SSH Server Hardening in one of the security part to secure your server.Refer following steps to secure SSH.

root@serevr[~]#pico /etc/ssh/sshd_config

Uncomment  #Protocol 2, 1

Change to Protocol 2

Append these lines to the bottom:

LoginGraceTime 120
IgnoreRhosts yes
X11Forwarding no
Save file and restart the SSH service.

root@serevr[~]#/etc/rc.d/init.d/sshd restart

Note : SSH Protocol one  based servers are facing many automated root kits attacks.As a result to step up the security Protcol 2 should be enabled on server.The reason to use SSH Protocol 2 on any webserver is that it is more secure as compare to protocol 1.

iptables creating rules after restarting the iptables. When iptables service is restarted settings from /etc/sysconfig/iptables file are applied and used with the iptables.

You can either set up iptables rule so that current stat is saved the rule upon restart or stop/start:

You need to make changes in following file as per your requirement for values received in following GREP result.

root@server[~]# grep IPTABLES_SAVE /etc/sysconfig/iptables-config
IPTABLES_SAVE_ON_STOP=”no”
IPTABLES_SAVE_ON_RESTART=”no”
IPTABLES_SAVE_COUNTER=”no”

Or overwrite current settings with iptables-save to /etc/sysconfig/iptables file:

root@server[~]# iptables-save > /etc/sysconfig/iptables

Note : Its always good if we use NO option for following options because some time due to wrong rule we face major problem to access server.

IPTABLES_SAVE_ON_STOP=”no”
IPTABLES_SAVE_ON_RESTART=”no”
IPTABLES_SAVE_COUNTER=”no”

How to disable root login and enable key authentication on Dedicated server?

Refer following steps to disable direct root login.

1. SSH into your server as root user.

2. Open file sshd_config in your favorite editor

pico /etc/ssh/sshd_config

3. Find the line

Protocol 2, 1

4. Uncomment line and change it to look like

Protocol 2

5. Now find the line
PermitRootLogin yes

6. And Uncomment libe and make it look like as
PermitRootLogin no

7. Save the file sshd_config file,

8. Restart SSH service
/etc/rc.d/init.d/sshd restart

Once root login disabled on server generate authentication key by using following steps.

1. Add user for example we will add user support

useradd support

2.Assigne user support in wheel group.

usermod -G wheel support

3. Set correct permission for sudoers files.

chmod 644 /etc/sudoers

4. Now open sudoers file and set followings line in sudoers file.

pico /etc/sudoers

# User privilege specification
root    ALL=(ALL) ALL

# Same thing without a password
%wheel        ALL=(ALL)       NOPASSWD: ALL

5. Make sure that sudo file binery file is secure.

chmod 4111 /usr/bin/sudo

If you are not sure about sudo binery path then run commamd to confirm the path.

which sudo

6.Now create .ssh directory in support users home directory.

cd /home/support

mkdir .ssh

cd .ssh

7. Now generate the key by using PuTTYgen software and save the key on your local machine as support.ppk file.

8. Create authorized_keys file in .ssh directory and copy content from file support.ppk to authorized_keys file.

9. Confirm permission and ownership for files.

cd /home

ll | grep support

The ownership shuold be

drwx——    7 support support          4096 Jul 10 03:44 support

cd /home/support

ll | grep .ssh

drwxr-xr-x    2 root   root        4096 Jul 12  3:34 .ssh/

cd /home/support/.ssh

ll

The ownership shoud be

drwxr-xr-x 2 root    root    4096 Jul 12 03:22 ./
drwx—— 7 support support 4096 Jul 12 03:44 ../
-rw-r–r– 1 root    root    224  Jul 12 03:40 authorized_keys

Note : Do not close current Shell until you are able to access server with the support.ppk key.

After upgrade server to 5.1 generally we are getting following error message.

Client does not support authentication protocol requested by server; consider upgrading MySQL client.

The above error message are receiving because latest version of MySql uses a new format for the password in that case to use older client to use older version Mysql with new version Mysql you have to set the passwords on the server to their old format.Refer following steps to set the password.

Login into shell as root user and access mysql with root user and password

[root@admin.com]#mysql -u root -p

Then, copy and paste the following command in shell, editing commands if necessary, to change the password of the user to the old format.

[root@admin.com]#UPDATE mysql.user
[root@admin.com]#SET password=OLD_PASSWORD(‘password’)
[root@admin.com]#WHERE user=’username’
[root@admin.com]#AND host=’host’;

After running above commands flush the tables.

[root@admin.com]#flush privileges;

Then exit the mysql client.

[root@admin.com]#\q