AlmaLinux: Simple Steps for a Secure Server

Ensuring the security of your AlmaLinux server is paramount in safeguarding against potential threats and maintaining a robust infrastructure. This comprehensive guide covers essential security measures to fortify your AlmaLinux server and protect it from vulnerabilities, providing step-by-step instructions for each security layer.

Prerequisites

Before securing your AlmaLinux server, ensure you have:

Fresh AlmaLinux installation (8.x or 9.x)
Root or sudo administrative access
Basic understanding of Linux command line
Network connectivity for package updates

1. Configure Firewall Rules

A properly configured firewall is the first line of defense against unauthorized access. AlmaLinux comes with firewalld, a dynamic firewall manager that provides zone-based firewall management.

Installing and Enabling Firewalld

# Install firewalld if not present
sudo dnf install firewalld -y

# Start and enable firewalld
sudo systemctl start firewalld
sudo systemctl enable firewalld

# Check firewall status
sudo firewall-cmd --state

Basic Firewall Configuration

# Set default zone to public (restrictive)
sudo firewall-cmd --set-default-zone=public

# Allow essential services
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https

# Allow custom ports if needed
sudo firewall-cmd --permanent --add-port=8080/tcp

# Reload firewall rules
sudo firewall-cmd --reload

# List active rules
sudo firewall-cmd --list-all

Advanced Firewall Rules

# Block specific IP range
sudo firewall-cmd --permanent --add-rich-rule="rule family='ipv4' source address='192.168.1.0/24' reject"

# Rate limit SSH connections
sudo firewall-cmd --permanent --add-rich-rule="rule service name='ssh' accept limit value='3/m'"

# Allow specific source IP for SSH
sudo firewall-cmd --permanent --add-rich-rule="rule family='ipv4' source address='203.0.113.0/24' service name='ssh' accept"

2. Secure SSH Access

Securing SSH access is critical as it’s a common target for attackers. Enhance security by modifying default settings and implementing key-based authentication.

SSH Configuration Hardening

Edit the SSH configuration file:

sudo nano /etc/ssh/sshd_config

Apply these security settings:

# Change default port (optional but recommended)
Port 2222

# Disable root login
PermitRootLogin no

# Use protocol 2 only
Protocol 2

# Limit login attempts
MaxAuthTries 3
MaxSessions 2

# Set idle timeout
ClientAliveInterval 300
ClientAliveCountMax 2

# Disable empty passwords
PermitEmptyPasswords no

# Disable X11 forwarding if not needed
X11Forwarding no

# Use strong ciphers
Ciphers aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-256,hmac-sha2-512

Implement Key-Based Authentication

Generate SSH key pair (on client machine):

ssh-keygen -t rsa -b 4096 -C "[email protected]"

Copy public key to server:

ssh-copy-id -p 2222 username@your_server_ip

Disable password authentication:

# In /etc/ssh/sshd_config
PasswordAuthentication no
PubkeyAuthentication yes

Restart SSH service:

sudo systemctl restart sshd

3. Regular Software Updates

Keeping your software up-to-date is crucial in addressing potential vulnerabilities and security patches.

Manual Updates

# Update package repositories
sudo dnf update

# Update all packages
sudo dnf upgrade -y

# Update specific package
sudo dnf update package_name

# Check for security updates only
sudo dnf --security check-update

Security-Only Updates

# Install only security updates
sudo dnf --security update

Verify Package Integrity

# Check package signatures
sudo dnf check

# Verify installed packages
rpm -Va

4. Implement SELinux

SELinux (Security-Enhanced Linux) adds an extra layer of security by enforcing mandatory access controls and preventing unauthorized actions.

Check SELinux Status

# Check current status
sestatus

# Check current mode
getenforce

Configure SELinux

# Set SELinux to enforcing mode
sudo setenforce 1

# Make change permanent
sudo nano /etc/selinux/config
# Set: SELINUX=enforcing

# Install SELinux management tools
sudo dnf install policycoreutils-python-utils selinux-policy-devel

SELinux Troubleshooting

# Check SELinux denials
sudo ausearch -m AVC -ts recent

# Generate policy for denials
sudo ausearch -m AVC -ts recent | audit2allow -M mypolicy
sudo semodule -i mypolicy.pp

# View SELinux contexts
ls -Z /path/to/directory

5. Install and Configure Fail2Ban

Fail2Ban protects against brute-force attacks by monitoring system logs and automatically banning suspicious IP addresses.

Install Fail2Ban

# Install EPEL repository
sudo dnf install epel-release -y

# Install Fail2Ban
sudo dnf install fail2ban -y

# Start and enable service
sudo systemctl start fail2ban
sudo systemctl enable fail2ban

Configure Fail2Ban

Create local configuration:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

Basic configuration:

[DEFAULT]
# Ban time (seconds)
bantime = 1800

# Find time window (seconds)  
findtime = 600

# Max retry attempts
maxretry = 5

# Email notifications
destemail = [email protected]
action = %(action_mwl)s

[sshd]
enabled = true
port = 2222
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600

Restart Fail2Ban:

sudo systemctl restart fail2ban

Monitor Fail2Ban

# Check status
sudo fail2ban-client status

# Check specific jail
sudo fail2ban-client status sshd

# View banned IPs
sudo fail2ban-client status sshd

# Unban IP manually
sudo fail2ban-client set sshd unbanip 192.168.1.100

6. Enable Automatic Updates

Automating system updates ensures that security patches are promptly applied, reducing exposure to known vulnerabilities.

Install DNF Automatic

sudo dnf install dnf-automatic -y

Configure Automatic Updates

Edit the configuration:

sudo nano /etc/dnf/automatic.conf

Key settings:

[commands]
# What kind of upgrade to perform
upgrade_type = security

# Whether to install downloaded updates
apply_updates = yes

[emitters]
# Email settings
emit_via = email
email_from = [email protected]
email_to = [email protected]

Enable Automatic Updates

# Enable and start the timer
sudo systemctl enable dnf-automatic.timer
sudo systemctl start dnf-automatic.timer

# Check timer status
sudo systemctl status dnf-automatic.timer

7. Monitor System Logs

Regular monitoring of system logs helps identify potential security issues, unauthorized access attempts, and system anomalies.

Essential Log Files

# Authentication logs
sudo tail -f /var/log/auth.log

# System messages
sudo tail -f /var/log/messages

# Security events
sudo tail -f /var/log/secure

# Firewall logs
sudo journalctl -u firewalld -f

Log Analysis Commands

# Failed SSH login attempts
sudo grep "Failed password" /var/log/secure

# Successful logins
sudo grep "Accepted" /var/log/secure

# Root login attempts
sudo grep "root" /var/log/secure

# Large file operations
sudo find /var/log -size +100M -type f

# Recent critical errors
sudo journalctl -p err -n 50

Setup Log Rotation

# Configure logrotate
sudo nano /etc/logrotate.d/security-logs

Add configuration:

/var/log/secure {
    weekly
    rotate 4
    compress
    delaycompress
    missingok
    notifempty
    create 600 root root
}

8. Additional Security Measures

Install and Configure AIDE

AIDE (Advanced Intrusion Detection Environment) monitors file integrity:

# Install AIDE
sudo dnf install aide -y

# Initialize database
sudo aide --init

# Move database
sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

# Run integrity check
sudo aide --check

# Schedule regular checks
echo "0 3 * * * /usr/sbin/aide --check" | sudo crontab -

Configure System Auditing

# Install audit system
sudo dnf install audit -y

# Start audit service
sudo systemctl start auditd
sudo systemctl enable auditd

# Add audit rules
echo "-w /etc/passwd -p wa -k passwd_changes" >> /etc/audit/rules.d/audit.rules
echo "-w /etc/shadow -p wa -k shadow_changes" >> /etc/audit/rules.d/audit.rules

# Restart audit service
sudo systemctl restart auditd

Network Security

# Disable unused network services
sudo systemctl disable bluetooth
sudo systemctl disable cups

# Configure TCP wrappers
echo "sshd: 203.0.113.0/24" >> /etc/hosts.allow
echo "ALL: ALL" >> /etc/hosts.deny

# Disable IPv6 if not needed
echo "net.ipv6.conf.all.disable_ipv6 = 1" >> /etc/sysctl.conf
sudo sysctl -p

9. Security Hardening Checklist

File System Security

# Set proper permissions on critical files
sudo chmod 644 /etc/passwd
sudo chmod 600 /etc/shadow
sudo chmod 644 /etc/group
sudo chmod 600 /etc/gshadow

# Secure mount options in /etc/fstab
# Add noexec,nosuid,nodev to appropriate partitions

# Find files with unusual permissions
sudo find / -type f -perm -4000 2>/dev/null
sudo find / -type f -perm -2000 2>/dev/null

User Account Security

# Lock unused accounts
sudo usermod -L username

# Set password policies
sudo nano /etc/login.defs
# PASS_MAX_DAYS 90
# PASS_MIN_DAYS 7
# PASS_WARN_AGE 14

# Install password quality checking
sudo dnf install libpwquality -y

Remove Unnecessary Software

# List installed packages
dnf list installed

# Remove unnecessary packages
sudo dnf remove telnet rsh rlogin

# Clean package cache
sudo dnf clean all

10. Monitoring and Alerting

Setup Email Alerts

Configure postfix for email notifications:

sudo dnf install postfix mailx -y
sudo systemctl start postfix
sudo systemctl enable postfix

Create Security Monitoring Script

sudo nano /usr/local/bin/security-check.sh

Add monitoring script:

#!/bin/bash
# Security monitoring script

LOG_FILE="/var/log/security-check.log"
EMAIL="[email protected]"

# Check for failed login attempts
FAILED_LOGINS=$(grep "Failed password" /var/log/secure | tail -10)
if [ ! -z "$FAILED_LOGINS" ]; then
    echo "Failed login attempts detected:" | mail -s "Security Alert" $EMAIL
fi

# Check for new user accounts
NEW_USERS=$(find /home -maxdepth 1 -type d -newermt "1 day ago")
if [ ! -z "$NEW_USERS" ]; then
    echo "New user directories detected: $NEW_USERS" | mail -s "New User Alert" $EMAIL
fi

# Check system load
LOAD=$(uptime | awk '{print $10}' | cut -d',' -f1)
if (( $(echo "$LOAD > 2.0" | bc -l) )); then
    echo "High system load detected: $LOAD" | mail -s "High Load Alert" $EMAIL
fi

echo "$(date): Security check completed" >> $LOG_FILE

Make executable and schedule:

sudo chmod +x /usr/local/bin/security-check.sh
echo "0 */6 * * * /usr/local/bin/security-check.sh" | sudo crontab -

Troubleshooting Common Issues

SSH Connection Problems

# Check SSH service status
sudo systemctl status sshd

# Test SSH configuration
sudo sshd -t

# Check firewall rules
sudo firewall-cmd --list-services

# Review SSH logs
sudo journalctl -u sshd -n 50

SELinux Issues

# Temporarily disable SELinux
sudo setenforce 0

# Check SELinux context
ls -Z /path/to/file

# Restore default context
sudo restorecon -v /path/to/file

Firewall Problems

# Check firewall status
sudo firewall-cmd --state

# List all rules
sudo firewall-cmd --list-all-zones

# Temporary rule addition
sudo firewall-cmd --add-service=ssh

Security Best Practices Summary

Keep systems updated with latest security patches
Use strong authentication with key-based SSH access
Implement defense in depth with multiple security layers
Monitor logs regularly for suspicious activities
Backup configurations before making changes
Test security measures in staging environment first
Document changes for future reference
Regular security audits to identify vulnerabilities

Conclusion

By implementing these comprehensive security measures, you’ve significantly enhanced the security posture of your AlmaLinux server. These steps provide multiple layers of protection against common attack vectors and establish a solid foundation for a secure server environment.

Security is an ongoing process, not a one-time setup. Regular monitoring, updates, and configuration reviews ensure your server remains protected against evolving threats. Consider implementing additional security measures based on your specific use case and compliance requirements.

Remember to:

Test all configurations in a safe environment first
Maintain regular backups of your system and configurations
Stay informed about security best practices and emerging threats
Review and update security policies periodically

Your AlmaLinux server is now significantly more secure and ready to handle production workloads with confidence.