For the first time I've installed original Debian (I used to use only Ubuntu server and client editions and Arch client before) server, it was surprise for me that it has no sudo, and no ssh server installed by default, and allows root login over ssh after ssh is installed (so obviously setting up and securing SSH daemon is #1 task to be done on new installation). Any more such surprises there?
-
It's right whit I've said - SSH indeed was not there, and no sudo as well. And that's a vulnerability (because obviously the first command to issue on a new installation is "apt-get install openssh-server", and the ssh daemon installed allows root login by default).– IvanJul 11, 2010 at 21:08
-
Ah, right. Need to clean my glasses or something because I thought you said the opposite.– ZoredacheJul 11, 2010 at 21:48
-
Actually, that's rather common I think: sudo and openssh seem to be secondary to most installs.– MeiJul 11, 2010 at 22:21
3 Answers
I wouldn't count on the base install being secure at all, no matter what distribution you use and no matter what you expect. Go through your basic configuration and tighten things up.
If I'm setting up an Internet server, I'd remove all possible servers except what you need, turn off as many services as possible, install OpenSSH and tighten down the configuration (you could even limit it to public keys if you like), install and activate portsentry, and other similar things.
Don't assume anything at all.
One more very important thing: do an update to make sure you have the most current releases. This alone will reduce your risk profile drastically.
-
Pretty list format: After install, 1) Start firewall (ufw, FireHOL, shorewall, ferm, <insert iptables front-end here>) 2) Make sure all services are shut off except those you need. That usually isn't an issue; Ubuntu for example has very few (if any) network services installed by default. 3) Update the system. Jul 12, 2010 at 14:13
Run OpenVAS (which is the new nessus), and it will tell you the remotely exploitable vulnerabilities on the system. I know Ubuntu will automatically install security updates by default, I'm not sure if Debian can do this. I know you can use apt-cron to automatically run an apt-get update && apt-get upgrade
.
-
1When exactly did Ian Murdock work for Canonical? Besides, what does the talk about Ubuntu and Canoical even has to do with the original question?– andolJul 11, 2010 at 21:04
Debian has a good Security Page. They post every update they do in their package system:
http://www.debian.at/security/
You should subscribe when running debian.
The Last Update of the Debian Lenny installer was published on the 26th oh June and includes all patches up to DSA-2063
http://www.debian.at/News/2010/20100626
Putting the two together you get 5 packages that have been fixed since... ;)
If you ad a user during install root access is deactivated...