How to Secure Your CentOS Server: Best Practices

Securing your CentOS server is crucial for protecting your data and ensuring system stability.
This tutorial covers best practices for securing CentOS servers, including SSH hardening, setting up firewalls, disabling unused services, and using Fail2Ban to prevent brute-force attacks.

1. Hardening SSH Access

The default SSH configuration can be improved to reduce potential vulnerabilities:

Edit the SSH configuration file:

• Change the Default SSH Port: Modify the SSH port to something other than 22. Find the line Port 22 and change it to a non standard port (e.g., 2222).
• Disable Root Login: Prevent direct root access by setting PermitRootLogin no in the same configuration file.

Restart the SSH service:

2. Use SSH Keys:

SSH keys provide stronger security and eliminate the risks of brute-force and password-based attacks.

Generate an SSH key pair on your local machine:

Copy the public key to your server:

3. Setting Up a Firewall

CentOS includes firewalld, a powerful tool for managing firewall rules:

• Install firewalld:
  sudo yum install firewalldCopy
  Enable and start the service:
  sudo systemctl enable --now firewalldCopy
• Allow Necessary Services: For example, to allow SSH on your custom port:
  sudo firewall-cmd --permanent --add-port=2222/tcpCopy
  Reload the firewall:
  sudo firewall-cmd --reloadCopy
• Check Active Rules:
  sudo firewall-cmd --list-allCopy

4. Disabling Unused Services

Reduce your attack surface by disabling unnecessary services:

• List All Active Services:
  sudo systemctl list-unit-files --type=serviceCopy
• Disable Unnecessary Services: For example:
  sudo systemctl disable cupsCopy
  This prevents the printer service from running on a server.

5. Installing and Configuring Fail2Ban

Fail2Ban helps protect against brute-force attacks by monitoring log files and banning suspicious IPs:

• Install Fail2Ban:
  sudo yum install epel-releaseCopy
  sudo yum install fail2banCopy
• Enable the SSH Jail: Edit the Fail2Ban configuration:
  sudo nano /etc/fail2ban/jail.localCopy
  Uncomment and configure the SSH section:

  [ssh] enabled = true port = 2222 filter = sshd logpath = /var/log/secure maxretry = 5

  Restart Fail2Ban:
  sudo systemctl restart fail2banCopy
• Check Banned IPs:
  sudo fail2ban-client status sshdCopy

6. Additional Security Tips

• Keep your system up to date:
  sudo yum updateCopy
• Use strong passwords for all user accounts.
• Install antivirus software if hosting files or applications prone to malware.

Conclusion

By following these steps, you can significantly enhance the security of your CentOS server.
SSH hardening, firewalls, service management, and tools like Fail2Ban work together to protect your system from attacks. Regular maintenance and updates ensure your server remains secure over time.