Security Hardening of Your Virtualmin Server for Associations: Fail2ban, SSH, TLS, and Role Permissions as a Checklist

Why Security Hardening Is Especially Important for Associations

Associations often manage sensitive member data, newsletters, and sometimes payment information. An unsecured server is an easy target for attackers. With proper hardening, you protect not only your members' data but also trust in your association. In this checklist, we show you how to make your Virtualmin server significantly more secure with simple measures.

1. Fail2ban: Automatic Defense Against Attacks

Fail2ban monitors log files and blocks IP addresses that stand out due to repeated failed login attempts. This effectively stops brute-force attacks on SSH, FTP, or web applications.

Installation and Configuration

• Install Fail2ban via your package manager: apt install fail2ban or yum install fail2ban.
• Create a local configuration file /etc/fail2ban/jail.local to override default values.
• Enable jails for SSH, Apache/Nginx, and if necessary Postfix/Dovecot.
• Adjust bantime, findtime, and maxretry to your needs.

Virtualmin already offers an integration for Fail2ban, which you can enable under Webmin > Network > Fail2Ban.

2. Securing SSH: The Key to More Security

SSH is the most popular entry point for attackers. With a few measures, you can make it significantly more resilient.

Important Measures

• Disable password authentication: Use SSH keys instead. In /etc/ssh/sshd_config, set PasswordAuthentication no.
• Prohibit root login: PermitRootLogin no prevents direct root logins.
• Change port: A port other than 22 reduces automated attacks (optional).
• Allow only specific users: Use AllowUsers to restrict access.
• Fail2ban for SSH: Ensure that the SSH jail is active.

After changes, always run sshd -t for testing and systemctl reload sshd to reload.

3. TLS Certificates: Encrypted Communication

Without TLS, data is transmitted in plain text. Virtualmin makes setting up Let's Encrypt certificates easy.

How to Set Up TLS

• Go to Virtualmin > Configure Server > SSL Certificate and select Let's Encrypt.
• Enable automatic renewal.
• Force HTTPS for all domains by setting up a redirect from HTTP to HTTPS.
• Use HSTS (HTTP Strict Transport Security) to bind browsers to HTTPS.

For domains and hosting, we recommend our domain services and web hosting packages.

4. Role Permissions: Least Privilege

In Virtualmin, you can assign users different permissions. Grant only the permissions that are actually needed.

Best Practices

• Create separate users for administrators and regular users.
• Use the Virtualmin roles (e.g., Domain Administrator, Email User) and customize them.
• Disable unused modules and features.
• Regularly review permissions and remove outdated accounts.

More tips can be found in our knowledge base.

5. Additional Hardening Measures

• Regular updates: Keep the operating system and Virtualmin up to date.
• Firewall: Use iptables or ufw to open only necessary ports.
• Backups: Create regular backups and test restoration.
• Monitoring: Monitor logs and system resources to detect attacks early.

For associations with their own server, it's worth taking a look at our virtual servers, which you can configure according to your security requirements.

Conclusion: More Security Through Systematic Approach

Hardening your Virtualmin server is not a one-time act but an ongoing process. With Fail2ban, SSH protection, TLS, and well-thought-out role permissions, you cover the most common attack vectors. This way, you can focus on your association's work while keeping your data secure.