Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to build a quite secure UNIX-Server. Mechanisms I already implemented:

  • SNORT + fwsnort for banning
  • psad to block network-scanning attempts
  • Portknocking to start+open SSH (key-based login - no password)
  • hourly update of IP-Tables-Rules from a Security-Subscription
  • Fail2Ban
  • ClamAV & Rootkithunter + Logwatch

What service-independent security mechanism would you add to this? What mechanism are you using? The server will run Apache&Postfix. For Apache hiding the server-information ofc. and nothing I can think of for Postfix. Thanks

share|improve this question

3 Answers 3

Wow, you really threw everything but the kitchen sink on that machine. Please don't take this the wrong way, but it seems from your question that you might not be super experienced. If I'm mistaken I apologize.

My point is, you are going to matter a lot more than what crazy amount of security software you throw on your machine. Specifically, your level of knowledge, experience, and attention to detail are all paramount to the success of your security setup.

If you don't have the experience or ability to maintain these applications you're running the risk of lulling yourself into a false sense of security.

That said, you've really covered a lot of bases there. The only thing I don't see is a host based intrusion detection. e.g. AIDE or Tripwire

share|improve this answer
    
Excellent answer; your sure your a programmer not a sys admin? –  Jacob Feb 23 '11 at 1:43
1  
@Jacob: I'm a good geek :) –  hobodave Feb 23 '11 at 2:21
    
I'm a CISSP so I assume I know what I am talking about. I think exchange of ideas and possible configurations is a good start, especially in such rapid-developing IT-world. Noone is perfect and can be up-to date - especially not regarding security, as a ISO has to read a lot of different material. –  Phoibe Feb 23 '11 at 5:06

I would add backups.

You've really gone all out on the network security front. Using only a subset of those tools would likely be adequate.

Disable any and all network services you don't need. If you have network service that are only accessed on the server, have them listen on the loopback interface only.

share|improve this answer

A downside to implementing all that on your server is this:

Every application adds potential vulnerabilities. If you aren't skilled in securing applications, you may well have made your server LESS secure!

If you know how to configure and tune snort then keep it there, otherwise it will give you a false sense of security.

Portknocking - fairly pointless unless you have a specific requirement for an invisible service. You'd possibly be better off using a normal SSHD with cert based authentication.

Check out this question on security stack exchange for some ideas.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.