Whitesmoke SMP docs

Security notes

Your own user, first

Do this once, as root, on the fresh server, before you install. Replace you with the name you want:

adduser --disabled-password --gecos "" you && usermod -aG sudo you
install -d -m 0700 -o you -g you /home/you/.ssh && install -m 0600 -o you -g you /root/.ssh/authorized_keys /home/you/.ssh/authorized_keys
passwd you

The password is for sudo (and for your provider's console); SSH never asks for it. Then log in as that user in a new terminal and check sudo -v works, before you close the root session.

Right after the install: smp-harden

Every release comes with a hardening script, installed as smp-harden. Two commands finish what the fresh server lacks. Keep a second SSH session open the whole time, so a mistake can't lock you out.

  1. The firewall (only 22, 80 and 443 in), daily automatic security updates, and your user in sudo with your keys:

    sudo smp-harden base --admin "$USER"

    It prints every key that can log in as you: they must all be yours.

  2. SSH: keys only, no root login, no passwords, no forwarding, at most 3 tries, and the two groups whitesmoke-ssh (you) and whitesmoke-sftp (your sites' SFTP users) as the only logins:

    sudo smp-harden ssh --admin "$USER" --mode allowgroups

    It first checks that you can log in with your key and use sudo, and refuses otherwise; if sshd -t rejects the result, the old settings go back. (On a server with SFTP for sites a first run picks this mode by itself; naming it leaves nothing to chance.)

  3. Open a new SSH session to make sure you still get in. Only then close the other one.

If it said a reboot is needed (a new kernel), reboot now and log in again.

Check the server: smp-harden check

The check only reads and reports, and changes nothing:

sudo smp-harden check --admin "$USER"

It shows the SSH settings that apply to your login (key-only, no root login, no passwords, who may log in), the firewall, and automatic security updates.

Use this installed copy: it comes with your release and is updated with it. Older copies of the script (before 0.2.0) don't show who may log in, so on a server that uses AllowGroups their report looks clean without telling you anything about it.

SSH: let groups in, not single users

SFTP for sites works through SSH. Each site's SFTP user is in the group whitesmoke-sftp, and SSH must let that group log in. If your SSH settings list users (AllowUsers you), sites can't log in over SFTP, and the installer tells you so.

Switch to groups with smp-harden:

  1. Keep a second SSH session open the whole time, so a mistake can't lock you out.

  2. Run:

    sudo smp-harden ssh --admin "$USER" --mode allowgroups

    It first checks that you can log in with your key and use sudo, and refuses otherwise. It puts your login in the group whitesmoke-ssh, sets AllowGroups whitesmoke-ssh whitesmoke-sftp, checks the settings with sshd -t and reloads SSH. Everything else stays as it was.

  3. Open a new SSH session to make sure you still get in, then run the check above.

Site users get only SFTP inside their own site folder, with keys only; the installer sets that up in /etc/ssh/sshd_config.d/20-whitesmoke-sftp.conf. Your own login keeps its settings.

Other good habits