Questions tagged [hardening]
The hardening tag has no usage guidance.
80
questions
14
votes
2
answers
2k
views
How to prevent users from extending their window of valid login
Been working on some security hardening procedures for a RedHat box, and I wanted to know if would be possible to prevent a user from changing his password, once it's expired.
For one of our clients ...
14
votes
2
answers
8k
views
SELinux vs. AppArmor vs. grsecurity [closed]
I have to set up a server that should be as secure as possible. Which security enhancement would you use and why, SELinux, AppArmor or grsecurity? Can you give me some tips, hints, pros/cons for those ...
8
votes
5
answers
7k
views
Red Hat server minimal install
In a farm of virtualized Red Hat servers, there's the need to install a minimal system for security reasons. Minimal installs have several advantages (even no security related):
Less exposure to ...
7
votes
3
answers
7k
views
CentOS 6 Minimal or Hardened Install
I am working on building some new CentOs 6 servers and creating documentation for the installation of said servers. I would like to create a base CentOS 6 server install that would be light on the ...
7
votes
5
answers
3k
views
Services to disable on a newly installed CentOS 5.3 machine?
I've recently installed a CentOS 5.3 machine which I'm locking down for server usage in a headless environment (no GUI will be used on the machine). The server will be used as a combined web- and ...
7
votes
2
answers
24k
views
Account Lockout with pam_tally2 in RHEL6
I am using pam_tally2 to lockout accounts after 3 failed logins per policy, however, the connecting user does not receive the error indicating pam_tally2's action. (Via SSH.)
I expect to see on the ...
6
votes
4
answers
14k
views
How do I secure a Dell Idrac card?
I'm trying to completely lock down a server which has to exist outside of a firewall/directly routed to the internet and whilst I have hardened the base OS to the best of my ability, I had a moment of ...
5
votes
3
answers
813
views
What are some specific changes you make when hardening a new NetBSD install?
I know most of the general advice: "turn off unnecessary services", "no really, turn off unnecessary services", "least privilege", etc. I've also seen a few guides and/or tools, e.g., Bastille, for ...
5
votes
1
answer
7k
views
Using App Pool Identity vs Local Account in IIS
I am supposed to harden web applications we have developed in our company.I decided to create separate application pool for each web site for this purpose.
My question is whether using Application ...
5
votes
5
answers
55k
views
Use Script To Edit Local Group Policy Windows Server 2012
I'm hardening a Windows Server 2012 R2 machine for serving secure web pages and following a guide that lays out multiple Local Group Policy Settings and Registry Settings.
When researching how to ...
4
votes
4
answers
2k
views
Service to harden an Ubuntu Server [closed]
I have a webserver which is hosted on mosso- Ubuntu 8.04. It does not have Cpanel installed. I wanted know if anyone can recommend any good services to harden my server from hacking etc. I tried ...
4
votes
2
answers
13k
views
how to configure postfix behind haproxy?
During the last years I had an emailserver running for my small business without problems.
Now that my company has grown, I wanted to add a bit of redundancy and added a failover emailserver with a ...
4
votes
5
answers
41k
views
How Can I Enable MSS Group Policy Settings Windows Server 2012
In the past I have gone through a server hardening checklist on a Windows Server 2008 web server for PCI compliance. Basically there are a lot of Group Policy, Registry, and other settings that need ...
4
votes
2
answers
1k
views
WebDAV Security and Hardening
What are the security ramifications that one should be aware of when considering using WebDAV? How does one go about securing it? What else should I know about it?
3
votes
3
answers
11k
views
Hardening Apache: How to disable Apache manual or make it unreachable?
I just found requests like this in my access log:
180.76.15.134 - - [30/Oct/2017:22:38:05 +0100] "GET /manual/en/server-wide.html HTTP/1.1" 200 3551 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +...
3
votes
3
answers
8k
views
Users cleaning in debian
I'm running a webserver at slicehost and decided to delete unused/unnecessary users. But I really don't know which ones are necessary for the system to work
I use it as apache webserver with mysql, ...
3
votes
2
answers
8k
views
NFS server + client : Recommended hardening / final touches
We have just setup a lovely little nfs share / client for the first time.
a) The UID for files on the client side, is showing up as 4294967294 when listed via ls, but the client is able to create and ...
3
votes
1
answer
10k
views
Account Lockout with pam_faillock in RHEL6
Previously, I asked about using pam_tally2 under RHEL6. I would like to pose this question and answer to document the recommended use of pam_faillock over pam_tally2 for the same function;
What is ...
3
votes
5
answers
382
views
Windows hardening [closed]
Can anyone point me at some good resources on Windows hardening servers and desktop? From 2000 upwards. Thanks.
3
votes
1
answer
1k
views
Did anyone know about update in Bastille for unix/linux?
I'm just wonder that bastille project is still active or not? which alternative tools are proper for both unix and linux?
Thanky you very much
3
votes
2
answers
7k
views
Recommendations for sysctl.conf settings to harden Linux against DDoS attacks?
A recent article from UNIXy http://blog.unixy.net/2010/08/the-penultimate-guide-to-stopping-a-ddos-attack-a-new-approach/ has suggestions to harden a Linux box against DDoS attacks.
Example of sysctl....
3
votes
0
answers
2k
views
Changed policy: locked out local and domain administrator account on Windows Server 2012
I'm kind of a rookie when it comes to servers and server hardening. I was following the CIS benchmark for Windows Server 2012 and changed the allow log on locally policy to include administrator, ...
2
votes
2
answers
280
views
General guide for securing windows server 2008
Is there a guide for securing windows server 2008? I seem to remember reading a MS doc on how to harden a Win2k server, but I can not find a publication for win2k8.
2
votes
3
answers
4k
views
securing/hardening ntp client on Linux servers - config file
I have a clean install of Debian with the NTP client. I was given settings to secure secure my NTP client configuration. I know how to add them to the /etc/ntp.conf file but I am not if settings need ...
2
votes
1
answer
1k
views
Does SSH compression make the protocol more insecure?
I'm auditing one ubuntu server using a tool named lynis, which performs several tests to configuration files and give suggestions to harden the servers. For example, it suggest to reduce the value of ...
2
votes
1
answer
441
views
Hardening web server cyphers: which cypher list to choose, or how to map between Mozilla and Hynek
Until now I was only aware of Hynek Schlawack's blog post on hardening web server cyphers having a relatively short list of cyphers.
But recently I found How to fix 'logjam' vulnerability in ...
2
votes
3
answers
1k
views
Which services to disable on a CentOs 5.8 web/database server?
I have just setup my CentOS 5.8 64 [final] server as a webserver.
Specs: 2x E5620 Intel CPU, DDR3 RAM, Hardware Adaptec RAID 10, 4x SAS drives.
I have installed myself:
Nginx
PHP-FPM
MySQL [...
2
votes
1
answer
149
views
Benefits of separating operating system files from user files onto different partitions
I am in the process of hardening a CentOS box, and came across an article that suggested mounting these filesystems onto different partitions:
/usr
/home
/var and /var/tmp
/tmp
I was wondering what ...
2
votes
1
answer
285
views
FAPolicyD overhead slowing down a server
We have a server with the Alma Linux 9.3 OS.
By default (as well as all current RHEL-like OSs) it has fapolicyd enabled.
There is also an application server (WildFly/JBoss/Java) running on that server....
2
votes
3
answers
2k
views
SELinux restrict Apache/PHP access
I installed a minimal CentOS system with Apache, PHP and SELinux in a default configuration:
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root ...
2
votes
1
answer
574
views
Hardening Ubuntu with Docker.io
I am new to Docker so please keep in mind.
The old way:
Create cloud instance
Add Ubuntu OS
Provision / harden Linux via Chef
Develop app locally
Deploy via Capistrano or some other deployment ...
2
votes
2
answers
898
views
Searching For a Desktop Security Software to harden Windows machines, anybody?
I'm a network administrator of a small/medium network.
I'm looking for a software (Free or Not) which can harden Windows Computers (XP And Win7) for the propose of hardening standalone desktop ...
2
votes
0
answers
301
views
Attempting to delete cron directory in docker gives "Invalid argument"
I'm trying to write a hardening script to remove the cron directory in an alpine Linux based docker image.
docker run -it alpine:3.7
rm -rf /var/spool/cron
rm: can't remove '/var/spool/cron': Invalid ...
2
votes
1
answer
4k
views
Windows Server 2016 + CIS security benchmarks: "access denied" on GP objects, locked out of all shares incl. SYSVOL
We have got an Active Directory domain with Windows Server 2016 on the domain controller and up-to-date Windows 10 on all clients. Not long ago I began deploying the Center for Internet Security (CIS) ...
2
votes
1
answer
744
views
CIS benchmark differences between 2008R2 to 2012R2
I'm looking at hardening our golden image inline with the CIS benchmarks for Windows Server 2008R2 and 2012R2. But, after looking at the two benchmark documents(registration required - sorry) from CIS,...
1
vote
8
answers
2k
views
Turning off FTP
I'm setting up a new debian server and I don't need FTP so I want to remove it. According to netstat -tap, ftp isn't listening on anything. However when I do a port scan (nmap) externally it says the ...
1
vote
2
answers
1k
views
How to block users from seeing others processes?
Generally it's one of the functionalities of (For example) grsecurity - user sees only his own processes, and not all others.
But - I'd prefer to avoid installing grsecurity - perhaps something like ...
1
vote
3
answers
86
views
Picking up a lot of failed authentications for various accounts
My server is getting a lot of various failed authentication attempts for various accounts. The most common one (that I've seen ) or the root account.
I have since enabled Fail2Ban and ran several ...
1
vote
3
answers
1k
views
ipv6 on Ubuntu server - how do I secure?
On our Ubuntu server, ipv4 & ipv6 are enabled. We have taken these steps so far.
Enabled iptables & ip6tables
Copied the rules exactly from our iptables to ip6tables
Do we need to make ...
1
vote
1
answer
1k
views
Which IPv4/6 ICMP types should I drop to block ping?
I'm using ufw.
I want to block pings for IPv4 and IPv6. I've read guides by ubuntu as well as hosting companies I use, and answers on StackExchange sites.
Advice is always to edit /etc/ufw/before....
1
vote
1
answer
1k
views
How to secure a 'public' sftp?
I have a server which enables some users of my services to upload files using SFTP. When I talk about users, I can neither be sure who they are nor how many have access.
I have set up the access as ...
1
vote
4
answers
4k
views
Server setup - Removing unnecessary Ubuntu 10.4 LTS packages
When setting a system up as a server with Ubuntu 10.4LTS, what packages are unnecessary and could be removed (to help harden the system)?
For example, I'm confident the gcc package can (and should) ...
1
vote
2
answers
3k
views
OpenSSH internal-sftp not accepting allowed/denied_requests
Trying to set up a highly restricted SFTP server with OpenSSH_7.4p1 for remote scripts to upload data. The goal is a black hole where the scripts can do a "put" with user level keys and no ...
1
vote
1
answer
2k
views
Windows 10: Kerberos settings not found
In our company, we want to configure our Windows-based infrastructure compliant to the IASE SCAP specifications, e.g., the Microsoft Windows Server 2016 STIG Benchmark.
In this document, there is the ...
1
vote
1
answer
6k
views
Editing Authselect files
I'm hardening fedora OS following the CIS Benchmark for fedora 28.
In one of the remediations, the Benchmark provides an script that modifies the files system-auth and password-auth. When I apply the ...
1
vote
1
answer
3k
views
Hardening TLS web server Apache settings [closed]
OS: GNU/Linux Debian 9.2, fully updated.
Under the title Hardening TLS web server Apache settings I mean the following:
disabling TLS 1.0, already done with this setting:
SSLProtocol -all +TLSv1.1 +...
1
vote
1
answer
613
views
Outlook 2010 Security Settings and Hardening
We are looking at rolling out Outlook 2010 in the near future. What recommendations, guides, settings, tools, etc. would you recommend to secure and harden the installation and usage of Outlook 2010? ...
1
vote
0
answers
138
views
Running hardened Ubuntu 22.04 desktop in an air gapped environment
I am trying to run Ubuntu 22.04 in an a semi Air Gapped environment.
The OS has been hardened using CSI hardening. There is no direct connection to the internet, but there is a Nexus Repo server ...
1
vote
3
answers
272
views
Locally and durably remove some files of a Debian package
Context: On Debian, when hardening PHP I disabled and deleted a few unused PHP modules: for example, for wddx I deleted:
/etc/php/7.3/*/conf.d/20-wddx.ini
/etc/php/7.3/mods-available/wddx.ini
/usr/...
1
vote
0
answers
46
views
Small business/charity first-time server build; Initializing and hardening?
I'm the volunteer IT coordinator for our small church. We currently use a Synology NAS as a file server, surveillance controller, web server, email server and DNS. It does a decent job with most of ...