How to secure a VPS running Rocky Linux

Rocky Linux is an enterprise-grade open source operating system. Its main distinguishing feature is that it is designed and maintained in lockstep with Red Hat Enterprise Linux — in other words, it is 100% bug-for-bug compatible. In this guide we will carry out an initial, basic hardening of a freshly installed Rocky Linux VPS. These first simple steps should then be complemented with any other security mechanisms you may need, depending on the services you plan to install.

Given the shared origin (Red Hat), this guide also applies to the CentOS 7 and 8 operating systems.

Prerequisites

1. A Rocky Linux VPS
2. A user with adequate privileges, i.e. root
3. A text editor; in our example we will use nano
4. The dnf package manager, normally included in the operating system
5. [Recommended] A firewall; in our example we will use firewalld

Check which operating system is installed

As a Linux distribution that tracks Red Hat EL, in the event of problems it's best to be certain of the version you are working on. To do so, we can run the command:

# cat /etc/os-release
NAME="Rocky Linux"
VERSION="9.0 (Blue Onyx)"
ID="rocky"
ID_LIKE="rhel centos fedora"
VERSION_ID="9.0"
PLATFORM_ID="platform:el9"
PRETTY_NAME="Rocky Linux 9.0 (Blue Onyx)"
ANSI_COLOR="0;32"
LOGO="fedora-logo-icon"
CPE_NAME="cpe:/o:rocky:rocky:9::baseos"
HOME_URL="https://rockylinux.org/"
BUG_REPORT_URL="https://bugs.rockylinux.org/"
ROCKY_SUPPORT_PRODUCT="Rocky-Linux-9"
ROCKY_SUPPORT_PRODUCT_VERSION="9.0"
REDHAT_SUPPORT_PRODUCT="Rocky Linux"
REDHAT_SUPPORT_PRODUCT_VERSION="9.0"

In our example the version is 9.0, codenamed Blue Onyx.

Update your operating system

To check for updates, we use the dnf command with the check-update parameter:

# dnf check-update

This command will show the list of all the packages that can be updated. At this point you can choose whether to update everything suggested or, selectively, only certain packages. In the first case, simply run the command:

# dnf -y update

The -y parameter simply pre-confirms your intention to update all the packages, without asking for any confirmation. If instead we want to proceed with a selective update, updating a specific package, simply run the command:

# dnf update cockpit.x86_64

In our example we update the cockpit package, leaving the others aside.

Creating a user with limited privileges

As a general security rule, it's best not to use the root user for day-to-day tasks on the VPS. To that end, we will create a user with limited privileges who can, however, temporarily impersonate the root user when needed. To create a new user, use the useradd command:

# useradd mio_utente

Once the user has been created, assign a password using the passwd command:

# passwd mio_utente
Changing password for user mio_utente
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

Even though the newly created user won't have much chance of doing damage to the system, let's avoid weak passwords (at least 8 alphanumeric characters, special characters included). At this point we can use the new user to log in to the VPS, but for now we won't be able to run commands that require the root user's privileges.

To run commands that require root privileges, there are two ways to proceed:

1. use the $ su root command to impersonate the root user;
2. add the newly created user to the sudoers group (the users who can run commands with root privileges): when needed, just type $ sudo comando_con_privilegi (for example $ sudo dnf update).

While in the first case the unprivileged user will need to know the root password in order to operate, in the second they will be pre-authorised — all the more reason not to underestimate the quality of the chosen password. Better still, avoid exposing SSH on the standard port and, better yet, use encrypted keys to connect rather than a mere username/password system.

To add the new user to the sudoers group, log in to the VPS as the root user and use the command:

# usermod -aG wheel mio_utente

The "wheel" group is a special group, used on some Linux systems to control which users may use the sudo command. Now, if we log in to the VPS over SSH with the unprivileged user, by using sudo followed by the privileged command we can carry out tasks that normally require root permissions, for example:

$ sudo dnf check-update
We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:
#1) Respect the privacy of others.
#2) Think before you type.
#3) With great power comes great responsibility.
[sudo] password for mio_utente:

The password requested is of course that of the user created earlier, not root's. This way we can create users for external collaborators without sharing the root password.

Managing the firewall

An important aspect of VPS security is managing the firewall. On Rocky Linux the firewall is active by default and has a base configuration that allows connections over SSH (standard port TCP 22) and to the Cockpit web console (port TCP 9090); the latter service is not active, so if you try to connect to https://ip_vps:9090 you will get no response. Unlike Debian-derived operating systems (e.g. Ubuntu Server), Rocky Linux uses firewalld: as a result, the commands for configuring it differ from ufw (regular Ubuntu users will know what we're talking about).

As a first step, let's make sure the firewall is running:

$ sudo firewall-cmd --state

Since you are using a non-root user, you will be asked for the password. If all goes as hoped, the output will be a simple "running".

To check the current firewall configuration, we use the command:

$ sudo firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources:
  services: cockpit dhcpv6-client ssh
  ports:
  protocols:
  forward: yes
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

From here we can see that the active zone is called public (active), that the eth0 network interface is assigned to that zone, that inbound communications are allowed for the cockpit, dhcpv6-client and ssh services, and that ICMP replies are allowed — icmp-block-inversion: no (for example: replies to the ping command).

The public zone blocks any inbound communication by default, unless specified otherwise. A fundamental concept in firewalld is that all changes made to the configuration are temporary, unless the --permanent parameter is used before the command. This means that if, for example, we wanted to open port 443 to allow HTTPS access with the following command:

$ sudo firewall-cmd --zone=public --add-service=https

the first time the VPS rebooted, this rule would be gone. If instead we want to make it permanent, all it takes — as mentioned — is:

$ sudo firewall-cmd --permanent --zone=public --add-service=https

Changing the SSH service port

As the brilliant contemporary author Ken Follett would say about trust: "Trusting someone is like holding water in your cupped hands…"; when it comes to IT security, imagine holding the water with your fingers spread wide open. Since we cannot know the "someone" who will try to connect to your VPS, let's give them no trust at all. A tip we have already given in other articles is to change the standard SSH service port: this simple operation reduces unauthorised access attempts by scripts that automatically try to connect on port 22.

Before starting the configuration, let's decide which port to use: in this example we have chosen port 4322/TCP.

Step 1 — Configure the firewall. Add port 4322/TCP to the firewall configuration:

$ sudo firewall-cmd --permanent --zone=public --add-port=4322/tcp

As you can see, we used the parameter that makes the configuration permanent. Now let's reload all the parameters and make sure there are no errors:

$ sudo firewall-cmd --reload
$ sudo firewall-cmd --list-ports

Our 4322/tcp will appear in the output.

Step 2 — Configure the SSH service. The procedure for changing the default port is fairly simple: just edit the /etc/ssh/sshd_config file, changing the port number, and then restart the service. To edit the file we will use the nano editor:

$ sudo nano /etc/ssh/sshd_config

In this file, anything beginning with "#" is a comment and is ignored by the system; at the same time, though, it tells us what the default value is. Look for the line beginning with #Port 22, remove the "#" symbol and change the port value — or add a line just below the comment with our new SSH port: Port 4322. All that's left is to save the change with CTRL+X and Y to confirm.

For the changes to take effect, the service must be restarted:

$ sudo systemctl restart sshd.service

From now on, if you try to connect to your VPS over SSH you will receive the message ssh: connect to host IP_VPS port 22: Connection refused. To connect, you need to add the -p option to the command, followed by the new port:

ssh mio_utente@IP_VPS -p 4322

Disabling root access via SSH

For greater VPS security, it is strongly recommended not to allow the root user to log in via SSH: this is why we earlier created a user with limited privileges who can nonetheless become root when required. We will now block SSH access for root. Once again we need to edit the SSH service configuration file, as we did to change the standard port.

Open the /etc/ssh/sshd_config file with the nano editor ($ sudo nano /etc/ssh/sshd_config), look for the string "PermitRootLogin yes" and set it to "no":

# Authentication:
#LoginGraceTime 2m
PermitRootLogin no
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10
#PubkeyAuthentication yes

Save the change with CTRL+X and Y to confirm. Restart the service for the changes to take effect:

$ sudo systemctl restart sshd.service

Even though preventing root from connecting via SSH may seem inconvenient, it is an important step in raising your VPS's security level. If you ever need to connect directly to the machine as the root user, you can always use the web console from the dashboard of your VPS GREEN account.

Guide originally published on the blog of VPS GREEN, the VPS service running on our green private cloud.

• VPS
• Rocky Linux
• hardening
• firewalld
• SSH
• dnf
• security