Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [hardening]

All about making systems more resilient against attacks

0
votes
2answers
47 views

What is the default behaviour when we mount filesystem with `nodev` option?

I read this in "RH413 Red Hat Server Hardening" course that we mount the filesystems with nodev which then does not allow the special files/devices to be mounted from it. However, it did not show an ...
0
votes
1answer
68 views

Is it useful to set the policies to DROP for all tables in Iptables?

I use iptables to secure my server. The default policies for all chains in the filter table have been set to DROP # iptables -t filter -L | grep -i \ (policy Chain INPUT (policy DROP) Chain FORWARD (...
3
votes
2answers
472 views

Remove busybox from buildroot

As part of Linux hardening we want to remove busybox from filesystem created with buildroot. But I am not sure if system can boot without it. I am quite sure that there are init files that depends ...
0
votes
0answers
693 views

Enable root login from tty1 on CentOS 7

I have been trying to secure root login on a CentOS7 minimal installation. It became clear to me after all the research I did that /etc/securetty and /etc/security/access.conf must be modified in ...
0
votes
1answer
44 views

Nagios compilation problem in hardened OS

I am trying to install nagios in hardened OS CentOS, but I can not: checking for a BSD-compatible install... /usr/bin/install -c checking build system type... x86_64-pc-linux-gnu checking host system ...
0
votes
1answer
1k views

Ways to Harden Linux Kernel? [closed]

I am working on prototyping a product using 3.18 Linux kernel. I am trying to understand the ways to harden Linux Kernel? I am referring a documentation. The document refers to numerous configuration ...
4
votes
0answers
365 views

lshw segfaults on Linux >= 4.8 due to hardened usercopy on many computers

We use a custom built opsi.org bootimage to automatically install Windows on customers' client computers. The userland of this bootimage is based on an upstream bootimage, with some modifications from ...
2
votes
1answer
623 views

Disabling the security hardening options for a `nix-shell` environment

In an attempt to build GCC (6.3) on NixOS (16.09), within a nix-shell, I get this: make[1]: Entering directory '<my-build-path>/coreboot/util/crossgcc/build-i386-elf-GCC/build-x86_64-pc-linux-...
1
vote
0answers
58 views

Jail outgoing DNS queries to single group with iptables does not work

I am trying to block all DNS queries from my machine by default, and only allow them for specific group of users. I try these rules: sudo su groupadd dns-allowed iptables -A OUTPUT -p udp --dport 53 -...
1
vote
2answers
185 views

Is Removal of Perl the Recommendation for Hardening a System? [closed]

I'm working on a BeagleBone Black shipped with Debian. Started reading the Securing Debian page, and part way through I see in a chapter 3 section 3.6.1 Removing Perl. Doing a quick google search ...
1
vote
1answer
170 views

noexec flag for /tmp (OpenSUSE)

I would harden my OpenSUSE 42.2. If I put noexec flag for /tmp and /var/tmp locations mount, zypper could suffer for this? Possible issues could depend by single package working and needing but above ...
3
votes
1answer
2k views

What are the groups 'users' and 'other' for?

There is a proprietary document about system hardening/security standard stating that group users, nogroup, other, and some other groups should not contain any user except system administrators. I've ...
2
votes
1answer
38 views

How to securely automate periodic website logins

I'm writing a webpage-monitoring program that, every hour, logs in to a website using Selenium and notifies me if the page has changed in a particular way. For example, this program can monitor my ...
7
votes
3answers
1k views

How to harden su with dpkg-statoverride?

I am reading an Ubuntu 14 hardening guide and this is one of the suggestions: It generally seems like a sensible idea to make sure that only users in the sudo group are able to run the su command ...
0
votes
1answer
95 views

Is it safe to uninstall `su` in favor of `sudo` to harden Arch Linux? [closed]

Is it safe to uninstall su in favor of sudo to harden Arch Linux? Have you got an opinion on whether this is a good or bad idea? I read the Arch Linux Wiki articles Security, Su and Sudo. I also ...
1
vote
3answers
235 views

Does it make sudo more secure when indexing all commands by their SHA-2 checksums?

I'm asking myself whether system security substantially increases when I generate a security policy, i.e. sudoers file which contains one or more Cmnd_Alias definitions that enumerate all executable ...
1
vote
3answers
893 views

preventing DoS attack in Apache webserver

This is the version of apache we're using - httpd-2.2.15-39.el6.centos.x86_64 We recently had our website down due to DoS attack and hence started exploring iptables, and how to use it to prevent DoS ...
1
vote
2answers
929 views

Using IPTables to Block Ports to Class A Subnets While Allowing Web Ports (80/443)

This is about a cPanel server which, like most servers, is under constant attack from lands afar. Considering that I only host to clients in the US and Canada, there is less of a reason to allow full ...
5
votes
1answer
1k views

Why is the “harden” suite of packages not available for Debian Jessie (8.0)?

These include all the harden packages listed in the Debian automatic hardening documentation (https://www.debian.org/doc/manuals/securing-debian-howto/ch-automatic-harden.en.html), including: harden ...
0
votes
1answer
94 views

kernel security and IDS Firewall + AV together or not?

I try to hardening my server. For doing so, I got a general question: Should I install kernel security patches like selinux and an Anti-Virus with Intrusion Detection Firewall? Does it make sense to ...
6
votes
1answer
345 views

Securing VPS against access by server company

I have a few linux VPS boxes that contain the private keys to Bitcoin. I've taken a few steps to harden them: Blocked all ports except those needed for my server with uncomplicated firewall Disabled ...
2
votes
1answer
5k views

debian7 cron.allow & cron.deny files

Almost 3 weeks that, in my downtime, I try to find out where the files cron.allow & cron.deny are located in debian7 distro. No way, it seems that by default they are not in the system. 'Just' ...
3
votes
1answer
572 views

unnecessary accounts in linux

It is recommended in hardening that unnecessary accounts be removed. Do these accounts include process and daemon accounts? What security problems exist with unnecessary user accounts? Can attackers ...
19
votes
3answers
6k views

Myth or reality: SELinux can confine the root user?

I read or heard somewhere (maybe in LinuxCBT's SELinux course; but I'm not sure) that there are online Linux servers, for which the password of the root user is also given. The Linux server is ...
2
votes
1answer
294 views

LAMP Hardening, Transparent Proxy with iptables

I'm running a LAMP server with FTP(S) and several users. The users have only access to uploading PHP files and other web content. Some are running Drupal and Wordpress, but also a few home made stuff. ...
6
votes
2answers
3k views

Deleting users with nologin shell

On a security audit performed on our production Linux servers , we were asked to remove nobody user if no application are using it. I checked and could see that there are no files owned by 'nobody' ...
3
votes
1answer
3k views

How to disable remote access on a linux distribution?

So I've read in Mark Sobell's book on Linux, that Linux by default is open to remote administration. Now seen as I'm running a Fedora 17, on a laptop I never have to administrate anything on remotely, ...
32
votes
2answers
14k views

How does one change the delay that occurs after entering an incorrect password?

After entering an incorrect password at a login prompt, there s an approximately 3-second delay. How can I change that on a Linux system with PAM?
2
votes
2answers
2k views

is stack-smashing protection on on Debian?

I heard that every binary that comes with Ubuntu is protected with stack-smashing protection and possibly other gcc features to harden programs against common security threats. What about Debian? I ...
4
votes
2answers
3k views

Hardening debian?

So I have thought a bit about hardening a Debian squeeze file & VPN server lately. Right now, we've placed the machine behind a firewall only allowing SSH connections from LAN, set a strong root ...
0
votes
1answer
3k views

How to really security a linux-mint-desktop?

I'm installing some security software in my mint9Gnome. I first went to Firestarter and looks like a pretty start. Now I'm going to OSSEC and want some good tools to search my logs too. Thinking ...
20
votes
2answers
8k views

What to use to harden Linux box? Apparmor, SELinux, grsecurity, SMACK, chroot?

I am planning to go back to Linux as a Desktop machine. I would like to make it more secure. And try a few hardening techniques, especially since I plan to get my own server. What would be a good, ...
8
votes
2answers
3k views

Hide processes from other users based on groups (under Linux)?

Is it possible to configure process hiding for certain user groups under a linux system? For example: Users from group X should not see processes owned by users from group Y in ps/top or under /proc. ...