Welcome to the inaugural post of “Security Sunday” on hersoncruz.com! Every Sunday, we’ll delve into essential security practices and share scripts that will help sysadmins fortify their servers and keep cyber threats at bay. Let’s get started with some foundational security practices and a few handy scripts to automate these tasks.

Regular Updates and Patching

Keeping your system and software up to date is the first line of defense against vulnerabilities. Regularly applying patches ensures that known security flaws are fixed.

Example: Automate Updates with a Simple Script 

#!/bin/bash
# Script to update and upgrade system packages

echo "Starting system update..."
sudo apt-get update -y
sudo apt-get upgrade -y
echo "System update complete!"

This script automatically updates and upgrades your system packages on Debian-based distributions. You can schedule it to run at regular intervals using cron jobs.

User Management and Access Control

Limiting user access and ensuring that only authorized personnel have administrative privileges is crucial. Regularly auditing user accounts helps maintain tight security.

Example: Check for Unused User Accounts 

#!/bin/bash
# Script to list user accounts that haven't logged in for over 30 days

echo "Checking for inactive user accounts..."
lastlog -b 30

This script lists user accounts that haven’t been used in the last 30 days. Review these accounts and disable or remove any that are no longer needed.

Strong Password Policies

Enforce strong password policies to prevent unauthorized access. Require complex passwords and regular changes.

Example: Enforce Strong Passwords with PAM

Edit the /etc/pam.d/common-password file to include:

password requisite pam_pwquality.so retry=3 minlen=12 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1

This configuration enforces a minimum password length of 12 characters and requires a mix of digits, uppercase, lowercase, and special characters.

Firewalls and Network Security

Using firewalls to control incoming and outgoing traffic is a fundamental security measure. Properly configured firewalls can block unauthorized access and prevent attacks.

Example: Basic UFW Configuration 

#!/bin/bash
# Script to set up a basic UFW firewall configuration

echo "Configuring UFW firewall..."
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw enable
echo "UFW configuration complete!"

This script sets up a basic UFW (Uncomplicated Firewall) configuration, denying all incoming traffic except for SSH and allowing all outgoing traffic.

Intrusion Detection Systems (IDS)

Implementing an IDS can help detect and respond to suspicious activities on your network. Tools like Snort or OSSEC can be configured to monitor your systems.

Example: Install and Configure OSSEC 

#!/bin/bash
# Script to install and configure OSSEC on a Debian-based system

echo "Installing OSSEC..."
sudo apt-get install ossec-hids -y

echo "Starting OSSEC configuration..."
sudo /var/ossec/bin/ossec-control start

This script installs OSSEC and starts the OSSEC HIDS service. Customize the configuration as needed to monitor specific files and directories.

Regular Backups

Regular backups are essential to recover from data loss or security breaches. Automating backups ensures that they happen consistently without manual intervention.

Example: Automate Backups with rsync 

#!/bin/bash
# Script to back up important directories to a remote server

SOURCE_DIR="/path/to/source"
DEST_DIR="/path/to/destination"
REMOTE_USER="user"
REMOTE_HOST="remote.host"

echo "Starting backup..."
rsync -avz $SOURCE_DIR $REMOTE_USER@$REMOTE_HOST:$DEST_DIR
echo "Backup complete!"

This script uses rsync to back up specified directories to a remote server. Schedule it with cron to run at regular intervals.

Log Monitoring and Analysis

Regularly monitoring and analyzing logs can help identify unusual activities and potential security threats. Tools like Logwatch or Splunk can automate this process.

Example: Simple Logwatch Setup 

#!/bin/bash
# Script to install and configure Logwatch

echo "Installing Logwatch..."
sudo apt-get install logwatch -y

echo "Running Logwatch for daily report..."
sudo logwatch --output mail --mailto you@example.com --detail high

This script installs Logwatch and runs it to send daily log reports to your email. Adjust the email address and report detail level as needed.

Stay tuned to hersoncruz.com for more security tips, tricks, and scripts every Sunday in our “Security Sunday” series. Keep your systems secure and your data safe!