# サーバセキュリティ
**URL:** https://forum.ficusonline.com/t/topic/355
**Category:** Server
**Created:** [2020 年 3 月 21 日午後 2:51 UTC](https://forum.ficusonline.com/t/topic/355 "2020-03-21T14:51:43Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@tk-fuse](https://forum.ficusonline.com/u/tk-fuse)
#### Post date: [2020 年 3 月 21 日午後 2:51 UTC](https://forum.ficusonline.com/t/topic/355/1 "2020-03-21T14:51:44Z")
> **[Prevent DDoS Attacks on Cloud Servers with Open Source Software](https://www.globalsign.com/en/blog/how-to-prevent-a-ddos-attack-on-a-cloud-server)**
>
> Author and Co-Founder of Pickaweb, Tony Messer is back to tell you how to Prevent DDoS Attacks on a Cloud Server Using Open Source Software.
[https://www.supinfo.com/articles/single/4342-how-to-secure-your-linux-server-from-ddos-attack](https://www.supinfo.com/articles/single/4342-how-to-secure-your-linux-server-from-ddos-attack)
## DDoS Deflate
> **[GitHub - jgmdev/ddos-deflate: Fork of DDoS Deflate with fixes, improvements and...](https://github.com/jgmdev/ddos-deflate)**
>
> Fork of DDoS Deflate with fixes, improvements and new features.
## Fail2Ban
> **[GitHub - fail2ban/fail2ban: Daemon to ban hosts that cause multiple...](https://github.com/fail2ban/fail2ban)**
>
> Daemon to ban hosts that cause multiple authentication errors
## Apache mod\_evasive module
> **[How to Install and Configure ModEvasive with Apache on Ubuntu](https://www.atlantic.net/vps-hosting/how-to-install-and-configure-modevasive-with-apache-on-ubuntu/)**
>
> ModEvasive is an Apache web server module that helps you to protect your web server in the event of DoS, DDoS, and brute-force attacks.
**インストール**
```auto
$ sudo apt-get install apache2 apache2-utils -y
$ sudo apt-get install libapache2-mod-evasive -y
```
**Apacheモジュールとして有効になっているかどうか確認**
```auto
$ sudo apachectl -M | grep evasive
evasive20_module (shared)
```
**mod\_evasiveの設定**
```auto
$ sudo nano /etc/apache2/mods-enabled/evasive.conf
DOSHashTableSize 3097
DOSPageCount 2
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 100
#DOSEmailNotify root@ubuntu1804
DOSSystemCommand "su - someuser -c '/usr/local/bin/a2_evasive_ban_ip.sh %s'"
DOSLogDir "/var/log/mod_evasive"
```
**DOSSystemCommand** ：ブラックリストIPを検知した際のシェルスクリプトを指定します。
```auto
$ sudo nano a2_evasive_ban_ip.sh
#!/bin/sh
# Offending IP as detected by mod_evasive
IP=$1
# Path to iptables binary executed by user www-data through sudo
IPTABLES="/sbin/iptables"
# mod_evasive lock directory
MOD_EVASIVE_LOGDIR=/var/log/mod_evasive
# Add the following firewall rule (block IP)
$IPTABLES -I INPUT -s $IP -j DROP
# Unblock offending IP after 2 hours through the 'at' command; see 'man at' for further details
echo "$IPTABLES -D INPUT -s $IP -j DROP" | at now + 1 minute
# Remove lock file for future checks
rm -f "$MOD_EVASIVE_LOGDIR"/dos-"$IP"
```
**DOSLogDir** の作成
```auto
$ sudo mkdir /var/log/mod_evasive
$ sudo chown -R www-data:www-data /var/log/mod_evasive
```
**Apacheの再起動**
```auto
$sudo service apache2 restart
```
**動作テスト**
```auto
$ sudo perl /usr/share/doc/libapache2-mod-evasive/examples/test.pl
HTTP/1.1 400 Bad Request
HTTP/1.1 400 Bad Request
HTTP/1.1 400 Bad Request
HTTP/1.1 400 Bad Request
HTTP/1.1 400 Bad Request
HTTP/1.1 400 Bad Request
HTTP/1.1 400 Bad Request
HTTP/1.1 400 Bad Request
....
```
## FastNetMon
> **[GitHub - pavel-odintsov/fastnetmon: Very fast DDoS sensor with...](https://github.com/pavel-odintsov/fastnetmon)**
>
> Very fast DDoS sensor with sFlow/Netflow/IPFIX/SPAN support
## HAPROXY
> **[HAProxy - The Reliable, High Perf. TCP/HTTP Load Balancer](https://www.haproxy.org/)**
>
> Reliable, High Performance TCP/HTTP Load Balancer
## NGINX
> **[F5 NGINX Products](https://www.f5.com/products/nginx)**
## Cloudflare WAF (Web Application Firewall)
> **[Cloudflare Web Application Firewall](https://developers.cloudflare.com/waf/)**
>
> The Cloudflare Web Application Firewall (WAF) provides automatic protection from vulnerabilities and the flexibility to create custom rules.
> [@Cloudflare: プロキシ機能、サーバセキュリティ、Certbot DNS-01チャレンジ、WARP Client](https://forum.ficusonline.com/t/topic/494/3):
>
> Web Application Firewall (WAF) Cloudflareによるファイヤーウォール Security → Security Rules 各種条件設定してアクセスのフィルタリング Security → Settings → Bot Fight Mode Cloudflareの 「Bot Fight Mode (ボット戦闘モード)」 とは、機械学習を用いて、あなたのサ…
---
### Author:  [@tk-fuse](https://forum.ficusonline.com/u/tk-fuse)
#### Post date: [2020 年 3 月 22 日午前 2:41 UTC](https://forum.ficusonline.com/t/topic/355/2 "2020-03-22T02:41:41Z")
**apacheユーザの変更**
apache2デフォルトユーザ **www-data** の変更
```auto
$ sudo pico /etc/apache2/envvars
.....
# Since there is no sane way to get the parsed apache2 config in scripts, some
# settings are defined via environment variables and then used in apache2ctl,
# /etc/init.d/apache2, /etc/logrotate.d/apache2, etc.
export APACHE_RUN_USER=apache_user
export APACHE_RUN_GROUP=apache_user
....
```
```auto
$ sudo chown -R apache_user:apache_user /var/www/html
$ sudo chmod -R 7XX /var/www/html
```
www-dataによるawstats等関連サービスのアクセス権も変更すること。
> [@アクセスログ解析AWStatsの導入](https://forum.ficusonline.com/t/awstats/27/4):
>
> 3. Crontabの設定 www-dataにApacheログファイルの読み取り権限を付与しても、新規ログファイルが作成されると無効になり統計データに反映されません。 [https://bugs.launchpad.net/ubuntu/+source/awstats/+bug/1252467](https://bugs.launchpad.net/ubuntu/+source/awstats/+bug/1252467) awstatsという新規ユーザを作成し、このユーザをwww-data,admグループに追加します。 …
---
### Author:  [@tk-fuse](https://forum.ficusonline.com/u/tk-fuse)
#### Post date: [2020 年 3 月 22 日午前 9:40 UTC](https://forum.ficusonline.com/t/topic/355/3 "2020-03-22T09:40:24Z")
### mod\_evasive whitelist
>
---
### Author:  [@tk-fuse](https://forum.ficusonline.com/u/tk-fuse)
#### Post date: [2020 年 3 月 23 日午前 1:14 UTC](https://forum.ficusonline.com/t/topic/355/4 "2020-03-23T01:14:44Z")
## 5 Tools to Scan a Linux Server for Malware and Rootkits
> **[5 Tools to Scan a Linux Server for Malware and Rootkits](https://www.tecmint.com/scan-linux-for-malware-and-rootkits/)**
>
> The tools presented in this article are created for these security scans and they are able to identify Viruses, Malware, Rootkits, and Malicious behaviors.
**clamav freshclam エラー**
>
---
### Author:  [@tk-fuse](https://forum.ficusonline.com/u/tk-fuse)
#### Post date: [2020 年 3 月 25 日午前 4:07 UTC](https://forum.ficusonline.com/t/topic/355/5 "2020-03-25T04:07:37Z")
**Redis**
[https://www.howtoforge.com/install-and-secure-redis-server-on-debian-10/](https://www.howtoforge.com/install-and-secure-redis-server-on-debian-10/)
```auto
$ sudo nano /etc/redis/redis.conf
```
ファイル最後尾に以下追加:
```auto
maxmemory 64mb
maxmemory-policy allkeys-lru
```
[https://redis.io/docs/management/security/](https://redis.io/docs/management/security/)
### redis-cli
> **[Redis CLI](https://redis.io/docs/latest/develop/connect/cli/)**
>
> Overview of redis-cli, the Redis command line interface
```auto
$ redis-cli
127.0.0.1:6379> flushall
(error) NOAUTH Authentication required.
127.0.0.1:6379> AUTH xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
OK
127.0.0.1:6379> flushall
OK
127.0.0.1:6379> exit
/data # exit
```
>
- [FLUSHDB](http://redis.io/commands/flushdb) – Deletes all keys from the connection’s current database.
- [FLUSHALL](http://redis.io/commands/flushall) – Deletes all keys from all databases on current host.
---
### Author:  [@tk-fuse](https://forum.ficusonline.com/u/tk-fuse)
#### Post date: [2020 年 3 月 25 日午前 9:30 UTC](https://forum.ficusonline.com/t/topic/355/6 "2020-03-25T09:30:31Z")
### ModSecurity
**ドキュメント**
> **[Home](https://github.com/owasp-modsecurity/ModSecurity/wiki#ipMatch)**
>
> ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a rang...
**インストール**
[https://hostadvice.com/how-to/how-to-setup-modsecurity-for-apache-on-ubuntu-18-04/](https://hostadvice.com/how-to/how-to-setup-modsecurity-for-apache-on-ubuntu-18-04/)
```auto
$ sudo apt-get install libapache2-mod-security2
```
**設定ファイルの作成**
```auto
$ sudo cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf
```
**設定ファイルの編集**
```auto
$ sudo nano /etc/modsecurity/modsecurity.conf
SecRuleEngine = on
```
**既存ルールのバックアップ作成**
```auto
$ sudo mv /usr/share/modsecurity-crs /usr/share/modsecurity-crs.bk
```
**Githubから最新ルールのダウンロード**
```auto
$ sudo git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git /usr/share/modsecurity-crs
```
**ルールファイルのコピー**
```auto
$ sudo cp /usr/share/modsecurity-crs/crs-setup.conf.example /usr/share/modsecurity-crs/crs-setup.conf
```
**ルールファイルの指定**
```auto
$ sudo nano /etc/apache2/mods-enabled/security2.conf
IncludeOptional /usr/share/modsecurity-crs/*.conf
IncludeOptional /usr/share/modsecurity-crs/rules/*.conf
```
**Apache再起動**
```auto
$ sudo service apache2 restart
```
**ホワイトリスト**
[https://www.liquidweb.com/kb/whitelisting-in-modsec/](https://www.liquidweb.com/kb/whitelisting-in-modsec/)
```auto
$ sudo nano /etc/modsecurity/whitelist.conf
SecRule REMOTE_ADDR "^XX\.XX\.XX\.XX" "phase:1,nolog,allow,ctl:ruleEngine=off,id:20000221"
```
XXに任意のIPアドレスを適用します。idには以下のリザーブ以外の値を指定すること。
**Rule ID**
[https://www.modsecurity.org/CRS/Documentation/ruleid.html](https://www.modsecurity.org/CRS/Documentation/ruleid.html)
```auto
ID Reservations
1-99,999; reserved for local (internal) use. Use as you see fit but do not use this range for rules that are distributed to others.
100,000-199,999; reserved for rules published by Oracle.
200,000-299,999; reserved for rules published Comodo.
300,000-399,999; reserved for rules published at gotroot.com.
400,000-419,999; unused (available for reservation).
420,000-429,999; reserved for ScallyWhack .
430,000-439,999: reserved for rules published by Flameeyes
440,000-599,999; unused (available for reservation).
600,000-699,999; reserved for use by Akamai http://www.akamai.com/html/solutions/waf.html
700,000-799,999; reserved for Ivan Ristic.
900,000-999,999; reserved for the OWASP ModSecurity Core Rule Set project.
1,000,000-1,009,999; reserved for rules published by Redhat Security Team
1,010,000-1,999,999; unused (available for reservation)
2,000,000-2,999,999; reserved for rules from Trustwave’s SpiderLabs Research team
3,000,000-3,999,999; reserved for use by Akamai
4,000,000-4,099,999; reserved in use by AviNetworks
4,100,000-4,199,999; reserved in use by Fastly
4,200,000 and above; unused (available for reservation)
```
**適用ルール除外**
> **[How To Set Up mod\_security with Apache on Debian/Ubuntu | DigitalOcean](https://www.digitalocean.com/community/tutorials/how-to-set-up-mod_security-with-apache-on-debian-ubuntu)**
>
> Here’s how to set up mod\_security with Apache on Debian/Ubuntu.
**バーチャルホスト全体の適用ルール除外**
`` セクション
```auto
SecRuleEngine Off
```
**特定ディレクトリの適用ルール除外**
```auto
SecRuleEngine Off
```
または
```auto
SecRuleEngine Off
```
**特定ルールのみ適用除外**
```auto
SecRuleRemoveById 981173
```
---
### Author:  [@tk-fuse](https://forum.ficusonline.com/u/tk-fuse)
#### Post date: [2021 年 3 月 23 日午前 2:12 UTC](https://forum.ficusonline.com/t/topic/355/7 "2021-03-23T02:12:56Z")
### セキュリティ上必須の対応事項
**注）Fail2ban** との組合せにより、以下対応が不要となるかもしれません。
**1.自動更新**
```auto
$ sudo dpkg-reconfigure --priority=low unattended-upgrades
```
**2.サーバへアクセスできる専用ユーザserveradmin（名称任意）の作成とsudoグループへの所属**
```auto
$ sudo adduser serveradmin
$ sudo usermod -aG sudo serveradmin
```
**3.認証キーによるアクセス（パスワード不可）**
キーペア：プライベートキー・パブリックキーの作成
アクセス先（サーバ）にパプリックキー保存ディレクトリを作成
```auto
serveradmin@localhost:~$ mkdir ~/.ssh && chmod 700 ~/.ssh
```
アクセス元（クライアント）でキーペアを作成
```auto
$ ssh-keygen -b 4096
overwrite ---> YES
passphrase ---> NO
$ ls ~/.ssh
id_rsa ---> private key
id_rsa.pub ---> public key
```
サーバへパブリックキーをコピー（-P：ポートオプション）
```auto
$ scp -P xxxxx ~/.ssh/id_rsa.pub serveradmin@xx.xx.xx.xx:~/.ssh/authorized_keys
```
サーバへ再ログイン後、sshアクセスをキーペアしたクライアントだけに制限するように設定を変更します。
`/etc/ssh/sshd_config/50-cloud-init.conf`
```auto
PasswordAuthentication no
```
sshデーモン再起動
```auto
$ sudo service ssh restart
```