Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more

Questions tagged [hardening]

All about making systems more resilient against attacks

Filter by
Sorted by
Tagged with
0 votes
0 answers
49 views

Is xinetd necessary? How to detect actual use on a running server?

I have "inherited" a CentOS 7 server on which xinetd is automatically started at boot. My task is to harden that server. Therefore I am wondering whether I can disable the xinetd service. ...
Ned64's user avatar
  • 8,764
0 votes
2 answers
69 views

Is it possible to redirect files in a readonly filesystem?

Let's assume that I have created a linux image with a filesystem that is inherently readonly (like SquashFS) and disabled swap. From readonly I mean the main filesystem and all its content is readonly ...
Afshin's user avatar
  • 115
0 votes
1 answer
42 views

Does my office/lab server need to be providing these services?

I'm trying to figure out what services my university Ubuntu 22.04 computer needs to provide to other machines. I often ssh into this machine and other computers in my lab use it as an NFS server. I ...
mikemtnbikes's user avatar
0 votes
1 answer
47 views

Detect changes made to VPS linux image by hosting company

My VPS hosting company injects "extras" into new Debian (and other) VPS images - scripts, network config, telemetry, etc. How can I compare a new VPS against the official image, to see what ...
lonix's user avatar
  • 1,753
1 vote
1 answer
106 views

Sudoedit configuration

I'm hardening a Rhel8.6, and I got this report "The sudoedit program must be used when edit privileges are required.." The directory reported is /etc/sudoers/* How can I set sudoedit to be ...
Nathan Velasque's user avatar
5 votes
0 answers
2k views

How does the use_pty sudoers option prevent a persistence attack?

As a rule in the Debian 10 hardening guide, and various other audit guides of the Center for Internet Security (CIS), setting the use_pty sudoers option is recommended for the following rationale: ...
Flo's user avatar
  • 51
1 vote
0 answers
35 views

Is it possible to harden systemd below 7.0 if my package needs permissions to install other packages?

I am not sure if my question has a proper answer but I still wanted to try. I want to harden my app systemd, the problem is that my package needs permissions to install other packages (that is one of ...
Peksio's user avatar
  • 121
-1 votes
1 answer
73 views

Malware for regular linux distros? [duplicate]

I heard many stories that Linux doesn't have viruses/malwares, but I used linux for a short period of time and not a power user yet. I have security concerns and want to hear what you have to say ...
KramGrebrekuz's user avatar
0 votes
0 answers
130 views

Disable everything but a hidden command for root access

linux security and root access question.... I'm setting up a server that has a validator node running on it for a blockchain. I was trying to harden the security of my server. I set up ufw for all ...
brent-franklin's user avatar
0 votes
0 answers
1k views

how to verify that Gratuitous ARP disabled in a Linux server?

Problem: I need to verify if Gratuitous ARP is disabled on a Linux server in the configuration files.
Coding_A_Nation's user avatar
1 vote
0 answers
356 views

hidepid=2 stopped working after an update. Kernel don't suppport “per-mount point”?

I am running arch linux hardened (5.11.13-hardened1-1-hardened) and have been setting hidepid=2 thru the fstab: proc /proc proc nosuid,nodev,noexec,hidepid=2,gid=proc 0 0 and ...
ihet's user avatar
  • 11
-1 votes
1 answer
251 views

Hardening of nsswitch.conf and sysctl.conf

I read somewhere (I forgot where) that the following should be set if I want to harden my linux, which is Ubuntu 18.04 in my case. However, using these values somehow caused a 504 Gateway Time-out for ...
keysha's user avatar
  • 3
1 vote
0 answers
447 views

Is it possible to use systemd on Gentoo with hardened/selinux profile?

Or I need to create custom profile which will combine settings from hardened/selinux and systemd profiles? Because I even can't unmask sys-apps/systemd or set USE-flag systemd on some package.
Armoken's user avatar
  • 11
1 vote
0 answers
264 views

Fedora 30 : Ensure No Device Files are Unlabeled by SELinux

While hardening Fedora 30, I encountered this measure on open-scap.org and actually the command : sudo find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n" returns on ...
John Doe's user avatar
  • 1,011
2 votes
1 answer
184 views

Stopping brute force attempts

"postfix/smtpd[28164]: warning: unknown[45.227.253.210]: SASL PLAIN authentication failed: authentication failure" Normally I'd use fail2ban however it seems that under the openvz container fail2ban ...
Robert's user avatar
  • 21
2 votes
2 answers
4k views

How can I unload a filesystem module in a RHEL 7 server in order to harden it?

I'm trying to harden my RHEL Linux server 7 according to the CIS guidelines, so I want to unload the cramfs. I typed the following command: modprobe -n -v cramfs and I got the following answer: ...
Housna's user avatar
  • 21
0 votes
2 answers
865 views

What is the default behaviour when we mount filesystem with `nodev` option?

I read this in "RH413 Red Hat Server Hardening" course that we mount the filesystems with nodev which then does not allow the special files/devices to be mounted from it. However, it did not show an ...
root's user avatar
  • 9
0 votes
1 answer
548 views

Is it useful to set the policies to DROP for all tables in Iptables?

I use iptables to secure my server. The default policies for all chains in the filter table have been set to DROP # iptables -t filter -L | grep -i \ (policy Chain INPUT (policy DROP) Chain FORWARD (...
Zetam's user avatar
  • 3
4 votes
2 answers
3k views

Remove busybox from buildroot

As part of Linux hardening we want to remove busybox from filesystem created with buildroot. But I am not sure if system can boot without it. I am quite sure that there are init files that depends ...
ransh's user avatar
  • 1,427
0 votes
1 answer
131 views

Nagios compilation problem in hardened OS

I am trying to install nagios in hardened OS CentOS, but I can not: checking for a BSD-compatible install... /usr/bin/install -c checking build system type... x86_64-pc-linux-gnu checking host system ...
0xGJx0's user avatar
  • 1
1 vote
1 answer
2k views

Ways to Harden Linux Kernel? [closed]

I am working on prototyping a product using 3.18 Linux kernel. I am trying to understand the ways to harden Linux Kernel? I am referring a documentation. The document refers to numerous configuration ...
sob's user avatar
  • 382
3 votes
0 answers
623 views

lshw segfaults on Linux >= 4.8 due to hardened usercopy on many computers

We use a custom built opsi.org bootimage to automatically install Windows on customers' client computers. The userland of this bootimage is based on an upstream bootimage, with some modifications from ...
Martin von Wittich's user avatar
4 votes
2 answers
2k views

Disabling the security hardening options for a `nix-shell` environment

In an attempt to build GCC (6.3) on NixOS (16.09), within a nix-shell, I get this: make[1]: Entering directory '<my-build-path>/coreboot/util/crossgcc/build-i386-elf-GCC/build-x86_64-pc-linux-...
Andrew's user avatar
  • 397
1 vote
0 answers
108 views

Jail outgoing DNS queries to single group with iptables does not work

I am trying to block all DNS queries from my machine by default, and only allow them for specific group of users. I try these rules: sudo su groupadd dns-allowed iptables -A OUTPUT -p udp --dport 53 -...
Martin's user avatar
  • 11
1 vote
2 answers
694 views

Is Removal of Perl the Recommendation for Hardening a System? [closed]

I'm working on a BeagleBone Black shipped with Debian. Started reading the Securing Debian page, and part way through I see in a chapter 3 section 3.6.1 Removing Perl. Doing a quick google search ...
杜興怡's user avatar
  • 123
1 vote
1 answer
455 views

noexec flag for /tmp (OpenSUSE)

I would harden my OpenSUSE 42.2. If I put noexec flag for /tmp and /var/tmp locations mount, zypper could suffer for this? Possible issues could depend by single package working and needing but above ...
Johfount's user avatar
9 votes
1 answer
15k views

What are the groups 'users' and 'other' for?

There is a proprietary document about system hardening/security standard stating that group users, nogroup, other, and some other groups should not contain any user except system administrators. I've ...
fikr4n's user avatar
  • 941
2 votes
1 answer
66 views

How to securely automate periodic website logins

I'm writing a webpage-monitoring program that, every hour, logs in to a website using Selenium and notifies me if the page has changed in a particular way. For example, this program can monitor my ...
ConvexMartian's user avatar
8 votes
3 answers
2k views

How to harden su with dpkg-statoverride?

I am reading an Ubuntu 14 hardening guide and this is one of the suggestions: It generally seems like a sensible idea to make sure that only users in the sudo group are able to run the su command ...
Drew's user avatar
  • 203
0 votes
1 answer
201 views

Is it safe to uninstall `su` in favor of `sudo` to harden Arch Linux? [closed]

Is it safe to uninstall su in favor of sudo to harden Arch Linux? Have you got an opinion on whether this is a good or bad idea? I read the Arch Linux Wiki articles Security, Su and Sudo. I also ...
Tim Friske's user avatar
  • 2,280
2 votes
3 answers
622 views

Does it make sudo more secure when indexing all commands by their SHA-2 checksums?

I'm asking myself whether system security substantially increases when I generate a security policy, i.e. sudoers file which contains one or more Cmnd_Alias definitions that enumerate all executable ...
Tim Friske's user avatar
  • 2,280
1 vote
3 answers
1k views

preventing DoS attack in Apache webserver

This is the version of apache we're using - httpd-2.2.15-39.el6.centos.x86_64 We recently had our website down due to DoS attack and hence started exploring iptables, and how to use it to prevent DoS ...
Gokul's user avatar
  • 1,071
1 vote
2 answers
2k views

Using IPTables to Block Ports to Class A Subnets While Allowing Web Ports (80/443)

This is about a cPanel server which, like most servers, is under constant attack from lands afar. Considering that I only host to clients in the US and Canada, there is less of a reason to allow full ...
Exit's user avatar
  • 111
5 votes
1 answer
1k views

Why is the "harden" suite of packages not available for Debian Jessie (8.0)?

These include all the harden packages listed in the Debian automatic hardening documentation (https://www.debian.org/doc/manuals/securing-debian-howto/ch-automatic-harden.en.html), including: harden ...
user339676's user avatar
0 votes
1 answer
121 views

kernel security and IDS Firewall + AV together or not?

I try to hardening my server. For doing so, I got a general question: Should I install kernel security patches like selinux and an Anti-Virus with Intrusion Detection Firewall? Does it make sense to ...
alpham8's user avatar
  • 61
8 votes
1 answer
427 views

Securing VPS against access by server company

I have a few linux VPS boxes that contain the private keys to Bitcoin. I've taken a few steps to harden them: Blocked all ports except those needed for my server with uncomplicated firewall Disabled ...
Zach's user avatar
  • 91
2 votes
1 answer
6k views

debian7 cron.allow & cron.deny files

Almost 3 weeks that, in my downtime, I try to find out where the files cron.allow & cron.deny are located in debian7 distro. No way, it seems that by default they are not in the system. 'Just' ...
lese's user avatar
  • 2,726
3 votes
1 answer
885 views

unnecessary accounts in linux

It is recommended in hardening that unnecessary accounts be removed. Do these accounts include process and daemon accounts? What security problems exist with unnecessary user accounts? Can attackers ...
Gohar's user avatar
  • 221
22 votes
3 answers
13k views

Myth or reality: SELinux can confine the root user?

I read or heard somewhere (maybe in LinuxCBT's SELinux course; but I'm not sure) that there are online Linux servers, for which the password of the root user is also given. The Linux server is ...
Sadeq Dousti's user avatar
2 votes
1 answer
333 views

LAMP Hardening, Transparent Proxy with iptables

I'm running a LAMP server with FTP(S) and several users. The users have only access to uploading PHP files and other web content. Some are running Drupal and Wordpress, but also a few home made stuff. ...
Markus's user avatar
  • 149
6 votes
2 answers
5k views

Deleting users with nologin shell

On a security audit performed on our production Linux servers , we were asked to remove nobody user if no application are using it. I checked and could see that there are no files owned by 'nobody' ...
Zama Ques's user avatar
  • 3,306
4 votes
1 answer
6k views

How to disable remote access on a linux distribution?

So I've read in Mark Sobell's book on Linux, that Linux by default is open to remote administration. Now seen as I'm running a Fedora 17, on a laptop I never have to administrate anything on remotely, ...
Happy's user avatar
  • 51
36 votes
2 answers
23k views

How does one change the delay that occurs after entering an incorrect password?

After entering an incorrect password at a login prompt, there s an approximately 3-second delay. How can I change that on a Linux system with PAM?
Shawn J. Goff's user avatar
2 votes
2 answers
2k views

is stack-smashing protection on on Debian?

I heard that every binary that comes with Ubuntu is protected with stack-smashing protection and possibly other gcc features to harden programs against common security threats. What about Debian? I ...
Enzo Fortino's user avatar
4 votes
2 answers
4k views

Hardening debian?

So I have thought a bit about hardening a Debian squeeze file & VPN server lately. Right now, we've placed the machine behind a firewall only allowing SSH connections from LAN, set a strong root ...
Industrial's user avatar
  • 1,801
0 votes
1 answer
3k views

How to really security a linux-mint-desktop?

I'm installing some security software in my mint9Gnome. I first went to Firestarter and looks like a pretty start. Now I'm going to OSSEC and want some good tools to search my logs too. Thinking ...
H_7's user avatar
  • 286
20 votes
2 answers
9k views

What to use to harden Linux box? Apparmor, SELinux, grsecurity, SMACK, chroot?

I am planning to go back to Linux as a Desktop machine. I would like to make it more secure. And try a few hardening techniques, especially since I plan to get my own server. What would be a good, ...
jottr's user avatar
  • 1,296
9 votes
2 answers
4k views

Hide processes from other users based on groups (under Linux)?

Is it possible to configure process hiding for certain user groups under a linux system? For example: Users from group X should not see processes owned by users from group Y in ps/top or under /proc. ...
maxschlepzig's user avatar
  • 57.7k