This document describes security hardening methods for common services on TencentOS Server, including SSH, FTP, BIND, and email, covering recommendations for configuration modification, access control, and encrypted transmission. Adjust the following settings based on your actual situation and needs.
SSH Security Hardening
Introduction to SSH
SSH is a protocol that uses a client-server architecture to provide secure communication between two systems, allowing users to remotely log in to the server host system. SSH provides secure encrypted communication between two untrusted hosts over an insecure network.
TencentOS Server provides an implementation of the open-source SSH version, including the base software package openssh, the client software package openssh-clients, and the server software package openssh-server. It provides the following user space tools:
|
ssh
| SSH client used for remote login to servers. |
sshd
| SSH daemon process on the server side. |
scp
| Secure remote file copy program based on SSH. |
sftp
| Secure file transfer program based on SSH. |
ssh-agent
| Authentication agent used to cache private keys. |
ssh-add
| Add a private key identity to ssh-agent. |
ssh-keygen
| Generate, manage, and convert SSH authentication keys. |
Configuration File
System-wide SSH configuration information is stored in the /etc/ssh/ directory. User-specific SSH configuration information is stored in ~/.ssh/ in the user's home directory. The main files are as follows:
/root/.ssh/authorized_keys: stores the public keys of authenticated users.
/etc/ssh/ssh_config: the global configuration file for the SSH client. Settings in this file are applied to all users on the system. Typically, this file contains default connection settings. User-level configuration files, such as ~/.ssh/config, can override parameters in the global configuration file.
/etc/ssh/sshd_config: the main configuration file for the SSH server. This file defines the behavior and settings of the SSH server, such as the port number, root login options, login timeout, and key verification. To change SSH server settings, edit this file and restart the SSH service.
/etc/ssh/ssh_host_*key and /etc/ssh/ssh_host_*key.pub: the private and public key files of the SSH server, used for its authentication and connection encryption. The asterisk (*) in the file names can be rsa, ecdsa, ed25519, or other key types. These files are generated on the server side and shared with remote clients when an SSH connection is established. The security of SSH connections is based on these keys.
Security Hardening Cases
The following are certain security hardening recommendations. Implementing the following configurations in your system will enhance the security of your SSH service. Adjust these settings based on your actual situation and needs.
Modifying the Default Port of SSH
Change the default port of SSH (22) to prevent port-based automatic scanning.
1. Modify the default listening port number.
Edit the /etc/ssh/sshd_config file, and find and modify the following lines:
Port <custom_port_number>
Replace <custom_port_number> with your desired custom port number.
2. Adjust the SELinux port tag.
If SELinux is running on your system and is set to enforcing (the default configuration of TencentOS Server), you need to adjust the SELinux policy to allow the new SSH port. Run the following commands:
sudo semanage port -a -t ssh_port_t -p tcp <custom_port_number>
3. Allow the new port through the firewall.
Ensure that the firewall allows SSH traffic on the new port:
sudo firewall-cmd --add-port=<custom_port_number>/tcp --permanent
sudo firewall-cmd --reload
4. Restart the sshd service.
Warning:
After the restart, sshd will listen on the new port, and the original port 22 will no longer accept connections. Before restarting, ensure that the SELinux port tag and firewall rule are configured. Keep the current session open, and after the restart, verify that an SSH connection can be established through the new port before disconnecting the current session.
sudo systemctl restart sshd
Disabling the Login of Root Users
Disabling remote login for the root user can prevent attackers from launching brute-force attacks against this user and limits remote login permissions.
Edit the /etc/ssh/sshd_config file and modify the following configuration. This configuration can reduce the risk of attacks and help you better track and audit operations performed on your system.
Warning:
If the sshd configuration contains errors, you may be unable to establish a new SSH connection after restarting the service. Before restarting, run sudo sshd -t to verify the configuration syntax. Keep the current session open, and after the restart, confirm that a new SSH connection can be established before disconnecting the current session.
After updating the configuration file, restart the sshd service:
sudo systemctl restart sshd
Configuring Password-Free Login
The following operations are all performed on the client OS.
1. Generate SSH public and private keys.
Running the above command generates a private key file named id_rsa and a public key file named id_rsa.pub in the current user's /home/<username>/.ssh directory. The -t option specifies that the key type is rsa.
2. Upload the public key.
ssh-copy-id username@remote-server
This command appends the id_rsa.pub file (the public key) from the local computer to the /home/<username>/.ssh/authorized_keys file on the remote server. If the file does not exist, it will be created automatically.
3. Verification
Verify on the local computer whether password-free login is possible.
FTP Security Hardening
Introduction to FTP and vsftpd
FTP (File Transfer Protocol) is a traditional and widely used file transfer tool. It transfers files between servers and clients over a network without requiring authentication, which allows anonymous users to connect to the server. FTP is insecure by default because it does not encrypt data when transmitting user credentials and data.
vsftpd (Very Secure File Transfer Protocol Daemon) is a popular, secure, fast, and free FTP server software for Unix and Linux-like operating systems. It incorporates many security and performance optimizations, making it widely used in various environments, including personal and enterprise servers.
Installation and Enabling
sudo dnf install vsftpd
sudo systemctl enable vsftpd
sudo systemctl start vsftpd
vsftpd Configuration
Edit the configuration file /etc/vsftpd/vsftpd.conf. The original configuration file may contain the following parameters. Modify or add the following configurations as needed:
# Disable anonymous login: Only authenticated users are allowed to access.
anonymous_enable=NO
# Enable FTP access for local users.
local_enable=YES
# Enable write permissions to create/update files or directories. Whether to enable it depends on actual demand.
write_enable=YES
# Enable chroot-based security: Limit users to their home directory.
chroot_local_user=YES
# Ensure that users with write permissions are always in the chroot environment.
allow_writeable_chroot=YES
# Enable the recording of user login information.
xferlog_enable=YES
# Listening: Enable the passive mode port range between pasv_min_port and pasv_max_port.
pasv_enable=YES
pasv_min_port=40000
pasv_max_port=50000
# Disable implicit and explicit SSL/TLS connections if needed.
# ssl_enable should also be disabled.
force_local_data_ssl=NO
force_local_logins_ssl=NO
ssl_enable=NO
Firewall Settings related to the FTP Service
Allow port 21 (FTP port by default) and passive mode port ranges for FTP services.
sudo firewall-cmd --add-port=21/tcp --permanent
sudo firewall-cmd --add-port=40000-50000/tcp --permanent
sudo systemctl restart firewalld
Configuring a FTP Dedicated User
Create a user and a user group dedicated to FTP access and limit their permissions:
sudo groupadd ftp-users
sudo useradd -m -g ftp-users -s /sbin/nologin <ftp_user>
sudo passwd <ftp_user>
Setting the user Shell to /sbin/nologin prevents interactive logins (such as SSH) while retaining access to non-interactive services such as FTP.
Using SFTP Instead of FTP
To improve security, consider using SFTP (Secure File Transfer Protocol) instead of FTP. SFTP is a secure file transfer method based on the SSH protocol that transmits files and commands over a single encrypted channel, making it more secure than plaintext-based FTP.
BIND Security Hardening
Introduction to BIND Service
The BIND (Berkeley Internet Name Domain) service is open-source DNS (Domain Name System) server software used to resolve domain names to IP addresses and vice versa.
Restricting Queries to the Management Zone
Access to the management zones of the BIND server should be restricted for queries and operations. Restricting access to BIND management zones primarily ensures that only authorized clients can query specific zones. This prevents unauthorized users from accessing potentially sensitive DNS information and reduces the threat of DDoS attacks. For example, allow only clients on the internal network to perform queries. Edit /etc/named.conf and add the following content to the options block:
options {
...
allow-query {
localhost;
192.168.0.0/24;
};
...
};
In this example, only the local computer and clients within the CIDR range 192.168.0.0/24 are allowed to query.
Restricting Zone Transfer
Restricting zone transfers for the BIND service means allowing only specific, authorized secondary DNS servers to obtain and replicate management zone data from the primary DNS server. By restricting zone transfers, you can ensure that sensitive DNS records are shared only between trusted servers, thereby enhancing network security.
To implement this restriction, you need to modify the settings of the relevant zone in the BIND configuration file /etc/named.conf. Specifically, add an allow-transfer configuration parameter to specify only the IP addresses or address ranges of secondary DNS servers that are allowed to receive zone transfers. The following is an example of a zone transfer restriction:
zone "example.com" {
type master;
file "/etc/named/zones/db.example.com";
allow-transfer {
192.168.1.2;
};
};
In this example, restrict zone transfers so that only the secondary DNS server with IP address 192.168.1.2 can receive zone transfers for example.com.
Disabling Recursive Queries
Recursive resolution is the process by which a DNS server obtains the mapping between domain names and IP addresses when responding to queries. When recursive queries are disabled, the BIND server no longer processes recursive query requests from external clients or tracks external domain name resolution. Disabling recursive queries can prevent external users from exploiting the server for attacks such as DNS amplification attacks and DNS cache poisoning. Disabling recursive queries can also reduce the server load, thereby improving its performance.
To disable recursive queries, edit /etc/named.conf and add the following content to the options block:
options {
...
recursion no;
...
};
Enabling DNSSEC
DNSSEC aims to provide additional security for DNS queries. By adding digital signatures (encryption verification) to DNS records and queries, DNSSEC can guarantee the integrity and source reliability of query data, allowing clients to ensure the authenticity of received DNS resolution results.
Enable DNSSEC to provide additional security. Edit /etc/named.conf and add the following content to the options block:
options {
...
dnssec-validation yes;
...
};
Note: The dnssec-enable option is deprecated and removed in BIND 9.16 and later, so no configuration is required. To enable DNSSEC validation, you only need to keep dnssec-validation yes;.
Using a Blocklist to Block Malicious Domain Names
You can block specific malicious domains by creating a blocklist file. First, create a file named named.blacklist in the /etc/named/ directory. Then, in the /etc/named.conf file, add the following content to the options section:
options {
...
response-policy { zone "blacklist"; };
...
};
Next, add the following content to the /etc/named.conf file:
zone "blacklist" {
type master;
file "named.blacklist";
allow-query { none; };
};
For each malicious domain to be blocked, add a line to the named.blacklist file:
bad-domain.example CNAME .
Security Hardening of Mail Services
Introduction to Mail Services
In Linux systems, email services involve multiple components, including MTAs, MDAs, IMAP/POP3 servers, and Webmail, which work together to send, receive, store, and retrieve emails. On TencentOS Server, many different software packages are available to provide email services, such as postfix, sendmail, and dovecot. When selecting your email service software package, consider your needs, preferences, and environment. postfix + dovecot is a popular email service software combination because it offers good security and performance. The following sections provide practical security hardening examples based on these two software packages.
Installing Postfix and Dovecot
On TencentOS Server, you can use dnf to install Postfix and Dovecot:
sudo dnf install postfix dovecot
After the installation is complete, enable the service to start automatically at boot and start the service:
sudo systemctl enable postfix dovecot
sudo systemctl start postfix dovecot
Mandatorily Using SSL/TLS Encryption
SSL/TLS encryption is a security technology used to encrypt communications between clients (such as email clients) and mail servers (such as the MTA Postfix and the IMAP/POP3 server Dovecot). It achieves secure connections by using digital certificates and keys, ensuring that the content of emails and user login credentials cannot be eavesdropped on or tampered with during transmission.
1. Generate SSL/TLS certificates.
The following example uses OpenSSL to generate a self-signed certificate. Alternatively, you can use certificates provided by trusted SSL certificate authorities such as Let's Encrypt. Generate a self-signed certificate using OpenSSL:
sudo openssl req -new -x509 -days 365 -nodes \\
-out /etc/pki/tls/certs/mailserver.pem \\
-keyout /etc/pki/tls/private/mailserver.key
sudo chmod 0600 /etc/pki/tls/private/mailserver.key
During certificate generation, you will be prompted to provide information such as country and organization.
2. Configure Postfix to use SSL/TLS.
Edit the Postfix configuration file /etc/postfix/main.cf and add or modify the following configuration items:
smtp_use_tls = yes
smtpd_tls_security_level = may
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/pki/tls/certs/mailserver.pem
smtpd_tls_key_file = /etc/pki/tls/private/mailserver.key
smtpd_tls_loglevel = 1
smtpd_tls_session_cache_timeout = 3600s
3. Configure Dovecot to use SSL/TLS.
Edit the Dovecot SSL configuration file /etc/dovecot/conf.d/10-ssl.conf and add or modify the following content:
ssl = required
ssl_cert = </etc/pki/tls/certs/mailserver.pem
ssl_key = </etc/pki/tls/private/mailserver.key
The < prefix is Dovecot configuration syntax, indicating that content is read from the specified file.
4. Restart the Postfix and Dovecot services.
sudo systemctl restart postfix
sudo systemctl restart dovecot
Configuring Email Authentication
Email authentication is a security mechanism used to verify user identity, typically implemented through the collaboration of the Mail Transfer Agent (MTA, such as Postfix) and the IMAP/POP3 server (such as Dovecot). To implement email authentication, you need to configure the MTA (such as Postfix) to use an authentication mechanism such as Simple Authentication and Security Layer (SASL). SASL is a general-purpose authentication framework that supports various authentication protocols (such as PLAIN and LOGIN).
1. Dovecot Configuration
Edit the /etc/dovecot/dovecot.conf file and modify or add the following line:
auth_mechanisms = plain login
Edit the /etc/dovecot/conf.d/10-auth.conf file, locate the following line, and uncomment it to disable insecure plaintext authentication:
disable_plaintext_auth = yes
2. Postfix Configuration
Edit the Postfix configuration file /etc/postfix/main.cf and add the following configuration items:
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = <myhostname>
smtpd_recipient_restrictions = permit_mynetworks,
permit_sasl_authenticated, reject_unauth_destination
Modify the Postfix configuration file /etc/postfix/master.cf to use Dovecot as the authentication proxy for the Mail Transfer Agent (MTA). Locate the following section:
smtp inet n - n - - smtpd
Add the following lines after it to enable SASL authentication:
-o smtpd_sasl_auth_enable=yes
-o smtpd_sasl_type=dovecot