Linux - securing the server

[MatthewL]

I currently run a Unifi controller on Windows and to be honest its resource intensive and the update process for Unifi in the way we run it is poor and I want to move it to Linux as its far easier to update and resource wise its better.

 

I use Linux but don't know it like Windows to be as sure on things like I would normally be. The server is internet facing tied down to ports but cannot restrict to IP's as we host some access points we manage in the big bad world.

 

We run a few tools on Windows servers to harden them up from a security point of view but want to ensure a Linux server is as secure as can be so any recommendations?

[ZeroHour]

Hmm its a tougher one given the whole issue of log4j that caused some unifi servers to be turned into miners. Will it have a domain pointed at it? I would maybe sit cloudflare infront of it possibly but I am not sure what rules would need to be allowed to ensure the management side works well.

I will have a think of what I would do.

[mavhc]

Can you use client side certificates in the connection?

[dmj]

It depends upon the distribution. If you're using RedHat you can turn on SCAP policies:

https://www.redhat.com/en/blog/getting-started-red-hat-insights-and-openscap-compliance-reporting

 

I'm working a lot with Ubuntu these days and use the devsec Ansible hardening collection:

https://github.com/dev-sec/ansible-collection-hardening

specifically the os hardening: https://github.com/dev-sec/ansible-collection-hardening/tree/master/roles/os_hardening

(there are some links at the bottom of that page that give a bit more explanation)

 

To be honest though, fewer and fewer places are running full scale linux servers now, for a service like this I'd be inclined to stick in a container.

[Arthur]

It might be worth outsourcing the UniFi hosting to HostiFi. They would then deal with all of the patching etc.

[jmak]

Have you ruled out using a Cloud Key? It would seem a waste to run a Linux server (even a VM) just to run the Unifi controller.

 

I ran a Cloud Key gen 1 for years without problems despite the flakey reputation. The Gen 2 is supposed to be a great improvement.

[MatthewL]

We have best part of 500 AP's and various switches so will be hosted in house. Spinning another server up and patching isn't an issue.

 

I've just never had a Linux box with open access to the www before although its restricted to ports just need to ensure they are ssecure.

[mavhc]

Page 169/175 of https://dl.ui.com/guides/UniFi/UniFi_Controller_V5_UG.pdf suggests that they connect via http not https? Bizarre.

[Guest]

A good starting point would be: https://github.com/imthenachoman/How-To-Secure-A-Linux-Server