Questions tagged [hardening]
All about making systems more resilient against attacks
45
questions
0
votes
1
answer
31
views
Detect changes made to VPS linux image by hosting company
My VPS hosting company injects "extras" into new Debian (and other) VPS images - scripts, network config, telemetry, etc.
How can I compare a new VPS against the official image, to see what ...
- 1,595
1
vote
1
answer
52
views
Sudoedit configuration
I'm hardening a Rhel8.6, and I got this report "The sudoedit program must be used when edit privileges are required.." The directory reported is /etc/sudoers/*
How can I set sudoedit to be ...
0
votes
0
answers
633
views
How does the use_pty sudoers option prevent a persistence attack?
As a rule in the Debian 10 hardening guide, and various other audit guides of the Center for Internet Security (CIS), setting the use_pty sudoers option is recommended for the following rationale:
...
- 1
1
vote
0
answers
32
views
Is it possible to harden systemd below 7.0 if my package needs permissions to install other packages?
I am not sure if my question has a proper answer but I still wanted to try.
I want to harden my app systemd, the problem is that my package needs permissions to install other packages (that is one of ...
- 121
-1
votes
1
answer
49
views
Malware for regular linux distros? [duplicate]
I heard many stories that Linux doesn't have viruses/malwares, but I used linux for a short period of time and not a power user yet. I have security concerns and want to hear what you have to say ...
0
votes
0
answers
84
views
Disable everything but a hidden command for root access
linux security and root access question....
I'm setting up a server that has a validator node running on it for a blockchain. I was trying to harden the security of my server. I set up ufw for all ...
0
votes
0
answers
800
views
how to verify that Gratuitous ARP disabled in a Linux server?
Problem:
I need to verify if Gratuitous ARP is disabled on a Linux server in the configuration files.
1
vote
0
answers
284
views
hidepid=2 stopped working after an update. Kernel don't suppport “per-mount point”?
I am running arch linux hardened (5.11.13-hardened1-1-hardened) and have been setting hidepid=2 thru the fstab:
proc /proc proc nosuid,nodev,noexec,hidepid=2,gid=proc 0 0
and ...
- 11
-1
votes
1
answer
185
views
Hardening of nsswitch.conf and sysctl.conf
I read somewhere (I forgot where) that the following should be set if I want to harden my linux, which is Ubuntu 18.04 in my case.
However, using these values somehow caused a 504 Gateway Time-out for ...
- 3
1
vote
0
answers
339
views
Is it possible to use systemd on Gentoo with hardened/selinux profile?
Or I need to create custom profile which will combine settings from hardened/selinux and systemd profiles? Because I even can't unmask sys-apps/systemd or set USE-flag systemd on some package.
- 11
1
vote
0
answers
231
views
Fedora 30 : Ensure No Device Files are Unlabeled by SELinux
While hardening Fedora 30, I encountered this measure on open-scap.org and actually the command :
sudo find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n"
returns on ...
- 981
2
votes
1
answer
159
views
Stopping brute force attempts
"postfix/smtpd[28164]: warning: unknown[45.227.253.210]: SASL PLAIN authentication failed: authentication failure"
Normally I'd use fail2ban however it seems that under the openvz container fail2ban ...
- 21
2
votes
2
answers
3k
views
How can I unload a filesystem module in a RHEL 7 server in order to harden it?
I'm trying to harden my RHEL Linux server 7 according to the CIS guidelines, so I want to unload the cramfs.
I typed the following command: modprobe -n -v cramfs
and I got the following answer:
...
- 21
0
votes
2
answers
716
views
What is the default behaviour when we mount filesystem with `nodev` option?
I read this in "RH413 Red Hat Server Hardening" course that we mount the filesystems with nodev which then does not allow the special files/devices to be mounted from it. However, it did not show an ...
- 9
0
votes
1
answer
445
views
Is it useful to set the policies to DROP for all tables in Iptables?
I use iptables to secure my server. The default policies for all chains in the filter table have been set to DROP
# iptables -t filter -L | grep -i \ (policy
Chain INPUT (policy DROP)
Chain FORWARD (...
- 3
4
votes
2
answers
2k
views
Remove busybox from buildroot
As part of Linux hardening we want to remove busybox from filesystem created with buildroot.
But I am not sure if system can boot without it.
I am quite sure that there are init files that depends ...
- 1,387
0
votes
1
answer
111
views
Nagios compilation problem in hardened OS
I am trying to install nagios in hardened OS CentOS, but I can not:
checking for a BSD-compatible install... /usr/bin/install -c
checking build system type... x86_64-pc-linux-gnu
checking host system ...
- 1
1
vote
1
answer
2k
views
Ways to Harden Linux Kernel? [closed]
I am working on prototyping a product using 3.18 Linux kernel.
I am trying to understand the ways to harden Linux Kernel? I am referring a documentation. The document refers to numerous configuration ...
- 342
3
votes
0
answers
591
views
lshw segfaults on Linux >= 4.8 due to hardened usercopy on many computers
We use a custom built opsi.org bootimage to automatically install Windows on customers' client computers. The userland of this bootimage is based on an upstream bootimage, with some modifications from ...
- 13.7k
4
votes
2
answers
2k
views
Disabling the security hardening options for a `nix-shell` environment
In an attempt to build GCC (6.3) on NixOS (16.09), within a nix-shell, I get this:
make[1]: Entering directory '<my-build-path>/coreboot/util/crossgcc/build-i386-elf-GCC/build-x86_64-pc-linux-...
- 397
1
vote
0
answers
91
views
Jail outgoing DNS queries to single group with iptables does not work
I am trying to block all DNS queries from my machine by default, and only allow them for specific group of users. I try these rules:
sudo su
groupadd dns-allowed
iptables -A OUTPUT -p udp --dport 53 -...
- 11
1
vote
2
answers
423
views
Is Removal of Perl the Recommendation for Hardening a System? [closed]
I'm working on a BeagleBone Black shipped with Debian. Started reading the Securing Debian page, and part way through I see in a chapter 3 section 3.6.1 Removing Perl. Doing a quick google search ...
- 123
1
vote
1
answer
398
views
noexec flag for /tmp (OpenSUSE)
I would harden my OpenSUSE 42.2. If I put noexec flag for /tmp and /var/tmp locations mount, zypper could suffer for this?
Possible issues could depend by single package working and needing but above ...
- 11
8
votes
1
answer
13k
views
What are the groups 'users' and 'other' for?
There is a proprietary document about system hardening/security standard stating that group users, nogroup, other, and some other groups should not contain any user except system administrators. I've ...
- 901
2
votes
1
answer
61
views
How to securely automate periodic website logins
I'm writing a webpage-monitoring program that, every hour, logs in to a website using Selenium and notifies me if the page has changed in a particular way. For example, this program can monitor my ...
- 163
8
votes
3
answers
2k
views
How to harden su with dpkg-statoverride?
I am reading an Ubuntu 14 hardening guide and this is one of the suggestions:
It generally seems like a sensible idea to make sure that only users
in the sudo group are able to run the su command ...
- 203
0
votes
1
answer
176
views
Is it safe to uninstall `su` in favor of `sudo` to harden Arch Linux? [closed]
Is it safe to uninstall su in favor of sudo to harden Arch Linux?
Have you got an opinion on whether this is a good or bad idea?
I read the Arch Linux Wiki articles Security, Su and Sudo. I also ...
- 2,180
2
votes
3
answers
540
views
Does it make sudo more secure when indexing all commands by their SHA-2 checksums?
I'm asking myself whether system security substantially increases when I generate a security policy, i.e. sudoers file which contains one or more Cmnd_Alias definitions that enumerate all executable ...
- 2,180
1
vote
3
answers
1k
views
preventing DoS attack in Apache webserver
This is the version of apache we're using - httpd-2.2.15-39.el6.centos.x86_64
We recently had our website down due to DoS attack and hence started exploring iptables, and how to use it to prevent DoS ...
- 1,061
1
vote
2
answers
2k
views
Using IPTables to Block Ports to Class A Subnets While Allowing Web Ports (80/443)
This is about a cPanel server which, like most servers, is under constant attack from lands afar. Considering that I only host to clients in the US and Canada, there is less of a reason to allow full ...
- 111
5
votes
1
answer
1k
views
Why is the "harden" suite of packages not available for Debian Jessie (8.0)?
These include all the harden packages listed in the Debian automatic hardening documentation (https://www.debian.org/doc/manuals/securing-debian-howto/ch-automatic-harden.en.html), including:
harden
...
- 857
0
votes
1
answer
120
views
kernel security and IDS Firewall + AV together or not?
I try to hardening my server. For doing so, I got a general question: Should I install kernel security patches like selinux and an Anti-Virus with Intrusion Detection Firewall? Does it make sense to ...
- 61
8
votes
1
answer
410
views
Securing VPS against access by server company
I have a few linux VPS boxes that contain the private keys to Bitcoin. I've taken a few steps to harden them:
Blocked all ports except those needed for my server with uncomplicated firewall
Disabled ...
- 91
2
votes
1
answer
6k
views
debian7 cron.allow & cron.deny files
Almost 3 weeks that, in my downtime, I try to find out where the files cron.allow & cron.deny are located in debian7 distro. No way, it seems that by default they are not in the system.
'Just' ...
- 2,706
3
votes
1
answer
835
views
unnecessary accounts in linux
It is recommended in hardening that unnecessary accounts be removed.
Do these accounts include process and daemon accounts?
What security problems exist with unnecessary user accounts?
Can attackers ...
- 221
22
votes
3
answers
12k
views
Myth or reality: SELinux can confine the root user?
I read or heard somewhere (maybe in LinuxCBT's SELinux course; but I'm not sure) that there are online Linux servers, for which the password of the root user is also given. The Linux server is ...
- 383
2
votes
1
answer
330
views
LAMP Hardening, Transparent Proxy with iptables
I'm running a LAMP server with FTP(S) and several users. The users have only access to uploading PHP files and other web content. Some are running Drupal and Wordpress, but also a few home made stuff. ...
- 149
6
votes
2
answers
4k
views
Deleting users with nologin shell
On a security audit performed on our production Linux servers , we were asked to remove nobody user if no application are using it.
I checked and could see that there are no files owned by 'nobody' ...
- 3,136
4
votes
1
answer
6k
views
How to disable remote access on a linux distribution?
So I've read in Mark Sobell's book on Linux, that Linux by default is open to remote administration. Now seen as I'm running a Fedora 17, on a laptop I never have to administrate anything on remotely, ...
- 51
36
votes
2
answers
22k
views
How does one change the delay that occurs after entering an incorrect password?
After entering an incorrect password at a login prompt, there s an approximately 3-second delay. How can I change that on a Linux system with PAM?
- 45.1k
2
votes
2
answers
2k
views
is stack-smashing protection on on Debian?
I heard that every binary that comes with Ubuntu is protected with stack-smashing protection and possibly other gcc features to harden programs against common security threats. What about Debian? I ...
- 23
4
votes
2
answers
4k
views
Hardening debian?
So I have thought a bit about hardening a Debian squeeze file & VPN server
lately.
Right now, we've placed the machine behind a firewall only allowing SSH connections from LAN, set a strong root ...
- 1,761
0
votes
1
answer
3k
views
How to really security a linux-mint-desktop?
I'm installing some security software in my mint9Gnome.
I first went to Firestarter and looks like a pretty start.
Now I'm going to OSSEC and want some good tools to search my logs too. Thinking ...
- 286
20
votes
2
answers
9k
views
What to use to harden Linux box? Apparmor, SELinux, grsecurity, SMACK, chroot?
I am planning to go back to Linux as a Desktop machine.
I would like to make it more secure. And try a few hardening techniques, especially since I plan to get my own server.
What would be a good, ...
- 1,276
9
votes
2
answers
4k
views
Hide processes from other users based on groups (under Linux)?
Is it possible to configure process hiding for certain user groups under a linux system?
For example: Users from group X should not see processes owned by users from group Y in ps/top or under /proc.
...
- 55.6k