Learning Devuan GNU/Linux - Security & Hardening

#Introduction

Security isn't an add-on feature — it's the result of consistent habits. Episode 14 covers security and hardening on Devuan: tightening SSH, setting sudo policy, running audits with lynis, preventing brute-force with fail2ban, automating security updates with unattended-upgrades, and auditing your own init scripts.

On Devuan, hardening feels easier to understand because every component is transparent. There are no hidden security daemons; everything is configuration files and init scripts you can read. Let's make that transparency an advantage.

#Hardening SSH

#Secure sshd Configuration

SSH is a server's main entrance. Tighten it by changing a few options in /etc/ssh/sshd_config:

sudo sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo service ssh restart

PermitRootLogin no disables direct root login; PasswordAuthentication no requires SSH keys. Before disabling passwords, make sure your public key is installed in ~/.ssh/authorized_keys or you could lock yourself out.

#Verifying Keys and Connections

Test the changes from another machine:

ssh -i ~/.ssh/id_ed25519 budi@server
ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

ssh-keygen -lf shows the host key fingerprint — a value you should match on first connect to reject man-in-the-middle attacks.

#sudo Policy and Root Access

#The Least Privilege Principle

Grant administrative rights only to users who genuinely need them. On Devuan, the sudo group controls this access:

sudo usermod -aG sudo budi
sudo gpasswd -d sinta sudo

usermod -aG sudo budi gives budi sudo access; gpasswd -d sinta sudo revokes it from sinta. Check the sudo user list anytime:

getent group sudo

getent group sudo lists all members of the sudo group. Auditing this list regularly prevents unused accounts from holding root access.

#Auditing with lynis

#Running a System Audit

lynis is a security audit tool that checks configuration, packages, and services:

sudo apt install lynis
sudo lynis audit system

sudo lynis audit system runs a thorough audit and produces a security score. Pay attention to the suggestions and warnings sections — that's where you'll find specific remediation steps.

#Reading the Audit Results

The lynis report is stored in /var/log/lynis.log with a summary in /var/log/lynis-report.dat. A good habit: run an audit before and after major changes, then compare the scores. This tool isn't a final judgment — it's a checklist that guides your hardening priorities.

#Preventing Brute-Force with fail2ban

#Installing and Configuring

fail2ban blocks IP addresses that fail login repeatedly:

sudo apt install fail2ban
sudo service fail2ban start
sudo service fail2ban status

sudo service fail2ban start starts the fail2ban daemon. The main configuration lives in /etc/fail2ban/jail.conf, and local settings that won't be overwritten by updates go in /etc/fail2ban/jail.local.

#A Jail for SSH

Enable a jail for SSH with a local file:

cat > /etc/fail2ban/jail.local <<'EOF'
[sshd]
enabled = true
maxretry = 5
bantime = 1h
EOF
sudo service fail2ban restart

maxretry sets the number of failed attempts before a ban, bantime how long the ban lasts. After the restart, monitor banned IPs with sudo fail2ban-client status sshd.

#Automatic Security Updates

#Installing unattended-upgrades

Security updates shouldn't wait until an admin remembers. Install unattended-upgrades so security packages install automatically:

sudo apt install unattended-upgrades
sudo unattended-upgrade

sudo unattended-upgrade runs security updates immediately for testing. For scheduled updates, enable the service:

sudo dpkg-reconfigure --priority=low unattended-upgrades
sudo service unattended-upgrades status

dpkg-reconfigure --priority=low unattended-upgrades makes sure automatic updates are enabled. On Devuan, the unattended-upgrades service is run by init on the cron schedule.

#Auditing Init Scripts

#Checking Running Services

There are no hidden daemons on Devuan — but only if you check regularly. The last hardening habit is a service audit:

service --status-all
ps aux --sort=-%mem | head -15

service --status-all lists all init services and their status. Compare it with your expectations: any unknown service deserves investigation. Auditing init scripts also means making sure no service is enabled without a reason — remove them with update-rc.d disable.

#Conclusion

Episode 14 covered Devuan security and hardening: tightening SSH, setting sudo policy with least privilege, running lynis audits, preventing brute-force with fail2ban, automating security updates, and auditing running services.

Key takeaways:

• Disable root login and passwords for SSH; keys are required.
• Give sudo access only to users who need it.
• Run lynis regularly as a hardening checklist.
• fail2ban blocks IPs that repeatedly fail to log in.
• unattended-upgrades installs security updates automatically.
• Audit services with service --status-all periodically.

In the next episode, episode 15, we'll cover eudev and device management — understanding eudev as the non-systemd device manager, using udevadm for inspection and monitoring, and writing rules in /etc/udev/rules.d/ to control devices.