Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running a hobby Debian sever hosting a few web sites, software repositories, and some other apps. There are tons of all kinds of network security enhancement tools available. Firewalls, hardening patches, intrusion preventors… Obviously no one needs all of these. I was wondering, what are the most essential ones, what should a normal user (i.e. not interested in becoming security expert) use?

I'm aware that no tool replaces good administration, and that most problems arise from poor passwords, non-patched apps, and so on. But if installing some clever tool gives a bit of extra security, then I'm interested.

Update: Debian is apparently quite secure right out of the box, and stays secure as long as its user keeps the system up to date and doesn't do anything stupid. That's good, of course. There's not much that add-on tools could actually add, but here are the suggestions with more than one vote so far:

  • Firewall (Shorewall/IPtables)
  • "Bruteforce login limiter" (fail2ban)
  • Rootkit checker (chkrootkit)
share|improve this question

migrated from stackoverflow.com Aug 16 '10 at 1:12

This question came from our site for professional and enthusiast programmers.

closed as not constructive by Chris S Jan 26 '12 at 4:19

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Humm, down-vote. Someone apparently considers security of software repositories "not-programming-related". Way to go ;) –  Joonas Pulakka Feb 16 '09 at 5:20
    
Yeah, pretty funny about that down-vote. Wish we could down-vote the down-vote. –  lackey Feb 19 '09 at 17:21
1  
Should be community wiki. –  joschi Aug 16 '10 at 5:31
add comment

7 Answers

I would recommend reading the Securing Debian Manual, cover to cover if you can.

(also, I want to second fail2ban. I get so many SSH brute-force attempts its sickening.)

share|improve this answer
    
Thanks. I mean, even this manual mentions more than ten <em>flavors</em> of security tools, not to mention the different implementation options. Well, chkrootkit has already been mentioned twice so I guess it's good ;-) –  Joonas Pulakka Feb 16 '09 at 5:14
    
Oh, and failt2ban has also been mentioned twice. –  Joonas Pulakka Feb 16 '09 at 5:16
add comment

For me, the musts are:

  • Firewall (I use shorewall)
  • Fail2Ban: Lock IPs after many authentification failures (on ssh, apache, ...). Can work in combination with shorewall
  • a rootkit checker like chkrootkit
  • install the security patches quickly and regularly
  • Forbid root Login for ssh (changing ssh port is not bad, too)
  • No telnet et al ;-)
  • a password policy for all users which can connect from remote
  • hardening patches should be considered as well
share|improve this answer
add comment

Some general advice is to keep your software up to date, turn off any unused/unnecessary services, and keep an eye on anything unusual. I probably wouldn't have a server running if I didn't have time to administer it properly.

Some tools you can use are:

There are many more than that, but it should be a good start.

share|improve this answer
    
+1 for Tripwire –  danlefree Aug 16 '10 at 5:35
add comment

Learn how to use lsof. It stands for List Open Files and gives you a good overview of what's going on on your system. It's probably not exactly a security tool, but when it comes to diagnostics (eg checking what a certain process exactly does) I don't know a better alternative. A short example if you want to check which network connections are open and which process opened it:

lsof -nPi

(-i stands for internet -P makes it showing the concerning ports and -n prevents it from resolving IP addresses using dns) However lsof is way more powerful just google a bit around or look at the manual. Finally lsof is also available on macs (also I'm not sure weather it's installed by default)

share|improve this answer
add comment

All the above applications are good. But don't forget a lot of security holes are caused by bad configuration, or barely none at all. Security software is only as good as its configuration. For example, to secure OpenSSH a bit more you could add a rule to iptables, but you could also use the /etc/hosts.allow/deny files to block off access to that service, or any service to everyone, other than your IP address. Turn permit_root_login off in sshd_config which is usually enabled by default. Use an IDS - Snort for example with Barnyard for better performance. Be sure to install oinkmaster to keep your rules up-to-date. A technique I use a lot, legally, when checking networks for people relies on mis-configured firewalls and/or routers. In some cases they will allow me to spoof my IP address as an internal one because the router/firewall allows inbound traffic to have LAN IP addresses. Once I've done this I can perform an ARP poisoning attack on the network forwarding all the packets they send to me. I can retrieve e-mail logins, conversations being passed over tcp/ip and more. Sometimes when I didn't get what I needed I would sniff my target, use DNS spoofing to relocate the A record to a site they used regularly to a malicious one I wrote that would download malicious software on their computer in order for me to get a bind shell to their system. So basically, ARP poisoning can be hard to stop if they have access to your network. Make sure your router is setup to stop inbound traffic claiming to be on your network, and use a program like ARPWatch to try and catch this activity. Maybe look over pages on current exploits (exploit-db.com, milw0rm.com for example) and see if the software you use is on there.

share|improve this answer
add comment

Linux security. Well, this is a little off-topic, but I'd suggest using OpenBSD as firewall in your network.

pf is a great and easy to configure firewall (packet filter).

share|improve this answer
add comment

Keep your machines on a DMZ with a correctly configured firewall in front of it, stick a VPN for administrative access and you will not need to worry to direct SSH attempts/brute force. If you really need SSH available to the "outside" of your network, change the ports as someone already suggested or use port knocking.

I second the indications of Tripwire and chkrootkit as local security tools. Remember though that security also encompass logging (logging with a correct clock and maybe a log server) and disaster recovery (having backup of your data is good, having restores is even better).

Also, using a tool like OpenVAS to check your servers is a good thing to do.

NIST has two good publications on the subject: Guide to General Server Security and Guidelines on Securing Public Web Servers.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.