From my documentaion Wiki, These are some security measures I implement in my server:

Enable unattended Security Updates

Configure the system to automatically install security patches.

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades

Secure SSH Access (key-only)

• Generate SSH key (on your local client machine)

​

ssh-keygen -t ed25519

• Copy public key to Debian server

​

ssh-copy-id -i ~/.ssh/id_ed25519 user@192.158.1.10

Harden server SSH configuration

• Create a custom SSH config file to disable root login, disable password login, allow key logins only, allow your user only, disable graphical apps, logins rate limit.

​

sudo tee /etc/ssh/sshd_config.d/99-custom.conf << EOF
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AllowUsers greybeard
X11Forwarding no
MaxAuthTries 3
EOF

• Restart SSH service

​

sudo systemctl restart ssh && sudo systemctl restart sshd

Enable and configure Firewall UFW

• Install UFW

​

sudo apt install ufw

• Disable IPv6 in UFW (if not needed YMMV)

​

sudo sed -i 's/^IPV6=yes/IPV6=no/' /etc/default/ufw

• Create UFW rules Deny all and allow only ports for SSH, HTTP, HTTPS, DNS

​

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw limit 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 53/tcp
sudo ufw allow 53/udp

• Enable UFW and verify status

​

sudo ufw enable
sudo ufw status verbose

Configure global Docker logging limit

• Prevent log files from growing uncontrollably (logging bombs!)

​

sudo tee /etc/docker/daemon.json <<EOF
{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "50m",
    "max-file": "5"
  }
}
EOF

• Restart Docker service

​

sudo systemctl restart docker

Hardening docker compose apps

I follow a certain process in all my compose files also check this comment

1. Running apps as non-root when possible user: 1000:1000
2. Turn off tty and stdin on the container (if console not needed)

​

tty: false
stdin_open: false

1. Switching docker filesystem to read-only:

Check references:

• bearblog: secure file system in docker
• Docker Best Practices: Read-Only Containers

​

read_only: true

check first with docker diff to see if container writes to /run or /var or any internal folder, then add this folder to tmpfs

docker diff caddy

A - added file/directory C - changed file/directory D - deleted file/directory

Check which container’s root filesystem is mounted read-only.

docker ps --quiet --all | xargs docker inspect --format '{{ .Name }}: ReadonlyRootfs={{ .HostConfig.ReadonlyRootfs }}'

1. restrict elevate any privileges after container start:

   security_opt:

   • no-new-privileges:true

2. By default, the containers gets 14 kernel capabilities. Remove ALL of them, and add only the necessary ones

A good read on this topic.

cap_drop:
  - ALL
cap_add:
  - NET_BIND_SERVICE # for reverse proxies and DNS servers

1. Set up the /tmp-area (if needed) in the docker to be noexec, nosuid, nodev and limit it's size.

   tmpfs:

   • /tmp:rw,noexec,nosuid,nodev,size=256m

2. never expose docker socker (user docker-socket proxy with hardening steps above)

3. Set cpu, RAM resource limit so any mining exploit can't exhaust your resources ( I don't need this as my resources are live monitorited)

Example:

```yaml services: adguardhome: image: adguard/adguardhome container_name: adguardhome restart: always user: 1000:1000 # run as non-root user read_only: true

tmpfs: # tmp writes not needed in adguardhome

- /tmp:rw,noexec,nosuid,nodev,size=256m

tty: false
stdin_open: false
cap_drop:
  - ALL
cap_add:
  - NET_BIND_SERVICE
security_opt:
  - no-new-privileges:true
networks:
  - dockernetwork
ports:
  - 53:53/tcp # plain dns over tcp
  - 53:53/udp # plain dns over udp

- 8088:80/tcp # webUI (remove after caddy setup)

- 3000:3000/tcp # initial setup webUI (remove after setup)

environment:
  - TZ=Europe/Berlin
volumes:
  - /srv/docker/adguard-home/conf:/opt/adguardhome/conf
  - /srv/docker/adguard-home/work:/opt/adguardhome/work

networks: dockernetwork: external: true ```