Brute Force Attack Prevention for Cloud Hosts

Running the Script

Run the hardening script (as shown in the preceding figure). The OS version and operation options are displayed. Select an option by typing the number.

Option Description

Note:

1:ALL

When you type 1, operations 2 to 7 will be executed automatically to harden the system. After that, type 9 to exit.

2:Set Password Complexity Requirements

Type 2 for the script to set the password complexity requirements. By default, the password must contain at least 12 characters comprising all of the following: digits, uppercase letters, lowercase letters, and special characters. If you want to set your own complexity requirements, follow the instructions in section 1.1.1 of the Best Practices.

3:Set Remote Login Configuration(SSH)

When you enter 3, the script will set the SSH protocol version to 2. Then you complete the configuration as prompted. Before disabling the root user login, make sure that at least one user is available for remote login. Restart the SSH service when you finish.

4:Set Shell History and TMOUT

When you select 4, the script will automatically configure HISTSIZE and HISTIMEFORMAT based on the Best Practices. Then, enter a value for the timeout period.

5:Set Key Login(SSH)

Type 5 for the script to configure SSH. The script will inject the public key after it's entered.

6:Set SSH Port

Note: Prior to selecting this option, prepare a pair of public and private keys as instructed in section 1.1.4 of the Best Practices. Restart the SSH service when you complete this option.

7:Set Su User

Type 6 and a port ID. The script will configure the port that you specify. If the port is occupied, you will be prompted to provide another. You need to restart the SSH service when this configuration is done.

8:Recover Configuration

Enter 7 and a username. The script will grant su permission to the user. Before selecting this option, ensure that you have created such a user.

9:Exit

This option recovers the system to the configuration backed up earlier. When the recovery is complete, you may need to restart SSH as prompted.

Select this option to exit the script when you have hardened or recovered the system.

Running the Script

Run the hardening script (as shown in the preceding figure). Select an option by typing the number.

Option Description

Note:

(9)Recover the Configuration

This option recovers the system to the configuration backed up earlier. When the recovery is complete, restart the system for the configuration to take effect.

(1)All the operation

When you type 1, operations 2 to 7 will be executed automatically to harden the system. After that, press Enter to exit.

(2)Set password complexity

Type 2 for the script to set the password complexity requirements based on the Excellent Practices. If you want to set your own requirements, follow the instructions in section 1.2.1 of the Excellent Practices.

(3)Set password history check

This option checks whether a password has been used before. Enter 3 and the script will configure the function automatically based on the Excellent Practices. If you want to configure it by yourself, follow the instructions in section 1.2.4 of the Excellent Practices.

(4)Set password lock conf

This option locks a user out after the user enters the wrong password for a configured number of times consecutively. When you select 4, the script will configure this function automatically. If you want to configure it by yourself, follow the instructions in section 1.2.3 of the Excellent Practices.

(5)Set default account

This option changes the username of the administrator account. Type 5 for the script to configure this function. You will be prompted to enter the username. For details, see section 1.2.2 of the Excellent Practices.

(6)Set disconnect timeout

Note: Remember the new username of the administrator; otherwise, you will fail to log in to the system.

(7)Hide the last login account

This option configures the timeout period of a session. Type 6 and the script will configure this function automatically. If you want to configure it by yourself, follow the instructions in section 1.2.6 of the Excellent Practices.

(8)Exit

This option allows you to hide the last login account. Enter 7 and the script will configure this function automatically. If you want to configure it by yourself, follow the instructions in section 1.2.5 of the Excellent Practices.

Select this option to exit the script when you have hardened or recovered the system.

Access Control

Use the security group function to control the access to management ports based on two principles: opening the fewest ports possible and blocking unauthorized requests sent to closed ports. As a result, only necessary, trusted sources are allowed access, thereby mitigating the potential for attacks.

Alternatively, you can use iptables for Linux OSs or firewalls for Windows OSs for the same purpose. For configuration details, see chapter 2 of the Excellent Practices.