SysAdmin Valley

Here are a few tips on how to get around in NANO

To edit a file type: nano filename
*** if you are using one of the legacy Linux servers, it will say NANO Command Not Found. Use PICO instead

• CTRL-Y – Page Up
• CTRL-V – Page Down
• CTRL-W – Where Is (Search)
• CTRL-K – Cut current line (press multiple times to multiple lines)
• CTRL-U – Paste lines just cut (if you cut multiple lines it will paste them all)
• CTRL-C – Word Count / Line Count / Current Position (will be displayed at bottom of page)
• CTRL-O then ENTER – Save file

• If no changes have been made, you can exit by hitting CTRL-X
• If changes have been made, but you DO NOT want to save, hit CTRL-X then N
• If changes have been made, but you DO WANT to save, hit CTRL-X then Y, then ENTER

Here are a few tips on how to get around in VI

To edit a file type: vi filename

Basic vi commands

• i – Change to insert mode (edit mode)
• CTRL-C – Change to command mode (exit edit mode)
• :w – Save the file being edited (command mode only)
• :wq – Save file and Quit (command mode only)
• :q – Quit (command mode only)
• :q! – Quit without saving (command mode only)
• h/j/k/l Navigation keys if your arrows break (command mode only) (Try pressing scroll-lock first to try and make arrows work)

The last thing you want is your Linux or Unix server to get hacked. And even though SSH is an encrypted there are a number of steps you can take to secure your SSH daemon. We will do 4 different things to secure sshd. For all these changes we will be editing the /etc/ssh/sshd_config file, use whatever is your favorite editor. In these examples we are leaving the commented lines for future reference.

Binding to 1 Port
First we bind SSHd to a specific port. We do this because hackers will expect that you are going to use port 22 for SSH. You can change it to any random 4 or 5 digit number.

Find where it says:

#Port 22

And enter a new line below it like this(change 7676 to your own number):

Port 7676

Binding to SSHv2
Next we are going to only allow access to SSH version 2, and not SSH version one. We do this because SSH version 2 is a more secure protocol.

Find where it says:

#Protocol 2,1

And enter a new line below it like this:

Protocol 2

Binding to 1 IP Address
Third we will bind SSHd to a single IP address. The reason we do this is imagine that you have a webserver with 5 IPs (192.168.1.2 – 192.168.1.6) and you have all your hosted clients on 192.168.1.2. Most people trying to gain access are going to try to connect to that IP address. To make it more secure, we will take one IP out of your allocated space and use it only for SSH access. We will call this our Server Administion IP, say 192.168.1.6.

Find where it says:

#ListenAddress 0.0.0.0

And enter a new line below it like this:

ListenAddress 192.168.1.6

As a side note, if you use IPv6, there is a line below #ListenAddress 0.0.0.0 that is #ListenAddress ::. You can use this format to bind to a IPv6 address.

Disabling SSH access via root account
Fourth, we are going to disable SSH access for the root account. We do this for security reasons. If for some reason your root password was comprimised, and root was allowed to SSH in, your system would be compromised. If you have disabled SSH access for root, then the hacker would have to also figure out another authorized user’s password to SSH in, then su to root. So this provides one more layer of security. But this does not protect against bad passwords.

Find where it says:

#PermitRootLogin yes

And enter a new line below it like this:

PermitRootLogin no

Make the changes take effect
The last thing we need to do is restart the SSH process. This depends on which distribution you are running, but more RedHat based distros do it this way:

/etc/init.d/sshd restart

Finally, to gain access to your system, you would now ssh to 192.168.1.6 port 7676