OpenBSD
Ask YC: Securing your servers?
11–20 of 25 posts
Re: Ask YC: Securing your servers?
#12this isn't an app realted but equally important...i think. i put everything behind a deployed firewall and layer3 manged switch. cisco plus 'ios' is good hardware solutions. run nagios for upkeep etc...
Re: Ask YC: Securing your servers?
#13Read Hardening Linux.
Re: Ask YC: Securing your servers?
#14Read Hardening Linux.
Yes. And after you do, realise that the process of hardening a base Linux server install takes more than 15 minutes. Linux is not a "silver bullet" for security right out of the box.
Re: Ask YC: Securing your servers?
#15One absolute rule for any *nix-based server: In /etc/ssh/sshd_config, disable root logins: PermitRootLogin no Even if you think your password ist strong. This will stop a majority of the brute-force password-guessing attacks. For extra credit, install denyhosts as well. It has stopped a _lot_ of bad guys trying to brute-force my servers.
More important is to routinely rotate strong root passwords. What most people neglect to mention, when denying root access to an SSH server, is that people then login with a second account, (you still need ssh), and then su - to root. So, all you've really done is moved the difficultly in logging onto the server from the root account, to the secondary account+root account. Your security is now based on the strength of that bi-pair of passwords. As others have mentioned, moving logins to RSA keys (very easy) is probably a better approach.
Re: Ask YC: Securing your servers?
#16deny by default and trust only people that need to know
Re: Ask YC: Securing your servers?
#17OpenBSD
It may seem flippant to just say OpenBSD but it's an awesome piece of software. I tend to deploy FreeBSD for historical reasons but I totally respect OpenBSD for it's complete and utter no nonsense approach to everything.
FreeBSD comes pretty locked down but OpenBSD is locked down as tight as a gnats arse. It's pretty safe to say that if your OpenBSD server is compromised it's something _you_ have done rather then something _you_ have NOT done. It's a good starting point.
Re: Ask YC: Securing your servers?
#18Ingress and egress packet filtering ( http://en.wikipedia.org/wiki/Egress_filtering ). Remove default route on all internal servers.
Re: Ask YC: Securing your servers?
#191. Expose the absolute minimum number of services (and even then only software with a good security reputation). 2. Lock them down as much as possible in configuration and access (for example: use iptables to restrict acces to only your home/office where possible). 3. Apply vendor security updates as quickly as possible (subscribe to mailing lists). 4. Remotely backup your data. 5. Hope for the best.
> 1. Expose the absolute minimum number of services (and even then only software with a good security reputation).
Perform a minimal install of your operating system then source compilation of latest services, with minimal features enabled. It is possible to compromise this configuration but it harder because there are less dormant features to exploit and it doesn't utilise widely used binaries.
Re: Ask YC: Securing your servers?
#201)Limit SSH logins to specific users
2)Get a proper /etc/sudoers
3)Use IP tables to limit SSH connections to trusted IP's/networks. Setup a port knock if you roam around a lot.
4)Read your daily logwatch
5)Turn off ports/services that are not in use (this is somewhat less necessary with a halfway decent iptables setup)
6)Use SSH keys instead of passwords!
7)Log to a syslog server that is highly secured as well
8)Run a nessus scan on your box regularly
9)Minimize how much specific information about your underlying OS various services display