Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Securing a Linux Server

spenserj.com

Post reply on HN
Print view View original

21–30 of 143 posts

Re: Securing a Linux Server

#21

Post by sturadnidge »

FooBarWidget wrote: post #18
sturadnidge wrote: post #16

I've never understood the compulsion to restrict outbound traffic on an internet facing server that you do not intend to be used by other (untrusted) people. If someone is good enough to own you with everything else locked down, they can change any firewall rules completely if they need to, or just tunnel out over an allowed port. Creating a non-root user then giving them carte blanche sudo rights is similarly odd to…

Or maybe there's a vulnerability in your web app that grants people shell access. In that case you'll still want to lock down their limited normal-user privileges.

Yes but even then you're still not protecting much by allowing HTTP... said user would still be able to download attack tools locally and use them.

Agreed it will still stop a script kiddie (do ppl even use that word anymore? Showing my age!) from running random crap on high ports, but thats about it.

Re: Securing a Linux Server

#22

Post by itry » 

  you’ll want to lock down SSH access entirely,
  and make sure that only you can get in
This sounds like Ubuntu is by default open to everybody via ssh. I find this hard to believe.

The whole article sounds like a lot of fud to me. For example, what benefit is there in creating a new user with sudo privileges instead of using root directly?

Re: Securing a Linux Server

#23

Post by sturadnidge »

saraid216 wrote: post #17
sturadnidge wrote: post #16

I've never understood the compulsion to restrict outbound traffic on an internet facing server that you do not intend to be used by other (untrusted) people. If someone is good enough to own you with everything else locked down, they can change any firewall rules completely if they need to, or just tunnel out over an allowed port. Creating a non-root user then giving them carte blanche sudo rights is similarly odd to…

While I agree with your reasoning (and personally wouldn't bother with such a restriction), there is a good reason and it's that while they're likely good enough to get root, they might not be or simply can't for some reason. And if they can't, then that extra measure could be worth its cost in time and effort.

Yeh i know what you mean, see reply to the other similar comment :)

Re: Securing a Linux Server

#24

Post by zokier »

np422 wrote: post #20

I've never been a fan of shunning/blocking ip-addresses based on number of wrong passwords. It's to easy to exploit as denial-of-service attack and can be used to lock out legitimate users. Possibly use a non-standard ssh port, make sure you disable ssh v1 and apply a password policy, allow password logins only for white listed users. Now you should be reasonably safe against brute force attacks and still have a syst…

> It's to easy to exploit as denial-of-service attack and can be used to lock out legitimate users.

Could you explain what's the "easy" way to DoS using fail2ban(or equivalent system)?

Re: Securing a Linux Server

#27

Post by scraplab »

itry wrote: post #22

you’ll want to lock down SSH access entirely, and make sure that only you can get in This sounds like Ubuntu is by default open to everybody via ssh. I find this hard to believe. The whole article sounds like a lot of fud to me. For example, what benefit is there in creating a new user with sudo privileges instead of using root directly?

Potentially that if the key is compromised, the holder still requires a password before gaining root access. But if your key is compromised, you probably have a bigger problem.

Re: Securing a Linux Server

#28

Post by DanBC »

itry wrote: post #22

you’ll want to lock down SSH access entirely, and make sure that only you can get in This sounds like Ubuntu is by default open to everybody via ssh. I find this hard to believe. The whole article sounds like a lot of fud to me. For example, what benefit is there in creating a new user with sudo privileges instead of using root directly?

> For example, what benefit is there in creating a new user with sudo privileges instead of using root directly?

Users should run with as few privileges as possible. Logging in as root requires two sets of keys.

Sudo logs all commands. The commands usable when using sudo can be limited, whereas root gives access to everything. Using sudo creates heightened awareness of risks.

Root is a high value target. Giving it a strong password is important, but locking it is better.

Re: Securing a Linux Server

#29

Post by jlkinsel »

sturadnidge wrote: post #16

I've never understood the compulsion to restrict outbound traffic on an internet facing server that you do not intend to be used by other (untrusted) people. If someone is good enough to own you with everything else locked down, they can change any firewall rules completely if they need to, or just tunnel out over an allowed port. Creating a non-root user then giving them carte blanche sudo rights is similarly odd to…

I've seen more compromised boxes than one can shake a stick at. There's all sorts of reasons that blocking egress is a great idea. Compromises are usually automated bots, and no, they're not smart enough to bring down iptables. Even if it's a human that's pwned you, it's frequently a stupid human, or a lazy human. It's just good practice to practice security in depth.
Post reply on HN