Reducing Attack Surfaces: A Practical Hardening Guide for Associations' Virtualmin Servers

Why Server Hardening Is Mandatory for Associations

Associations often manage sensitive member data – from addresses to bank details. An unsecured server is a gateway for attackers and a risk for GDPR compliance. In Art. 32, the General Data Protection Regulation requires "appropriate technical and organizational measures" to ensure a level of protection appropriate to the risk. This guide shows you how to reduce the attack surface of your Virtualmin server with simple means.

1. Securing SSH: The First Step

SSH is powerful, but also a popular target for brute-force attacks. Harden your SSH access with these measures:

• Keys Instead of Passwords: Disable password authentication and use SSH keys. This eliminates the risk of password guessing attacks.
• Prohibit Root Login: Set PermitRootLogin no and work with a regular user who has sudo privileges.
• Change the Port: An alternative SSH port (e.g., 2222) reduces automated scan attacks.
• Restrict Access: Allow SSH only from specific IP addresses (e.g., your association's office) or use a VPN.

You make these changes in /etc/ssh/sshd_config and restart the service with systemctl restart sshd.

2. Fail2ban: Automatic Defense Against Attacks

Fail2ban monitors log files and blocks IP addresses that stand out due to repeated failed attempts. Install it with apt install fail2ban (Debian/Ubuntu) and adjust the configuration:

• Jail for SSH: Enable the SSH jail and set maxretry = 3 and bantime = 3600.
• Protect Virtualmin/Webmin: Add a jail for Webmin to also block login attempts there.
• Notifications: Set up email alerts so you are informed about bans.

Fail2ban is a simple and effective measure that can also be operated by small teams.

3. Firewall Rules: Allow Only What Is Necessary

A restrictive firewall is essential. In Virtualmin, you can manage the firewall directly via the web interface (Webmin > Networking > Firewall). Alternatively, use ufw or iptables. The basic rule: Deny everything that is not explicitly needed.

• SSH: Only from trusted IPs or ports.
• HTTP/HTTPS: For websites and Virtualmin (port 10000) – ideally only via HTTPS.
• Mail Ports: Only open if you use email services.
• Databases: Make MySQL/PostgreSQL reachable only locally or via VPN.

With ufw allow 2222/tcp and ufw enable, you can quickly implement a basic firewall.

4. Automated Security Updates

Outdated software is one of the biggest security gaps. Set up automatic updates to install critical patches promptly:

• Unattended Upgrades: Install unattended-upgrades and configure it for security updates.
• Virtualmin Updates: Enable the automatic update function in Virtualmin for Webmin and related packages.
• Regular Review: Check monthly whether all updates have been installed, and restart if necessary.

This keeps your system up to date without you having to intervene manually every day.

5. GDPR Compliance Under Art. 32

The measures mentioned above are not only sensible from a security perspective, but also an important building block for GDPR compliance. Art. 32 requires, among other things:

• The ability to ensure the confidentiality, integrity, availability, and resilience of the systems.
• The regular review and assessment of the effectiveness of the technical measures.

Document your hardening measures and record how you verify them. In an emergency, this shows that you take your obligations seriously.

6. Further Hardening Tips

• Minimal Services: Disable all unnecessary services and ports.
• Regular Backups: Back up your data and test the restoration.
• Log Monitoring: Use tools such as logwatch or journalctl to detect suspicious activity.
• User Accounts: Assign strong passwords and use two-factor authentication for Virtualmin.

If you need a new server or want to expand your hosting, take a look at our web hosting packages and virtual servers. For domain questions, visit our domain page.