status verbose
    ```