4

Are there any tools to check my server's file system for permission vulnerabilities?

My server is a low-security web and email server running our local email and website. Anyone in my organization can use the server, but currently I'm the only user.

I plan on giving user-level access to people and I want to be sure that if they go playing around (perfectly ok), they can't break anything important, like conf files and such. In my case if a conf file is deleted I'll just recreate it, no money loss or anything, but I'd rather not have to spend the time doing that.

5
  • This is very very broad: anything from "fan speed" to "hard drive diagnostics" to "disk filling up" to "log file X growing rapidly" to "am I fully patched" to "are there users logged in" would fall under "checking if the server is falling apart (or compromised)". As a meta-solution, many people find tools like nagios useful for monitoring. Dec 28, 2014 at 10:02
  • I changed the question to be more specific. I've never seen a hold before, how do I request a review? Also I'll check out nagios, so far it looks like a perfect answer. Dec 29, 2014 at 3:11
  • 1
    I've cast a vote to reopen (needs four other people to agree with me and then you can get answers again). Dec 29, 2014 at 7:25
  • Tripwire, samhain, OSSEC, AIDE are common solutions for detecting unexpected file modification
    – derobert
    Dec 29, 2014 at 18:06
  • 1
    His question was more from a permissions/vulnerability standpoint.
    – Wadih M.
    Jan 27, 2017 at 21:14

2 Answers 2

0

My first recommendation would be to have the system update automatically.

Assuming a Debian system, if not you can find the equivalent commands.

apt-get update
apt-get upgrade

Put them in a daily cron job, to update regularly. However also do it manually once in a while as sometimes those updates need a manual input. Newer versions of apt-get support an unattended switch for updates as well, but I still like to run it myself once in a while. Gives me peace of mind.

Then I recommend that you look for the EOL (End of life) of the linux distribution you deployed.

Assuming a Debian system, you can find them all on that page. https://wiki.debian.org/DebianReleases

For example at the time of this post:

Version Code name   Release date        End of life date
8.0     Jessie      April 25th 2015     ~June 6th 2018 (full) / ~June 6th 2020 (LTS)

That gives you a deadline of June 6th 2018 if you installed Jessie where you should be going back and upgrading the apt sources to jump to the next version.

Keep in mind that with LTS (long term support) your distribution will still be getting security updates for a period after the end of life, however it's not forever.

Don't let your server be part of the next https://shodan.io worldwide vulnerability report.

Some other steps that would be relevant for your needs:

  • Setup your other users as regular users with ID > 1000
  • Setup a cron job to report to you all world-writable files by email
  • Disable root password logins from SSH to avoid someone brute forcing it from the inside
0

You could use some host-oriented IDS tool that check for system file integrity. Ossec is a good example. It sends mail alerts when detect some system file is modified.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .