Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

I am in the planning stages for a new server where I plan on running Ubuntu. In looking at my hardening options, I wanted to add DigSig.

I noticed however that DigSig went out of maintenance on March 5, 2009.  Should I consider another package or stick with my original plan?

share|improve this question

2 Answers

up vote 1 down vote

I do not recommend to use a solution that is no longer maintained.

There are many other ways to improve the security of a server. What do you really want?

One of my favorite is grsecurity (http://www.grsecurity.net). It's main goal is to protect agains buffer overflow attacks.

share|improve this answer
<p>Thank you. I was wondering what other users (or potential users) of DigSig were thinking. </p> <p>I arrived here after reading the following URL: </p> <p>itsecurity.com/features/ubuntu-secure-install-resource </p> <p>Under <strong></strong><strong>Important Software </strong>grsecurity was the first packaged mentioned. <br /> </p> <p>To keep your computer secure, install the following software: </p> <ul> <li><a target="_blank" href="grsecurity.net/">grsecurity</a>; - A complete security suite for protecting Linux's kernel.</li> </ul> <br /> – Mike Jr May 31 '09 at 15:08
Yeah it's a good checklist too. – cstamas May 31 '09 at 15:47
up vote 0 down vote

Just curious. Is this home server exposed to the Internet in any way? If not, security should be somewhat irrelevant unless you have malicious people in your home. One way to ensure security of your network is simply to use VPN or other remote access methods to securely access your home network (even using public/private key encryption on the tunnel) and from there you shouldn't need to harden a home server.

share|improve this answer
Yes, exposure to the internet is my concern. I have two other computers that I plan on networking in via a wireless router. – Mike Jr May 31 '09 at 15:13
Like I mentioned, unless it is directly exposed to the Internet using port forwarding from your router or some other method, there's very little risk. Set up a VPN (using OpenVPN perhaps or via your router). Secure your wireless using WPA/WPA2 with MAC address filtering and your risk is very minimal. – Kevin Kuphal May 31 '09 at 20:57
I have been reading "Counter Hack", by Ed Skoudis, pub. Prentice Hall PTR. Ed paints a pretty scary picture. I agree though about about the need to secure my wireless connection. WPA2 with AES in hardware has only a small (one percent) performance hit. – Mike Jr May 31 '09 at 23:01
I am worried about root kits (e.g. replacements for /bin/login). See Ed's book, pages 424-433. Maybe I will just use Tripwire. Anybody willing to give a vote of confidence in Open Source Tripwire 2.4.1.2? – Mike Jr May 31 '09 at 23:36
I go back to what risk are you exposed to anyways. If your system is not accessible via the internet directly and access is only via VPN and/or public/private key encryption or physical access, what risk do you have for rook kit installation other than by yourself? – Kevin Kuphal Jun 1 '09 at 4:15
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.