Hardening and Tightening Security on Your Server/Network
|
|
Hardening Methodology
|
- Read the various Security and Hardening HowTo
- Create a Network and System Admin Policy
- Install from a Linux CDROM into the properly sized disk partitions
- Apply all Patches for that particular linux distribution
- Compile and install your own kernel Kernel-HOWTO
- Turn off unused daemons and harden services , Change file/directory permissions
- Add additional security updates for various servers
- Test/Audit your new server for Exploits/Vulnerabilities
- Install and Monitor Your Servers and Networks
- Install your Intruder Detection System ( IDS )
- Backup your tested/clean server
- Read and Understand your Security log files and messages
- Send yourself emails and pages when a security breach occured
- Upon a security breach, Find out how, when they got into your system and fix the vulnerability
- Repeat from the beginning with the cdrom installs
|
Server Hardening Script
|
- No Time to Read ? ... Don't Understand what to do ?
- harden.pl
script to be created
|
Hardening HowTo & FAQs
|
|
| Network and Server Policy |
|
| Harden and Patch Your Servers |
- Always test your changes on your test machines/farms before applying changes to your production servers
- Kernel-Hardening-HowTO
- Compile and Install your own custom kernel
- Turn off unused kernel options
- Turn off kernel modules
- Install OpenWall - stops most buffer overflow, stops /tmp race condition
- Install LibSafe defend against buffer overflow ( stack smashing )
Apply all the Security Patches and Updates for your distro
Install SSH, SSL
Disallow ftp/telnet connections - use ssh instead
Install secure pop3/imapd servers for email clients
Apply Additional Security Precautions to Secure Your Dedicated Servers
Use TCP_Wrappers ( hosts.allow and hosts.deny )
Turn Un-necessary Daemons and Services in inetd
FileSystem Hardening
Services Hardening
Tighten your user login process - require ssh/ssl login only
|
| Monitor Your Servers and Network |
|
| Implement Intruder Detection Systems ( IDS ) |
|
| Audit Your Server for Vulnerabilities |
- Audit
your server for known exploits and vulnerabilities
- Anything you forgot to check could prove extremely disasterous
- Check for Buffer Overflows
- Check for open ports
- Check for known exploits
|
| Analyze, Read and Understand Your Log Files |
|
| Implement Backup System |
- Make a Backup copy of the "virgin system" BEFORE going live
- Assume the intruder erases your disk... can you recover your data within an hour or two...
- Be sure your Backups are protected against backup failures"
- Test your Backups and restore your system on a new disk
|
| Tracking, Tracking Your Attackers |
- Check into and Track Down your Attackers before it beomes a serious security breach
- All binaries on a compromised system are to be considered suspect until verified against the original cdrom
- Boot from a separate boot media to examine compromised systems
|
| Send yourself Emails and Pages |
- Your IDS should page you immediately upon a root compromise
|