Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am working on building some new CentOs 6 servers and creating documentation for the installation of said servers. I would like to create a base CentOS 6 server install that would be light on the packages to reduce bloat by default. Additionally, I am looking for some common or industry practices in which to harden the server so that it can be used in production and online facing to the world. I am curious if there are any best practice guides, techniques, or steps that you use in performing such a task? Later, I would look at adding servers and sections to the documentation about using the server for web serving, database hosting, etc. For now, I am looking for a base server install.

share|improve this question

3 Answers 3

up vote 6 down vote accepted

The US National Security Agency (NSA) provides guides for hardening Linux and other operating systems which may be of some help. Since CentOS is so similar to RedHat, you may be intrested in:

share|improve this answer
    
Thank you for the posting. Would I need to be worried about the differences between CentOS v5 and v6 since I am looking at CentOS v6? –  John Jan 3 '12 at 23:34
    
For the most part, no, don't be worried about the differences. –  Aaron Copley Jan 4 '12 at 0:33

The lightest install you can do will require Kickstart with the below option:

%packages --nobase

You will need to experiment to figure out what packages you will explicitly want to include after that. At minimum you'll probably want to include these just to get started.

%packages --nobase
openssh
openssh-server
yum

Regarding a secure/hardended install, DISA provides STIGs for Linux. It's hard to navigate, but it's out there... I hate linking, but it's too much to copy/paste here. Check this for a Kickstart with DISA STIGs. https://nazar.karan.org/cgit/bluecain/tree/ (secure-kickstart.cfg)

share|improve this answer
    
+1 for the secure-kickstart.cfg –  becomingwisest Jan 4 '12 at 0:14

The bastille package helps you to harden your host step by step by asking questions and letting you make choices. It provides information about every step, so educating the user is a goal of the project, too.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.