Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Secure a Linux Server

github.com

Post reply on HN
Print view View original

101–108 of 108 posts

Re: How to Secure a Linux Server

#101

Post by zlynx »

imthenachoman wrote: post #84
zlynx wrote: post #61

Earlier quoted context omitted.

It might help protect against an OpenSSH zero-day but those are pretty rare. I've been running my home server with an completely open SSH port since 2012 and haven't been hacked yet. And I know since I check occasionally with Tripwire and/or RPM verification from a clean boot. The only downside to an open SSH port is the thousands and thousands of log spams from connection attempts. The upside is that I can log in fr…

Can you use Tripwire for free for home/consumer stuff? And what does RPM verification do? Just make sure all the packages you have installed are legit?

Tripwire is packaged up in Fedora. It's listed as GPLv2 licensed. So, yes.

RPM verification checks that all of the files installed through RPM have checksums that match the original RPM. It also checks that the RPM cryptographic signatures match.

So that should guarantee that files like the kernel, systemd, /bin/sh, /lib/libc.so.6, etc are not compromised.

A system can still be vulnerable to persistent attacks installed in unwatched files such as /root/.bash_profile, /etc/profile.d, extra files in /usr/systemd/system, etc. So you also have to check for extra files that you didn't install.

I don't have anything except Secure Boot to protect against UEFI attacks.

Re: How to Secure a Linux Server

#102

Post by imthenachoman »

zlynx wrote: post #101
imthenachoman wrote: post #84

Earlier quoted context omitted.

Can you use Tripwire for free for home/consumer stuff? And what does RPM verification do? Just make sure all the packages you have installed are legit?

Tripwire is packaged up in Fedora. It's listed as GPLv2 licensed. So, yes. RPM verification checks that all of the files installed through RPM have checksums that match the original RPM. It also checks that the RPM cryptographic signatures match. So that should guarantee that files like the kernel, systemd, /bin/sh, /lib/libc.so.6, etc are not compromised. A system can still be vulnerable to persistent attacks instal…

Got it. Thanks!

Re: How to Secure a Linux Server

#103

Post by imthenachoman »

z3t4 wrote: post #100
imthenachoman wrote: post #82

Earlier quoted context omitted.

I am not familiar with namespaces in this context? Can you please point me in the right direction? I have added AppArmor to my to-do list. I know what chroot and setuid are, not sure what to mention about them in the guide? And I will look into unix sockets. Can you recommend any good network scanning tools? I've been on the hunt for a good one.

I think the most useful for sysadmins are the network namespace that lets you put an app into it's own network, so it can not see the rest of the network. Container technology makes use of namespaces to create lightweight VM/containers. See man namespaces, lxc nmap is a popular tool for network scanning. I've also found tcpdump to be useful for looking at network traffic. setuid and chroot are useful for programmers,…

Got it. Thank you!

Re: How to Secure a Linux Server

#104

Post by imthenachoman »

wodny wrote: post #99
imthenachoman wrote: post #98

Earlier quoted context omitted.

This is great feedback! Thank you so much. I simplified things that would be too heavy to get into. The guide is not intended to teach everything about security -- that would be too much. The goal is to cover enough to give the reader a high level understanding. Once they have a basic understanding they can research more if they desire. Can you tell me some of the "exotic details where defaults would be sane enough"?…

> The guide is not intended to teach everything about security -- that would be too much. On the other hand, the objectives list contains: "this guide will attempt to cover as many of them as possible". Despite that, it still misses basic security rules. "A desktop class computer [...] That I want to be able to SSH to remotely from unknown computers and unknown locations (i.e. a friend's house)." SSH from an unknown…

The goal is to cover as many things as possible, not everything. Security is a very deep and complex topic -- no single document can cover everything. I want to wet the readers appetite to get them interested enough to learn more.

Thanks for that link -- never seen it before.

I was an SA for a Fortune 10 company for 5+ years supporting 150k+ servers but we don't need to get into comparing resumes here. I appreciate your time and don't want to waste more of it. However, if would like to continue the discussion maybe we can do it on GitHub? I don't care for HNs commenting style. Thanks!

Re: How to Secure a Linux Server

#105

Post by imthenachoman »

wodny wrote: post #89
imthenachoman wrote: post #74

Hey folks! I am the author of this guide. I did not know this was here or I would have commented sooner. This is my first time putting a guide like this together. I see a lot of really great feedback and I will be incorporating them into future updates. I don't have time today but I will reply individually to all the comments that I can. I appreciate any/all feedback/advice. If possible, could future issues be submit…

It has been mentioned in one of the pull request that this guide was being discussed on HN right after it got here: https://github.com/imthenachoman/How-To-Secure-A-Linux-Serve... . There are two fresh threads on Reddit: https://www.reddit.com/r/linuxadmin/comments/arx7xo/howtosec... https://www.reddit.com/r/linux/comments/arx7st/howtosecureal...

Holy crap! I did not see those two on Reddit. I had posted to Reddit and was monitoring those comments but didn't know of these. Thanks! Although, I'm sad both of those threads got more comments then the original one I posted. Not that it really matters in life. Heh.

And yes, I saw that pull request but I didn't know what HN was at that time. After I saw that comment, and before they said HN = Hacker News, I started Googling around to see if I could find where my repo was being mentioned. That is how I found this post in HN.

Thanks!

Re: How to Secure a Linux Server

#106

Post by imthenachoman »

jSherz wrote: post #7

The CIS benchmarks are a great place to start for hardening a system ( https://www.cisecurity.org/cis-benchmarks/ ) and there's also OpenSCAP gives you a nice way to scan systems for compliance against a set of hardening rules ( https://www.open-scap.org/ ).

I am in the process of going through one of their benchmarks right now. They have some good stuff but I'm on page 130 of 431 and so far I haven't come across anything that needed to be changed from a standard Debian install.

Re: How to Secure a Linux Server

#107

Post by imthenachoman »

Geee wrote: post #23
jSherz wrote: post #7

The CIS benchmarks are a great place to start for hardening a system ( https://www.cisecurity.org/cis-benchmarks/ ) and there's also OpenSCAP gives you a nice way to scan systems for compliance against a set of hardening rules ( https://www.open-scap.org/ ).

Thanks. What about using the hardened images they provide? https://www.cisecurity.org/cis-hardened-image-list/

From what I can tell, their images are only for the big three cloud providers.

Re: How to Secure a Linux Server

#108

Post by ThePhysicist »

imthenachoman wrote: post #91
ThePhysicist wrote: post #21

I would not recommend using “ufw” for configuring the firewall on a production server (as it’s not easily composable and lacks configurability for more complex rules). I can recommend “ferm” instead as it allows you to compose multiple config files (important for automation e.g. when using Ansible) and allows describing more complex rules that e.g. involve policies.

How would you define a production server? Do you mean in the context of a home server or a server used by a large company? The guide is intended for a server for home use. I hope anyone securing a large corporate server is not using information on GitHub. If they are then the company has far bigger problems than security. I think for home use, ufw is probably good enough. I've been using it for 3+ years and it's work…

Sorry, very late reply: We deploy all our infrastructure with Ansible, hence we want to have a way to configure the firewall for each role individually without overwriting previous configuration. For example, we have firewall rules for IP-Sec connections, SSH connections from the bastion host and then specific configurations for applications like databases or message queues. With ferm we can just create individual configs for each of these and put them in a directory where they are loaded sequentially and automatically. This allows us to iteratively define firewall rules and deploy different Ansible roles.

For a home server ufw is probably good enough, as I said I wouldn't recommend it for "serious" use in a highly automated environment.

Post reply on HN