{"id":346,"date":"2019-11-07T15:51:11","date_gmt":"2019-11-07T20:51:11","guid":{"rendered":"https:\/\/www.bu.edu\/engit\/?page_id=346"},"modified":"2021-08-17T13:31:37","modified_gmt":"2021-08-17T17:31:37","slug":"ubuntuatbu-security","status":"publish","type":"page","link":"https:\/\/www.bu.edu\/engit\/knowledge-base\/linux\/ubuntuatbu-security\/","title":{"rendered":"Security Basics"},"content":{"rendered":"<p>Most attacks usually come from 1) login services like SSH, TeamViewer, and Remote Desktop (XRDP) with weak or known passwords, 2) vulnerabilities in internet browsers and email clients, and 3) vulnerabilities in externally shared services, particularly web apps and network shares.<\/p>\n<p>Here are some of our recommendations for a more secure system. We can help you with any or all topics.<\/p>\n<h1 id=\"Firewall\">Block External Connections<\/h1>\n<p>Services like SSH open ports to the internet. A firewall can limit which IP networks can reach your services, for example, here are some instructions that limit incoming <strong>ssh<\/strong> (port 22) connections to BU&#8217;s IP space, including the VPN and wireless networks:<\/p>\n<pre class=\"darkSnippet\">$ sudo apt install ufw\r\n$ sudo ufw default deny incoming\r\n$ sudo ufw default allow outgoing\r\n$ sudo ufw allow from 128.197.0.0\/16 to any port 22\r\n$ sudo ufw allow from 10.0.0.0\/8 to any port 22\r\n$ sudo ufw allow from 168.122.0.0\/16 to any port 22\r\n$ sudo ufw allow from 155.41.0.0\/16 to any port 22\r\n$ sudo ufw enable\r\n<\/pre>\n<p>By default Ubuntu doesn&#8217;t not have a firewall turned on, because there are no servers running by default. The <strong><tt class=\"backtick\">ufw<\/tt><\/strong> commanded used above, stands for <a class=\"https\" href=\"https:\/\/wiki.ubuntu.com\/UncomplicatedFirewall\">UncomplicatedFireWall<\/a>. It a good place to start, but is a simplified interface for configuring <strong>iptables<\/strong>. If you need more power, you can remove <strong><tt class=\"backtick\">ufw<\/tt><\/strong> and use <strong>iptables<\/strong> directly.<\/p>\n<p>You can find more <a href=\"https:\/\/www.digitalocean.com\/community\/tutorials\/how-to-set-up-a-firewall-with-ufw-on-ubuntu-18-04\">documentation on ufw<\/a>, or ask us for help, enghelp@bu.edu<\/p>\n<h1>Patch System Vulnerabilities<\/h1>\n<p>Keep your operating system up-to-date with patches that remove security vulnerabilities. We recommend configuring <a href=\"https:\/\/help.ubuntu.com\/community\/AutomaticSecurityUpdates\">automatic security updates.<\/a> Most importantly keep you browser and email client updated. For instance, <a href=\"https:\/\/support.google.com\/chrome\/a\/answer\/9025903?hl=en\">install Chrome from Google&#8217;s repository<\/a> and let apt keep it updated. If you have any external services, like a website or TeamViewer, running, please keep them updated.<\/p>\n<h1>Install End-Point Protection<\/h1>\n<p>CrowdStirke Falcon provides lightweight virus scanning and intrusion detection. Currently the <a href=\"https:\/\/www.bu.edu\/tech\/services\/cccs\/desktop\/device-security\/endpoint-protection\/\">IS&amp;T installation page<\/a> does not include Linux, but we can help you with that. We just can&#8217;t post it publicly.<\/p>\n<h1 id=\"BootMenu\">Lock the Boot Menu<\/h1>\n<p>If you have untrusted users with physical access to your machine, you should <a href=\"https:\/\/www.techrepublic.com\/article\/how-to-password-protect-the-grub-boot-loader-in-ubuntu\/\">secure the grub boot menu<\/a> to prevent users from starting in &#8220;recovery mode&#8221;, which grants root access.<\/p>\n<ul><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Most attacks usually come from 1) login services like SSH, TeamViewer, and Remote Desktop (XRDP) with weak or known passwords, 2) vulnerabilities in internet browsers and email clients, and 3) vulnerabilities in externally shared services, particularly web apps and network shares. Here are some of our recommendations for a more secure system. We can help [&hellip;]<\/p>\n","protected":false},"author":16541,"featured_media":0,"parent":868,"menu_order":14,"comment_status":"closed","ping_status":"closed","template":"","meta":[],"_links":{"self":[{"href":"https:\/\/www.bu.edu\/engit\/wp-json\/wp\/v2\/pages\/346"}],"collection":[{"href":"https:\/\/www.bu.edu\/engit\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.bu.edu\/engit\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.bu.edu\/engit\/wp-json\/wp\/v2\/users\/16541"}],"replies":[{"embeddable":true,"href":"https:\/\/www.bu.edu\/engit\/wp-json\/wp\/v2\/comments?post=346"}],"version-history":[{"count":11,"href":"https:\/\/www.bu.edu\/engit\/wp-json\/wp\/v2\/pages\/346\/revisions"}],"predecessor-version":[{"id":2095,"href":"https:\/\/www.bu.edu\/engit\/wp-json\/wp\/v2\/pages\/346\/revisions\/2095"}],"up":[{"embeddable":true,"href":"https:\/\/www.bu.edu\/engit\/wp-json\/wp\/v2\/pages\/868"}],"wp:attachment":[{"href":"https:\/\/www.bu.edu\/engit\/wp-json\/wp\/v2\/media?parent=346"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}