```
Save/close file.
Restart fail2ban for settings to take effect.
```
sudo systemctl restart fail2ban
```
## :bear: Optional: Disable root account
System admins should not frequently log in as root in order to maintain server security. Instead, you can use sudo execute that require low-level privileges.
```bash
# To disable the root account, simply use the -l option.
sudo passwd -l root
```
```bash
# If for some valid reason you need to re-enable the account, simply use the -u option.
sudo passwd -u root
```
## :tools: Optional: Setup Two Factor Authentication for SSH
{% hint style="info" %}
SSH, the secure shell, is often used to access remote Linux systems. Because we often use it to connect with computers containing important data, it’s recommended to add another security layer. Here comes the two factor authentication (*2FA*).
{% endhint %}
```
sudo apt install libpam-google-authenticator -y
```
To make SSH use the Google Authenticator PAM module, edit the `/etc/pam.d/sshd` file:
```
sudo nano /etc/pam.d/sshd
```
Add the following line:
```
auth required pam_google_authenticator.so
```
Now you need to restart the `sshd` daemon using:
```
sudo systemctl restart sshd.service
```
Modify `/etc/ssh/sshd_config`
```
sudo nano /etc/ssh/sshd_config
```
Locate **ChallengeResponseAuthentication** and update to yes
```
ChallengeResponseAuthentication yes
```
Locate **UsePAM** and update to yes
```
UsePAM yes
```
Save the file and exit.
Run the **google-authenticator** command.
```
google-authenticator
```
It will ask you a series of questions, here is a recommended configuration:
* Make tokens “time-base”": yes
* Update the `.google_authenticator` file: yes
* Disallow multiple uses: yes
* Increase the original generation time limit: no
* Enable rate-limiting: yes
You may have noticed the giant QR code that appeared during the process, underneath are your emergency scratch codes to be used if you don’t have access to your phone: write them down on paper and keep them in a safe place.
Now, open Google Authenticator on your phone and add your secret key to make two factor authentication work.
{% hint style="danger" %}
**Note**: If you are enabling 2FA on a remote machine that you access over SSH you need to follow **steps 2 and 3** of [this tutorial](https://www.digitalocean.com/community/tutorials/how-to-set-up-multi-factor-authentication-for-ssh-on-ubuntu-18-04) to make 2FA work.
{% endhint %}
## :jigsaw: Optional: Secure Shared Memory
{% hint style="info" %}
One of the first things you should do is secure the shared [memory](https://www.lifewire.com/what-is-random-access-memory-ram-2618159) used on the system. If you're unaware, shared memory can be used in an attack against a running service. Because of this, secure that portion of system memory.
To learn more about secure shared memory, read this [techrepublic.com article](https://www.techrepublic.com/article/how-to-enable-secure-shared-memory-on-ubuntu-server/).
{% endhint %}
{% hint style="warning" %}
**One exceptional case**
There may be a reason for you needing to have that memory space mounted in read/write mode (such as a specific server application like **DappNode** that requires such access to the shared memory or standard applications like Google Chrome). In this case, use the following line for the fstab file with instructions below.
```
none /run/shm tmpfs rw,noexec,nosuid,nodev 0 0
```
The above line will mount the shared memory with read/write access but without permission to execute programs, change the UID of running programs, or to create block or character devices in the namespace. This a net security improvement over default settings.
**Use with caution**
With some trial and error, you may discover some applications(**like DappNode**) do not work with shared memory in read-only mode. For the highest security and if compatible with your applications, it is a worthwhile endeavor to implement this secure shared memory setting.
Source: [techrepublic.com](https://www.techrepublic.com/article/how-to-enable-secure-shared-memory-on-ubuntu-server/)
{% endhint %}
Edit `/etc/fstab`
```
sudo nano /etc/fstab
```
Insert the following line to the bottom of the file and save/close. This sets shared memory into read-only mode.
```
tmpfs /run/shm tmpfs ro,noexec,nosuid 0 0
```
Reboot the node in order for changes to take effect.
```
sudo reboot
```
## :woman\_astronaut: Optional: **Use** system user accounts - Principle of Least Privilege \[Advanced Users]
{% hint style="info" %}
**Recommended for Advanced Users Only**
**Principle of Least Privilege**: Each eth2 process is assigned a *system user account* and runs under the least amount of privileges required in order to function. This best practice protects against a scenario where a vulnerability or exploit discovered in a specific process might enable access other system processes.
{% endhint %}
```bash
# creates system user account for eth1 service
sudo adduser --system --no-create-home eth1
# creates system user account for validator service
sudo adduser --system --no-create-home validator
# creates system user account for beacon-chain service
sudo adduser --system --no-create-home beacon-chain
# creates system user account for slasher
sudo adduser --system --no-create-home slasher
```
{% hint style="danger" %}
:fire: **Caveats For Advanced Users**
If you decide to use **system user accounts**, remember to replace the **systemd unit files** with the corresponding users.
```bash
# Example of beacon-chain.service unit file
User = beacon-chain
```
Furthermore, ensure the correct **file ownership** is assigned to your **system user account** where applicable.
```bash
# Example of prysm validator's password file
sudo chown validator:validator -R $HOME/.eth2validators/validators-password.txt
```
{% endhint %}
## :sparkles: Additional validator node best practices
| | |
| ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Networking | Assign static internal IPs to both your validator node and daily laptop/PC. This is useful in conjunction with ufw and Fail2ban's whitelisting feature. Typically, this can be configured in your router's settings. Consult your router's manual for instructions. |
| Power Outage | In case of power outage, you want your validator machine to restart as soon as power is available. In the BIOS settings, change the **Restore on AC / Power Loss** or **After Power Loss** setting to always on. Better yet, install an Uninterruptable Power Supply (UPS). |
| Clear the bash history | When pressing the up-arrow key, you can see prior commands which may contain sensitive data. To clear this, run the following:
shred -u \~/.bash\_history && touch \~/.bash\_history
|
## :rocket: References
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}