diff --git a/README.md b/README.md index 4809ad7..fed840d 100644 --- a/README.md +++ b/README.md @@ -112,6 +112,72 @@ You'll get a command to paste in your new node. Copy the one that ends with `--w in your new node. Wait a few minutes until it connects, and then you're ready to go! No need to follow the steps down below if the cluster is already up and running. +##### SSH Security + +To secure the access to the server, you'll need to follow the following steps: + +###### Disable Password Authentication + +Having SSH password authentication leaves an open door for brute force attacks. Before disabling +it, make sure that the server has your SSH key to prevent from getting locked out after proceeding. + +After you have made sure your keys have been properly configured, edit the SSH configuration file: + +```sh +nano /etc/ssh/ssh_config +``` + +In the file, find the following configurations: +1. `ChallengeResponseAuthentication` +2. `PasswordAuthentication` +3. `UsePAM` + +If they're set in the file, set their value to `no`. After that, restart the SSH service: + +```sh +systemctl restart ssh +``` + +###### Set Up `fail2ban` + +The next step to secure SSH is to set up `fail2ban`, which will rate limit failed attempts to log +in. First, install it in the server: + +```sh +apt update +apt install fail2ban +``` + +Next, make a copy of the configuration file: + +```sh +cd /etc/fail2ban +cp jail.conf jail.local +``` + +You now need to update it to enable SSH protection: + +```sh +nano jail.local +``` + +Find the `[ssh]` section and add the following line (or update it if it already exists): + +```toml +enable = true +``` + +After updating that line, close the file, enable, and start the service: + +```sh +systemctl enable fail2ban +systemctl start fail2ban + +# Check the status of the service to make sure it was enabled properly. You can exit the status +# screen pressing "q". +systemctl status fail2ban +``` + ## Deploying Payphone The following steps show how to pull and install Payphone on a running cluster of nodes.