Questions tagged [hardening]

All about making systems more resilient against attacks

12 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
484 views

lshw segfaults on Linux >= 4.8 due to hardened usercopy on many computers

We use a custom built opsi.org bootimage to automatically install Windows on customers' client computers. The userland of this bootimage is based on an upstream bootimage, with some modifications from ...
2
votes
1answer
319 views

LAMP Hardening, Transparent Proxy with iptables

I'm running a LAMP server with FTP(S) and several users. The users have only access to uploading PHP files and other web content. Some are running Drupal and Wordpress, but also a few home made stuff. ...
2
votes
1answer
74 views

Stopping brute force attempts

"postfix/smtpd[28164]: warning: unknown[45.227.253.210]: SASL PLAIN authentication failed: authentication failure" Normally I'd use fail2ban however it seems that under the openvz container fail2ban ...
1
vote
0answers
74 views

hidepid=2 stopped working after an update. Kernel don't suppport “per-mount point”?

I am running arch linux hardened (5.11.13-hardened1-1-hardened) and have been setting hidepid=2 thru the fstab: proc /proc proc nosuid,nodev,noexec,hidepid=2,gid=proc 0 0 and ...
1
vote
0answers
150 views

Is it possible to use systemd on Gentoo with hardened/selinux profile?

Or I need to create custom profile which will combine settings from hardened/selinux and systemd profiles? Because I even can't unmask sys-apps/systemd or set USE-flag systemd on some package.
1
vote
0answers
154 views

Fedora 30 : Ensure No Device Files are Unlabeled by SELinux

While hardening Fedora 30, I encountered this measure on open-scap.org and actually the command : sudo find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n" returns on ...
1
vote
0answers
65 views

Jail outgoing DNS queries to single group with iptables does not work

I am trying to block all DNS queries from my machine by default, and only allow them for specific group of users. I try these rules: sudo su groupadd dns-allowed iptables -A OUTPUT -p udp --dport 53 -...
1
vote
1answer
283 views

noexec flag for /tmp (OpenSUSE)

I would harden my OpenSUSE 42.2. If I put noexec flag for /tmp and /var/tmp locations mount, zypper could suffer for this? Possible issues could depend by single package working and needing but above ...
0
votes
1answer
52 views

What are some very basic hardening steps a novice can take to better secure their Linux system?

I've read that there are a lot of issues with Linux security. Most of them are covered in this article by a security researcher. The same security researcher also has a Linux hardening guide, but it ...
0
votes
0answers
55 views

how to verify that Gratuitous ARP disabled in a Linux server?

Problem: I need to verify if Gratuitous ARP is disabled on a Linux server in the configuration files.
0
votes
0answers
50 views

What counts as a "login" in GNU/Linux and how to set a proper maxsyslogins / maxlogins in limits.conf to limit simultaneous logins to e.g. 1?

When I run w or users && id && who -a I see that there are over 5 logins with my username: one for tty7 and the rest pts/0 pts/1 etc. Those pts are pseudo terminals (open consoles or /...
0
votes
1answer
75 views

Nagios compilation problem in hardened OS

I am trying to install nagios in hardened OS CentOS, but I can not: checking for a BSD-compatible install... /usr/bin/install -c checking build system type... x86_64-pc-linux-gnu checking host system ...