FinClip uses container packaging for distribution and is deployed on Linux servers (Windows is also supported). For Linux system security configuration, you can refer to the following recommendations:

1. System Updates and Patches

• Update System Regularly: Use package managers to update software and kernels regularly, e.g., apt-get update && apt-get upgrade or yum update.
• Automatic Updates: Enable automatic update services, such as unattended-upgrades (Ubuntu) or dnf-automatic (CentOS).

2. User Accounts and Access Control

• Disable Default Accounts:

  • Prevent direct login as the root user. Edit /etc/ssh/sshd_config:

    PermitRootLogin no

  • Create non-privileged users for daily operations and escalate privileges using sudo.

• Strong Password Policy:

  • Use complex passwords and enable password complexity policies:

    /etc/security/pwquality.conf

  • Enforce password expiration using the chage tool.

• Limit Login Attempts:

  • Configure pam_tally2 or faillock to lock accounts after multiple failed login attempts.

3. SSH Security

• Change Default Port

  • Change the default SSH port from 22 to a non-standard port, such as 2222.

• Enable Key-Based Authentication

  • Disable password login and enforce SSH public key authentication:

    PasswordAuthentication no

• Restrict IP Addresses

  • Use firewall rules or /etc/hosts.allow and /etc/hosts.deny to allow login only from specific IPs.

4. Firewall and Network Configuration

• Enable Firewall:

  • Use ufw (Ubuntu) or firewalld (CentOS) to manage rules and restrict access to only necessary ports:

    ufw allow 22
    ufw deny 3306

• Disable Unnecessary Services:

  • Use systemctl or chkconfig to disable unused services:

    systemctl disable service_name

• Defend Against Port Scanning:

  • Configure iptables or use Fail2Ban to detect and block malicious access.

5. File and Directory Permissions

• Principle of Least Privilege:

  • Ensure file and directory permissions do not exceed what is necessary, for example:

    chmod 700 /root
    chmod 600 /etc/ssh/sshd_config

• Restrict Access to Critical Files:

  • Use ACL (setfacl) to further restrict user access to sensitive files.

6. Logging and Auditing

• Enable Log Auditing:

  • Configure auditd to monitor critical operations, such as file changes and account management:

    auditctl -w /etc/passwd -p wa

• Regularly Review Logs:

  • Analyze system logs in /var/log, such as auth.log and syslog.
  • Use log management tools, such as ELK or Loki.

7. Backup and Recovery

• Regular Backups

  • Use tools such as rsync or borg to back up data and verify recoverability.

• Off-Site Backups

  • Store backup data on remote servers or cloud storage.