What are the most essential tools for Linux security? [closed]

Question

I'm running a hobby Debian sever hosting a few web sites, software repositories, and some other apps. There are tons of all kinds of network security enhancement tools available. Firewalls, hardening patches, intrusion preventors… Obviously no one needs all of these. I was wondering, what are the most essential ones, what should a normal user (i.e. not interested in becoming security expert) use?

I'm aware that no tool replaces good administration, and that most problems arise from poor passwords, non-patched apps, and so on. But if installing some clever tool gives a bit of extra security, then I'm interested.

Update: Debian is apparently quite secure right out of the box, and stays secure as long as its user keeps the system up to date and doesn't do anything stupid. That's good, of course. There's not much that add-on tools could actually add, but here are the suggestions with more than one vote so far:

• Firewall (Shorewall/IPtables)
• "Bruteforce login limiter" (fail2ban)
• Rootkit checker (chkrootkit)

Answer 1

I would recommend reading the Securing Debian Manual, cover to cover if you can.

(also, I want to second fail2ban. I get so many SSH brute-force attempts its sickening.)

Answer 2

For me, the musts are:

• Firewall (I use shorewall)
• Fail2Ban: Lock IPs after many authentification failures (on ssh, apache, ...). Can work in combination with shorewall
• a rootkit checker like chkrootkit
• install the security patches quickly and regularly
• Forbid root Login for ssh (changing ssh port is not bad, too)
• No telnet et al ;-)
• a password policy for all users which can connect from remote
• hardening patches should be considered as well

Answer 3

Some general advice is to keep your software up to date, turn off any unused/unnecessary services, and keep an eye on anything unusual. I probably wouldn't have a server running if I didn't have time to administer it properly.

Some tools you can use are:

• IPTables
• TCP Wrappers -- there are probably better resources for this
• Snort
• chkrootkit
• Tripwire

There are many more than that, but it should be a good start.

Answer 4

Learn how to use lsof. It stands for List Open Files and gives you a good overview of what's going on on your system. It's probably not exactly a security tool, but when it comes to diagnostics (eg checking what a certain process exactly does) I don't know a better alternative. A short example if you want to check which network connections are open and which process opened it:

lsof -nPi

(-i stands for internet -P makes it showing the concerning ports and -n prevents it from resolving IP addresses using dns) However lsof is way more powerful just google a bit around or look at the manual. Finally lsof is also available on macs (also I'm not sure weather it's installed by default)

Answer 5

All the above applications are good. But don't forget a lot of security holes are caused by bad configuration, or barely none at all. Security software is only as good as its configuration. For example, to secure OpenSSH a bit more you could add a rule to iptables, but you could also use the /etc/hosts.allow/deny files to block off access to that service, or any service to everyone, other than your IP address. Turn permit_root_login off in sshd_config which is usually enabled by default. Use an IDS - Snort for example with Barnyard for better performance. Be sure to install oinkmaster to keep your rules up-to-date. A technique I use a lot, legally, when checking networks for people relies on mis-configured firewalls and/or routers. In some cases they will allow me to spoof my IP address as an internal one because the router/firewall allows inbound traffic to have LAN IP addresses. Once I've done this I can perform an ARP poisoning attack on the network forwarding all the packets they send to me. I can retrieve e-mail logins, conversations being passed over tcp/ip and more. Sometimes when I didn't get what I needed I would sniff my target, use DNS spoofing to relocate the A record to a site they used regularly to a malicious one I wrote that would download malicious software on their computer in order for me to get a bind shell to their system. So basically, ARP poisoning can be hard to stop if they have access to your network. Make sure your router is setup to stop inbound traffic claiming to be on your network, and use a program like ARPWatch to try and catch this activity. Maybe look over pages on current exploits (exploit-db.com, milw0rm.com for example) and see if the software you use is on there.

Answer 6

Linux security. Well, this is a little off-topic, but I'd suggest using OpenBSD as firewall in your network.

pf is a great and easy to configure firewall (packet filter).

Answer 7

Keep your machines on a DMZ with a correctly configured firewall in front of it, stick a VPN for administrative access and you will not need to worry to direct SSH attempts/brute force. If you really need SSH available to the "outside" of your network, change the ports as someone already suggested or use port knocking.

I second the indications of Tripwire and chkrootkit as local security tools. Remember though that security also encompass logging (logging with a correct clock and maybe a log server) and disaster recovery (having backup of your data is good, having restores is even better).

Also, using a tool like OpenVAS to check your servers is a good thing to do.

NIST has two good publications on the subject: Guide to General Server Security and Guidelines on Securing Public Web Servers.