10 grundlegende Schritte für die Serversicherheit

# Ed25519-Schlüssel erstellen
ssh-keygen -t ed25519 -C "server-name@rexe"

# Oder wenn Sie RSA verwenden möchten
ssh-keygen -t rsa -b 4096 -C "server-name@rexe"

# Vom lokalen Rechner ausführen
ssh-copy-id -i ~/.ssh/id_ed25519.pub benutzer@server-ip

# /etc/ssh/sshd_config bearbeiten
sudo nano /etc/ssh/sshd_config

# Diese Zeilen ändern:
PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin no

# SSH-Dienst neu starten
sudo systemctl restart sshd

# UFW installieren
sudo apt install ufw -y

# Standardrichtlinien festlegen
sudo ufw default deny incoming
sudo ufw default allow outgoing

# SSH erlauben
sudo ufw allow 22/tcp

# Webserver-Ports
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# UFW aktivieren
sudo ufw enable

# Fail2ban installieren
sudo apt install fail2ban -y

# Konfigurationsdatei erstellen
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

[DEFAULT]
bantime  = 3600
findtime = 600
maxretry = 5

[sshd]
enabled = true
maxretry = 3
bantime  = 86400

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure -plow unattended-upgrades

# Laufende Dienste auflisten
sudo systemctl list-units --type=service --state=running

# Offene Ports prüfen
sudo ss -tlnp

# Unnötige Dienste stoppen
sudo systemctl stop bluetooth
sudo systemctl disable bluetooth

sudo apt install libpam-pwquality -y

minlen = 12
ucredit = -1
lcredit = -1
dcredit = -1
ocredit = -1

# Lokales Backup mit rsync
rsync -avz --delete /var/www/ /backup/www/

# Cron-Job für automatisches Backup
0 2 * * * rsync -avz /var/www/ /backup/www/

# Datenbank-Backup
mysqldump -u root -p --all-databases | gzip > /backup/db_$(date +%Y%m%d).sql.gz

tail -f /var/log/auth.log
tail -f /var/log/syslog
grep "Failed password" /var/log/auth.log | tail -20

# SYN-Flood-Schutz
sudo iptables -A INPUT -p tcp --syn -m limit \
  --limit 1/s --limit-burst 3 -j ACCEPT
sudo iptables -A INPUT -p tcp --syn -j DROP

# Verbindungsanzahl-Limit (pro IP)
sudo iptables -A INPUT -p tcp --dport 80 -m connlimit \
  --connlimit-above 50 -j REJECT

sudo apt install certbot python3-certbot-nginx -y
sudo certbot --nginx -d example.com -d www.example.com

server {
    listen 443 ssl http2;
    ssl_protocols TLSv1.2 TLSv1.3;
    add_header Strict-Transport-Security "max-age=63072000" always;
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;
}