Questions tagged [hardening]

All about making systems more resilient against attacks

Filter by
Sorted by
Tagged with
0 votes
0 answers
36 views

Disable everything but a hidden command for root access

linux security and root access question.... I'm setting up a server that has a validator node running on it for a blockchain. I was trying to harden the security of my server. I set up ufw for all ...
user avatar
0 votes
0 answers
257 views

how to verify that Gratuitous ARP disabled in a Linux server?

Problem: I need to verify if Gratuitous ARP is disabled on a Linux server in the configuration files.
user avatar
1 vote
0 answers
196 views

hidepid=2 stopped working after an update. Kernel don't suppport “per-mount point”?

I am running arch linux hardened (5.11.13-hardened1-1-hardened) and have been setting hidepid=2 thru the fstab: proc /proc proc nosuid,nodev,noexec,hidepid=2,gid=proc 0 0 and ...
user avatar
  • 11
-1 votes
1 answer
91 views

Hardening of nsswitch.conf and sysctl.conf

I read somewhere (I forgot where) that the following should be set if I want to harden my linux, which is Ubuntu 18.04 in my case. However, using these values somehow caused a 504 Gateway Time-out for ...
user avatar
  • 3
1 vote
0 answers
208 views

Is it possible to use systemd on Gentoo with hardened/selinux profile?

Or I need to create custom profile which will combine settings from hardened/selinux and systemd profiles? Because I even can't unmask sys-apps/systemd or set USE-flag systemd on some package.
user avatar
  • 11
1 vote
0 answers
184 views

Fedora 30 : Ensure No Device Files are Unlabeled by SELinux

While hardening Fedora 30, I encountered this measure on open-scap.org and actually the command : sudo find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n" returns on ...
user avatar
  • 907
2 votes
1 answer
95 views

Stopping brute force attempts

"postfix/smtpd[28164]: warning: unknown[45.227.253.210]: SASL PLAIN authentication failed: authentication failure" Normally I'd use fail2ban however it seems that under the openvz container fail2ban ...
user avatar
  • 21
1 vote
2 answers
2k views

How can I unload a filesystem module in a RHEL 7 server in order to harden it?

I'm trying to harden my RHEL Linux server 7 according to the CIS guidelines, so I want to unload the cramfs. I typed the following command: modprobe -n -v cramfs and I got the following answer: ...
user avatar
  • 11
0 votes
2 answers
552 views

What is the default behaviour when we mount filesystem with `nodev` option?

I read this in "RH413 Red Hat Server Hardening" course that we mount the filesystems with nodev which then does not allow the special files/devices to be mounted from it. However, it did not show an ...
user avatar
  • 9
0 votes
1 answer
343 views

Is it useful to set the policies to DROP for all tables in Iptables?

I use iptables to secure my server. The default policies for all chains in the filter table have been set to DROP # iptables -t filter -L | grep -i \ (policy Chain INPUT (policy DROP) Chain FORWARD (...
user avatar
  • 3
4 votes
2 answers
2k views

Remove busybox from buildroot

As part of Linux hardening we want to remove busybox from filesystem created with buildroot. But I am not sure if system can boot without it. I am quite sure that there are init files that depends ...
user avatar
  • 1,307
0 votes
1 answer
90 views

Nagios compilation problem in hardened OS

I am trying to install nagios in hardened OS CentOS, but I can not: checking for a BSD-compatible install... /usr/bin/install -c checking build system type... x86_64-pc-linux-gnu checking host system ...
user avatar
  • 1
1 vote
1 answer
2k views

Ways to Harden Linux Kernel? [closed]

I am working on prototyping a product using 3.18 Linux kernel. I am trying to understand the ways to harden Linux Kernel? I am referring a documentation. The document refers to numerous configuration ...
user avatar
  • 332
4 votes
0 answers
529 views

lshw segfaults on Linux >= 4.8 due to hardened usercopy on many computers

We use a custom built opsi.org bootimage to automatically install Windows on customers' client computers. The userland of this bootimage is based on an upstream bootimage, with some modifications from ...
user avatar
2 votes
1 answer
1k views

Disabling the security hardening options for a `nix-shell` environment

In an attempt to build GCC (6.3) on NixOS (16.09), within a nix-shell, I get this: make[1]: Entering directory '<my-build-path>/coreboot/util/crossgcc/build-i386-elf-GCC/build-x86_64-pc-linux-...
user avatar
  • 367
1 vote
0 answers
70 views

Jail outgoing DNS queries to single group with iptables does not work

I am trying to block all DNS queries from my machine by default, and only allow them for specific group of users. I try these rules: sudo su groupadd dns-allowed iptables -A OUTPUT -p udp --dport 53 -...
user avatar
  • 11
1 vote
2 answers
340 views

Is Removal of Perl the Recommendation for Hardening a System? [closed]

I'm working on a BeagleBone Black shipped with Debian. Started reading the Securing Debian page, and part way through I see in a chapter 3 section 3.6.1 Removing Perl. Doing a quick google search ...
user avatar
  • 123
1 vote
1 answer
335 views

noexec flag for /tmp (OpenSUSE)

I would harden my OpenSUSE 42.2. If I put noexec flag for /tmp and /var/tmp locations mount, zypper could suffer for this? Possible issues could depend by single package working and needing but above ...
user avatar
6 votes
1 answer
10k views

What are the groups 'users' and 'other' for?

There is a proprietary document about system hardening/security standard stating that group users, nogroup, other, and some other groups should not contain any user except system administrators. I've ...
user avatar
  • 771
2 votes
1 answer
57 views

How to securely automate periodic website logins

I'm writing a webpage-monitoring program that, every hour, logs in to a website using Selenium and notifies me if the page has changed in a particular way. For example, this program can monitor my ...
user avatar
8 votes
3 answers
2k views

How to harden su with dpkg-statoverride?

I am reading an Ubuntu 14 hardening guide and this is one of the suggestions: It generally seems like a sensible idea to make sure that only users in the sudo group are able to run the su command ...
user avatar
  • 203
0 votes
1 answer
141 views

Is it safe to uninstall `su` in favor of `sudo` to harden Arch Linux? [closed]

Is it safe to uninstall su in favor of sudo to harden Arch Linux? Have you got an opinion on whether this is a good or bad idea? I read the Arch Linux Wiki articles Security, Su and Sudo. I also ...
user avatar
  • 2,108
2 votes
3 answers
445 views

Does it make sudo more secure when indexing all commands by their SHA-2 checksums?

I'm asking myself whether system security substantially increases when I generate a security policy, i.e. sudoers file which contains one or more Cmnd_Alias definitions that enumerate all executable ...
user avatar
  • 2,108
1 vote
3 answers
1k views

preventing DoS attack in Apache webserver

This is the version of apache we're using - httpd-2.2.15-39.el6.centos.x86_64 We recently had our website down due to DoS attack and hence started exploring iptables, and how to use it to prevent DoS ...
user avatar
  • 1,041
1 vote
2 answers
1k views

Using IPTables to Block Ports to Class A Subnets While Allowing Web Ports (80/443)

This is about a cPanel server which, like most servers, is under constant attack from lands afar. Considering that I only host to clients in the US and Canada, there is less of a reason to allow full ...
user avatar
  • 111
5 votes
1 answer
1k views

Why is the "harden" suite of packages not available for Debian Jessie (8.0)?

These include all the harden packages listed in the Debian automatic hardening documentation (https://www.debian.org/doc/manuals/securing-debian-howto/ch-automatic-harden.en.html), including: harden ...
user avatar
0 votes
1 answer
119 views

kernel security and IDS Firewall + AV together or not?

I try to hardening my server. For doing so, I got a general question: Should I install kernel security patches like selinux and an Anti-Virus with Intrusion Detection Firewall? Does it make sense to ...
user avatar
  • 61
6 votes
1 answer
391 views

Securing VPS against access by server company

I have a few linux VPS boxes that contain the private keys to Bitcoin. I've taken a few steps to harden them: Blocked all ports except those needed for my server with uncomplicated firewall Disabled ...
user avatar
  • 71
2 votes
1 answer
6k views

debian7 cron.allow & cron.deny files

Almost 3 weeks that, in my downtime, I try to find out where the files cron.allow & cron.deny are located in debian7 distro. No way, it seems that by default they are not in the system. 'Just' ...
user avatar
  • 2,646
3 votes
1 answer
775 views

unnecessary accounts in linux

It is recommended in hardening that unnecessary accounts be removed. Do these accounts include process and daemon accounts? What security problems exist with unnecessary user accounts? Can attackers ...
user avatar
  • 221
22 votes
3 answers
11k views

Myth or reality: SELinux can confine the root user?

I read or heard somewhere (maybe in LinuxCBT's SELinux course; but I'm not sure) that there are online Linux servers, for which the password of the root user is also given. The Linux server is ...
user avatar
2 votes
1 answer
323 views

LAMP Hardening, Transparent Proxy with iptables

I'm running a LAMP server with FTP(S) and several users. The users have only access to uploading PHP files and other web content. Some are running Drupal and Wordpress, but also a few home made stuff. ...
user avatar
  • 149
6 votes
2 answers
4k views

Deleting users with nologin shell

On a security audit performed on our production Linux servers , we were asked to remove nobody user if no application are using it. I checked and could see that there are no files owned by 'nobody' ...
user avatar
  • 2,736
4 votes
1 answer
5k views

How to disable remote access on a linux distribution?

So I've read in Mark Sobell's book on Linux, that Linux by default is open to remote administration. Now seen as I'm running a Fedora 17, on a laptop I never have to administrate anything on remotely, ...
user avatar
  • 51
36 votes
2 answers
20k views

How does one change the delay that occurs after entering an incorrect password?

After entering an incorrect password at a login prompt, there s an approximately 3-second delay. How can I change that on a Linux system with PAM?
user avatar
2 votes
2 answers
2k views

is stack-smashing protection on on Debian?

I heard that every binary that comes with Ubuntu is protected with stack-smashing protection and possibly other gcc features to harden programs against common security threats. What about Debian? I ...
user avatar
4 votes
2 answers
4k views

Hardening debian?

So I have thought a bit about hardening a Debian squeeze file & VPN server lately. Right now, we've placed the machine behind a firewall only allowing SSH connections from LAN, set a strong root ...
user avatar
  • 1,671
0 votes
1 answer
3k views

How to really security a linux-mint-desktop?

I'm installing some security software in my mint9Gnome. I first went to Firestarter and looks like a pretty start. Now I'm going to OSSEC and want some good tools to search my logs too. Thinking ...
user avatar
  • 276
20 votes
2 answers
9k views

What to use to harden Linux box? Apparmor, SELinux, grsecurity, SMACK, chroot?

I am planning to go back to Linux as a Desktop machine. I would like to make it more secure. And try a few hardening techniques, especially since I plan to get my own server. What would be a good, ...
user avatar
  • 1,266
9 votes
2 answers
4k views

Hide processes from other users based on groups (under Linux)?

Is it possible to configure process hiding for certain user groups under a linux system? For example: Users from group X should not see processes owned by users from group Y in ps/top or under /proc. ...
user avatar
  • 52.9k