How to secure a Ubuntu Server (part 2)
How to secure a Ubuntu Server (part 2)
Ubuntu Security Documentation
https://ubuntu.com/server/docs/securi...
0:00 - Intro
0:15 - Self Sign Certifications
1:00 - Install OpenSSL
sudo apt install openssl
1:44 - Generate the Key and password phrase
sudo openssl genrsa -des3 -out server.key 2048
Enter a new password
3:40 - Create the CSR, run the following command at a terminal prompt:
sudo openssl req -new -key server.key -out server.csr
Enter Password for key
Enter company information
7:00 - Creating a Self-Signed Certificate
sudo openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
8:17 - Installing the Certificate
You can install the key file server.key and certificate file server.crt, or the certificate file issued by your CA, by running following commands at a terminal prompt:
sudo cp server.crt /etc/ssl/certs
sudo cp server.key /etc/ssl/private
Now simply configure any applications, with the ability to use public-key cryptography, to use the certificate and key files. For example, Apache can provide HTTPS, Dovecot can provide IMAPS and POP3S, etc.
9:37 - Certification Authority
sudo mkdir /etc/ssl/CA
sudo mkdir /etc/ssl/newcerts
The CA needs a few additional files to operate, one to keep track of the last serial number used by the CA, each certificate must have a unique serial number, and another file to record which certificates have been issued:
Please look at documentation for this command.
sudo sh -c "echo '01' /etc/ssl/CA/serial"
sudo touch /etc/ssl/CA/index.txt
11:21 - The third file is a CA configuration file. Though not strictly necessary, it is very convenient when issuing multiple certificates. Edit /etc/ssl/openssl.cnf, and in the [ CA_default ] change:
sudo nano /etc/ssl/openssl.cnf
add the following:
Comment out RAND line with #
dir = /etc/ssl # Where everything is kept
database = $dir/CA/index.txt # database index file.
certificate = $dir/certs/cacert.pem # The CA certificate
serial = $dir/CA/serial # The current serial number
private_key = $dir/private/cakey.pem# The private key
12:44 - Next, create the self-signed root certificate:
sudo openssl req -new -x509 -extensions v3_ca -keyout cakey.pem -out cacert.pem -days 3650
Enter Company and cert information
14:14 - Now install the root certificate and key:
sudo mv cakey.pem /etc/ssl/private/
sudo mv cacert.pem /etc/ssl/certs/
15:20 - You are now ready to start signing certificates. The first item needed is a Certificate Signing Request (CSR), see Generating a Certificate Signing Request (CSR) for details. Once you have a CSR, enter the following to generate a certificate signed by the CA:
sudo openssl ca -in server.csr -config /etc/ssl/openssl.cnf
There should now be a new file, /etc/ssl/newcerts/01.pem, containing the same output. Copy and paste everything beginning with the line: ----BEGIN CERTIFICATE---- and continuing through the line: ---END CERTIFICATE---- lines to a file named after the hostname of the server where the certificate will be installed. For example mail.example.com.crt, is a nice descriptive name.
16:50 - Generate the Key and password phrase
sudo openssl genrsa -des3 -out server.key 2048
Enter a new password
17:54 - Skip this part if your already did this earlier.
Comment out RAND line with #
sudo openssl ca -in server.csr -config /etc/ssl/openssl.cnf
18:33 - Signing Cert
20:07 - Finally, copy the new certificate to the host that needs it, and configure the appropriate applications to use it. The default location to install certificates is /etc/ssl/certs. This enables multiple services to use the same certificate without overly complicated file permissions.
For applications that can be configured to use a CA certificate, you should also copy the /etc/ssl/certs/cacert.pem file to the /etc/ssl/certs/ directory on each server.
sudo cp /etc/ssl/certs/cacert.pem /etc/ssl/certs/
22:11 - Installing a root CA certificate in the trust store
sudo apt-get install -y ca-certificates
sudo cp local-ca.crt /usr/local/share/ca-certificates
sudo update-ca-certificates
Note: It is important to have the .crt extension on the file, otherwise it will not be processed.
After this point you can use Ubuntu’s tools like curl and wget to connect to local sites.
На этой странице сайта вы можете посмотреть видео онлайн How to secure a Ubuntu Server (part 2) длительностью часов минут секунд в хорошем качестве, которое загрузил пользователь Telifox 29 Ноябрь 2021, поделитесь ссылкой с друзьями и знакомыми, на youtube это видео уже посмотрели 86 раз и оно понравилось 2 зрителям. Приятного просмотра!
