Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

There are many tutorials on how to set up a new secured server.

But what if I have to administrate a server someone else had set up some time ago and I don't know much about its configuration yet?

Is there some tool which automatically checks the "usual suspects" or some checklist I can go through to make sure no obvious security holes exist? Are there web services which check remotely for vulnerabilities?

share|improve this question
add comment

12 Answers

up vote 13 down vote accepted

Download Nessus and perform a network check on it. It will tell you about remotely exploitable vulnerabilities.

Also, install Ossec; although it is not its primary purpose, it will find some common misconfigurations (improperly configured accounts for example). And its primary function -- host based intrusion detection -- will help find if someone is trying to exploit vulnerabilities.

share|improve this answer
5  
Nessus is not open-source anymore. Its open-source fork is called openvas. –  Anonymous Aug 11 '09 at 10:41
1  
I know. But it's still free-as-in-beer IIRC, and the poster never said he only wanted F/OSS. –  niXar Aug 11 '09 at 10:57
    
+1 Nessus is very good, I'd also carryout and Nmap scan loading the results into Nessus might help it pick up on a few more vulnerabilites in some cases. –  Mark Davidson Aug 11 '09 at 11:43
1  
+1 for OSSEC. It also has a rootkit/system auditing module that you can run standalone: ossec.net/rootcheck –  sucuri Aug 11 '09 at 12:06
add comment

I would start with the Center for Internet Security's "benchmark" checklists. These are consensus based checklists compiled by security professionals for a variety of platforms and software packages. Some tools mentioned by the checklists, or otherwise commonly recommended that will aid in your hunt for security issues:

  • Nessus/OpenVAS (vulnerability scanner)
  • Nmap (port scanner)
  • TCPdump/Wireshark (libpcap packet capture)
  • SNORT (intrusion detection system)

(tcpdump is installed on many linux systems by default, or may be easily installed from a package repository, and has a comprehensive man page)

If this is for the company you work for, make sure that security analysis is authorized by management, and that the scans aren't going to cause any outage or application silliness. Yes a simple portscan can cause problems - portscan older HP Laserjet printers and they'll spit out heaps of paper.

share|improve this answer
add comment

As a very quick first check:

Run

netstat -ltnp

as root. That will show you all services listening on the network:

This might show you stuff you want to shut down right away. Then you can continue with the solutions in the other answers.

For services that need to run, but not be accessible from the outside (such as a local DB server), consider changing the config so it only listens on localhost/127.0.0.1. That way it can only be accessed by local users.

share|improve this answer
add comment

I would check out Bastille-Linux at http://www.bastille-unix.org/, its a set of scripts that you can run and it will check the system settings, file permissions, user setup etc. I've used it once or twice on my own boxes, and if finds issues on default installs (mostly r_x on rsh/rsync utils). It outputs as html/java+curses/flat text.

share|improve this answer
add comment

What distro?

General:

  • Review iptables and/or firewall settings
  • Review SSHD configs
  • Review all externally accessible service configs
  • Ensure that you are running latest software available
  • Check for kernel vulnerabilities (uname -a and then google)
  • Review user permission and group permissions on editable files
share|improve this answer
    
No special distribution / all distributions –  Daniel Rikowski Aug 11 '09 at 7:52
    
Also, you might want to grab a list of installed packages. Something like dpkg --get-selections > installed_pkgs.txt for debian distros. –  David Rickman Aug 11 '09 at 7:55
2  
You may also need to check for unusual setuid/setgid files, which accounts have passwords set, what their login shell is, etc. to eliminate the easy back doors. –  mas Aug 11 '09 at 8:15
    
Great suggestion mas, I completely forgot that one, which is potentially a huge hole. –  David Rickman Aug 11 '09 at 8:17
add comment

Another good first check is to run nmap hostname from another host on the network. This gives an outsider's view of what netstat showed on the host.

share|improve this answer
add comment

If you are worried, I would recommend following those tutorials you mentioned and rebuilding the server. Especially if you think the other admin might have left something bad. As the new admin, you should know how to deploy whatever service it is running again anyways.

Just make sure you back everything up first, you could image all the partitions to to make sure you really get it right.

If your boss won't let you, then everyone else recommendations sound good to me :-)

share|improve this answer
    
+1: If it's creation/configuration isn't documented and you have the time, then perhaps take the opportunity to rebuild it. Rather than having to do it under duress at a later date. Then you can be sure that it is secure and it will be documented for future reference. –  Dan Carley Aug 11 '09 at 21:05
add comment

In addition to some of the very good responses here, check out http://www.sans.org/. They have some very good documents if you're willing to do a little reading to get a better comprehension of "defense in depth".

Some of the very basic premises tho:

  • keep your servers patched
  • run only those services that need to be running
  • limit user access to the server
share|improve this answer
1  
Remember to limit also physical access, not only from network. –  iny Aug 11 '09 at 13:55
add comment

Also try chkrootkit, it comes in the standard repository of most distribution and is anyway very easy to install. It will check your system for many known vulnerabilities, rootkit and worms.

share|improve this answer
add comment

One thing you can do to get a feel for the system is diff the /etc folder against a fresh install (with the same updates applied.) This will tell you what has changed so you can focus your security concerns there.

share|improve this answer
add comment

To expand on what mas said, here's a simple find command to list all the setuid and setgid files on the system for review.

find / -type f \( -perm -4000 -o -perm -2000 \) -print

Of course, like others have said, this is all assuming the machine doesn't have a rootkit on it already...

share|improve this answer
add comment

Chrootkit/rkhunter are the long hanging fruit. If you got a rootkit installed, everything that's reported will be compromised and thus not much help, so please download them from a known source, don't use the ones already on the box. Another good trick is to install a kernel you know is good (either from packages or roll your own). Check for backdoors (lsof -i and 0 uid non-root accounts). Inspecting firewall rules can usually tell you a lot about the previous admins' habits. Put a wireshark/snort on it, try to spot anything unusual. Look at where the logs are going. Check out all the .profile/.bashrc sort of files for any unusual commands. Look in .ssh/known_hosts for any dodgy hosts.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.