Questions tagged [hardening]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
0 answers
138 views

Running hardened Ubuntu 22.04 desktop in an air gapped environment

I am trying to run Ubuntu 22.04 in an a semi Air Gapped environment. The OS has been hardened using CSI hardening. There is no direct connection to the internet, but there is a Nexus Repo server ...
PrestonDocks's user avatar
2 votes
1 answer
285 views

FAPolicyD overhead slowing down a server

We have a server with the Alma Linux 9.3 OS. By default (as well as all current RHEL-like OSs) it has fapolicyd enabled. There is also an application server (WildFly/JBoss/Java) running on that server....
McLayn's user avatar
  • 193
0 votes
0 answers
71 views

DISA STIG False Positives and Tailoring Profile

we currently use oscap to run security scans to validate configurations in DISA STIG for our Linux machines. We are seeing a lot of false positives and we are trying to figure out if there is a way to ...
Matthew Hane's user avatar
2 votes
1 answer
1k views

Does SSH compression make the protocol more insecure?

I'm auditing one ubuntu server using a tool named lynis, which performs several tests to configuration files and give suggestions to harden the servers. For example, it suggest to reduce the value of ...
Rockcat's user avatar
  • 131
0 votes
0 answers
104 views

Why should I disable insecure SSH hostkeys if I never plan on using them?

A number of articles suggest removing insecure (broken) SSH key types in order to have a more secure server. In practice, if I only connect to the server with secure key types, why should I bother ...
angryserver's user avatar
0 votes
0 answers
42 views

Printing on hardened windows clients

I have inherited hardened clients with a lot of policies applied to them. There is an application running on this clients, that should show the windows printing dialog, but it does not pop up. There ...
RagedVimClicker's user avatar
0 votes
2 answers
482 views

Network Security: Hardening IPv6 on Ubuntu Server?

I am familiar with hardening IPv4 on Ubuntu server, but when I use the same rules for IPv6 with ip6tables, the IPv6 connectivity is lost resulting in Destination unreachable: Address unreachable ...
lion's user avatar
  • 23
0 votes
0 answers
569 views

Is it worth it to install and configure fail2ban for an Bind9 authoritative DNS server?

In our project infrastructure we have a nameserver, based on bind9. This nameserver is configured as primary and authoritative, so it is quite important. The question is, should I install and ...
hancack's user avatar
  • 21
0 votes
0 answers
447 views

OpenLDAP/ds-389 Secure Hardening Guide

I am in the process of setting up an Open Ldap Server (ds-389) however, I cannot find many good resources which define a security or hardening guide which can be applied to the configuration or schema ...
sfalzon's user avatar
1 vote
3 answers
272 views

Locally and durably remove some files of a Debian package

Context: On Debian, when hardening PHP I disabled and deleted a few unused PHP modules: for example, for wddx I deleted: /etc/php/7.3/*/conf.d/20-wddx.ini /etc/php/7.3/mods-available/wddx.ini /usr/...
Seb35's user avatar
  • 220
1 vote
0 answers
46 views

Small business/charity first-time server build; Initializing and hardening?

I'm the volunteer IT coordinator for our small church. We currently use a Synology NAS as a file server, surveillance controller, web server, email server and DNS. It does a decent job with most of ...
Eric H. Bowen's user avatar
1 vote
2 answers
3k views

OpenSSH internal-sftp not accepting allowed/denied_requests

Trying to set up a highly restricted SFTP server with OpenSSH_7.4p1 for remote scripts to upload data. The goal is a black hole where the scripts can do a "put" with user level keys and no ...
netdxr's user avatar
  • 13
0 votes
1 answer
103 views

Block IIS GUI sites configuration change for hardening

I am trying to find the configuration settings for this hardening on Windows 2019: Block IIS sites configuration change from the IIS GUI, even for administrators. The sites web.config change should ...
jwalker's user avatar
  • 108
0 votes
0 answers
135 views

IS this error an Ancient “su – hostile” vulnerability in Debian 8 & 9 ? $ bash: cannot set terminal process group (-1): Inappropriate ioctl for device

Just received this error >> bash: cannot set terminal process group (-1): Inappropriate ioctl for device then the disk partition went into READ-Only mode ; also noticed gnome-software was ...
Marc Cox's user avatar
0 votes
1 answer
71 views

iptables policy & saving in RHEL

As part of a "Hardening" task, I need to run iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP On our servers. Normally we would run this command and then run /sbin/...
searcot jabali's user avatar
1 vote
1 answer
6k views

Editing Authselect files

I'm hardening fedora OS following the CIS Benchmark for fedora 28. In one of the remediations, the Benchmark provides an script that modifies the files system-auth and password-auth. When I apply the ...
Luis Gc's user avatar
  • 11
0 votes
1 answer
2k views

I am trying to setup some auditd rules but getting error -F missing operation for auid

i am trying to setup the below rule in /etc/audit/audit.rules -a always,exit -S unlink -S unlinkat -S rename -S renameat -F auid>= 1000 -F auid!=4294967295 -k delete which didn't work so i tried ...
user avatar
1 vote
1 answer
1k views

Which IPv4/6 ICMP types should I drop to block ping?

I'm using ufw. I want to block pings for IPv4 and IPv6. I've read guides by ubuntu as well as hosting companies I use, and answers on StackExchange sites. Advice is always to edit /etc/ufw/before....
lonix's user avatar
  • 938
0 votes
1 answer
681 views

Why does `lynis audit system` suggest to change the `sshd` port from `22` to '' (empty)?

I ran a lynis audit system on a reasonably fresh ubuntu 18.04 instance, and of the more intriguing suggestions it made was: Test: Checking Port in /tmp/lynis.AT7qAndGzq Result: Option Port found ...
cueedee's user avatar
  • 225
0 votes
0 answers
49 views

Webserver (Apache/NGINX): Disabling connections / binding on IP address

I was wondering if I would be able to harden my Apache configuration in such a way it would only respond to one of it's actual vhost configuration (e.g. https://myhost.example.com/) and make it ...
William Jozef's user avatar
2 votes
3 answers
4k views

securing/hardening ntp client on Linux servers - config file

I have a clean install of Debian with the NTP client. I was given settings to secure secure my NTP client configuration. I know how to add them to the /etc/ntp.conf file but I am not if settings need ...
IMTheNachoMan's user avatar
2 votes
0 answers
301 views

Attempting to delete cron directory in docker gives "Invalid argument"

I'm trying to write a hardening script to remove the cron directory in an alpine Linux based docker image. docker run -it alpine:3.7 rm -rf /var/spool/cron rm: can't remove '/var/spool/cron': Invalid ...
Daniel Powell's user avatar
0 votes
0 answers
538 views

Debian 9 file system CIS-CAT hardening issues

I'm performing a CIS-CAT scan and I'm questioning the results of the scanner being poorly designed. Now I am running on Debian 9 which isn't officially supported by the scanner but I can get it to run ...
Brad's user avatar
  • 260
1 vote
0 answers
174 views

How to configure Dovecot to disable NIST's curves and still rertain EECDH?

I am interested in configuring Dovecot's TLS so as to retain forward secrecy, but eliminate all of NIST's elliptic curves. Besides being subject to side channel attacks, in some quarters there is a ...
Kurt Fitzner's user avatar
1 vote
1 answer
2k views

Windows 10: Kerberos settings not found

In our company, we want to configure our Windows-based infrastructure compliant to the IASE SCAP specifications, e.g., the Microsoft Windows Server 2016 STIG Benchmark. In this document, there is the ...
Patrick Stoeckle's user avatar
-1 votes
1 answer
90 views

When someone gains remote access to a server are there other ways to execute system commands other than the bash shell?

I am hardening a server and attempting to build a restrictive layer to a potential hacker even with root access to the server to do harm. If a user gains root or user access to the shell via say ...
I'm Root James's user avatar
4 votes
2 answers
13k views

how to configure postfix behind haproxy?

During the last years I had an emailserver running for my small business without problems. Now that my company has grown, I wanted to add a bit of redundancy and added a failover emailserver with a ...
Joe Silencio's user avatar
1 vote
0 answers
480 views

Solaris 11 Auditing, audit_control file cannot be found

First of all I would like to say I'm not a Linux/Solaris guy, but just assigned task to look at 1 particular item in hardening checklist, so thinking to seek help here to understand more. From the ...
nlks's user avatar
  • 132
1 vote
1 answer
3k views

Hardening TLS web server Apache settings [closed]

OS: GNU/Linux Debian 9.2, fully updated. Under the title Hardening TLS web server Apache settings I mean the following: disabling TLS 1.0, already done with this setting: SSLProtocol -all +TLSv1.1 +...
Vlastimil Burián's user avatar
3 votes
3 answers
11k views

Hardening Apache: How to disable Apache manual or make it unreachable?

I just found requests like this in my access log: 180.76.15.134 - - [30/Oct/2017:22:38:05 +0100] "GET /manual/en/server-wide.html HTTP/1.1" 200 3551 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +...
Robert's user avatar
  • 163
0 votes
3 answers
4k views

Security advantages of a SSH jumphost / jumpserver

I want to learn more about hardening Webservers and currently stopped on the topic Jumphost. So for me it seems like a Jumphost for example is connected to a webserver via VPN and the only server who ...
frankhammer's user avatar
2 votes
1 answer
4k views

Windows Server 2016 + CIS security benchmarks: "access denied" on GP objects, locked out of all shares incl. SYSVOL

We have got an Active Directory domain with Windows Server 2016 on the domain controller and up-to-date Windows 10 on all clients. Not long ago I began deploying the Center for Internet Security (CIS) ...
Marecki's user avatar
  • 21
1 vote
1 answer
1k views

How to secure a 'public' sftp?

I have a server which enables some users of my services to upload files using SFTP. When I talk about users, I can neither be sure who they are nor how many have access. I have set up the access as ...
q9f's user avatar
  • 640
3 votes
0 answers
2k views

Changed policy: locked out local and domain administrator account on Windows Server 2012

I'm kind of a rookie when it comes to servers and server hardening. I was following the CIS benchmark for Windows Server 2012 and changed the allow log on locally policy to include administrator, ...
Mvh's user avatar
  • 31
2 votes
1 answer
441 views

Hardening web server cyphers: which cypher list to choose, or how to map between Mozilla and Hynek

Until now I was only aware of Hynek Schlawack's blog post on hardening web server cyphers having a relatively short list of cyphers. But recently I found How to fix 'logjam' vulnerability in ...
Jeroen Wiert Pluimers's user avatar
2 votes
3 answers
2k views

SELinux restrict Apache/PHP access

I installed a minimal CentOS system with Apache, PHP and SELinux in a default configuration: SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root ...
jbrsn's user avatar
  • 21
0 votes
1 answer
256 views

Securing local repository with SSH and chroot

I've got a local Debian repository server in my network and I want my clients to upgrade, update, and install packages from it through SSH. I configured my sources.list so it would look like this : ...
monkeytrouble's user avatar
2 votes
1 answer
744 views

CIS benchmark differences between 2008R2 to 2012R2

I'm looking at hardening our golden image inline with the CIS benchmarks for Windows Server 2008R2 and 2012R2. But, after looking at the two benchmark documents(registration required - sorry) from CIS,...
House's user avatar
  • 121
5 votes
5 answers
55k views

Use Script To Edit Local Group Policy Windows Server 2012

I'm hardening a Windows Server 2012 R2 machine for serving secure web pages and following a guide that lays out multiple Local Group Policy Settings and Registry Settings. When researching how to ...
ibsk8in31's user avatar
  • 113
14 votes
2 answers
2k views

How to prevent users from extending their window of valid login

Been working on some security hardening procedures for a RedHat box, and I wanted to know if would be possible to prevent a user from changing his password, once it's expired. For one of our clients ...
born to hula's user avatar
4 votes
5 answers
41k views

How Can I Enable MSS Group Policy Settings Windows Server 2012

In the past I have gone through a server hardening checklist on a Windows Server 2008 web server for PCI compliance. Basically there are a lot of Group Policy, Registry, and other settings that need ...
ibsk8in31's user avatar
  • 113
5 votes
1 answer
7k views

Using App Pool Identity vs Local Account in IIS

I am supposed to harden web applications we have developed in our company.I decided to create separate application pool for each web site for this purpose. My question is whether using Application ...
Pooya Yazdani's user avatar
0 votes
1 answer
145 views

cache_dir and some hardening squid

Suppose i'm going to define multiple cache_dir such as : cache_dir ..... # disk 1 cache_dir ..... # disk 2 cache_dir ..... # disk 3 Question: Do i need to define maximum_object_size and ...
PersianGulf's user avatar
0 votes
1 answer
501 views

Local port access blocked by iptables

Although experienced with Linux, I'm new to iptables, having set it up following a Rackspace virtual server setup guide. Using port scans and checking remote access to required ports, I can see all ...
Andrew Ebling's user avatar
2 votes
1 answer
574 views

Hardening Ubuntu with Docker.io

I am new to Docker so please keep in mind. The old way: Create cloud instance Add Ubuntu OS Provision / harden Linux via Chef Develop app locally Deploy via Capistrano or some other deployment ...
csi's user avatar
  • 1,575
-1 votes
1 answer
3k views

How do I disable unnecessary Windows services and test for stability?

When I configure a minimal Server (unselecting any role in SCW) I still have quite a number of (obscure) services running or set up as manual. Requirements in my project say that the Server shall ...
AHalvar's user avatar
  • 107
3 votes
1 answer
10k views

Account Lockout with pam_faillock in RHEL6

Previously, I asked about using pam_tally2 under RHEL6. I would like to pose this question and answer to document the recommended use of pam_faillock over pam_tally2 for the same function; What is ...
Aaron Copley's user avatar
  • 12.7k
-6 votes
1 answer
3k views

In standalone Windows, safely force all apps to use AppData\Local\ instead of AppData\Roaming\ and Hardening security [closed]

In "standalone" or individual windows (vista & above: Vista, Win7, Win8, Win8.1, etc OS based) computers & tablets, which are configured to use only "TCP/IP" network component, each has ...
atErik's user avatar
  • 101
1 vote
3 answers
1k views

ipv6 on Ubuntu server - how do I secure?

On our Ubuntu server, ipv4 & ipv6 are enabled. We have taken these steps so far. Enabled iptables & ip6tables Copied the rules exactly from our iptables to ip6tables Do we need to make ...
csi's user avatar
  • 1,575
0 votes
1 answer
354 views

prevent explorer.exe from launching internet explorer

In a Windows Terminal Server (2003 R2) where the users are not allowed to run a remote desktop, but just the applications they want (that's Citrix work), i've published "Explorer.exe" for the users to ...
AgostinoX's user avatar
  • 181