Questions tagged [hardening]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
14 votes
2 answers
2k views

How to prevent users from extending their window of valid login

Been working on some security hardening procedures for a RedHat box, and I wanted to know if would be possible to prevent a user from changing his password, once it's expired. For one of our clients ...
born to hula's user avatar
14 votes
2 answers
8k views

SELinux vs. AppArmor vs. grsecurity [closed]

I have to set up a server that should be as secure as possible. Which security enhancement would you use and why, SELinux, AppArmor or grsecurity? Can you give me some tips, hints, pros/cons for those ...
user avatar
8 votes
5 answers
7k views

Red Hat server minimal install

In a farm of virtualized Red Hat servers, there's the need to install a minimal system for security reasons. Minimal installs have several advantages (even no security related): Less exposure to ...
chmeee's user avatar
  • 7,440
7 votes
3 answers
7k views

CentOS 6 Minimal or Hardened Install

I am working on building some new CentOs 6 servers and creating documentation for the installation of said servers. I would like to create a base CentOS 6 server install that would be light on the ...
John's user avatar
  • 2,276
7 votes
5 answers
3k views

Services to disable on a newly installed CentOS 5.3 machine?

I've recently installed a CentOS 5.3 machine which I'm locking down for server usage in a headless environment (no GUI will be used on the machine). The server will be used as a combined web- and ...
knorv's user avatar
  • 1,819
7 votes
2 answers
24k views

Account Lockout with pam_tally2 in RHEL6

I am using pam_tally2 to lockout accounts after 3 failed logins per policy, however, the connecting user does not receive the error indicating pam_tally2's action. (Via SSH.) I expect to see on the ...
Aaron Copley's user avatar
  • 12.7k
6 votes
4 answers
14k views

How do I secure a Dell Idrac card?

I'm trying to completely lock down a server which has to exist outside of a firewall/directly routed to the internet and whilst I have hardened the base OS to the best of my ability, I had a moment of ...
William Hilsum's user avatar
5 votes
3 answers
813 views

What are some specific changes you make when hardening a new NetBSD install?

I know most of the general advice: "turn off unnecessary services", "no really, turn off unnecessary services", "least privilege", etc. I've also seen a few guides and/or tools, e.g., Bastille, for ...
Hank Gay's user avatar
  • 375
5 votes
1 answer
7k views

Using App Pool Identity vs Local Account in IIS

I am supposed to harden web applications we have developed in our company.I decided to create separate application pool for each web site for this purpose. My question is whether using Application ...
Pooya Yazdani's user avatar
5 votes
5 answers
55k views

Use Script To Edit Local Group Policy Windows Server 2012

I'm hardening a Windows Server 2012 R2 machine for serving secure web pages and following a guide that lays out multiple Local Group Policy Settings and Registry Settings. When researching how to ...
ibsk8in31's user avatar
  • 113
4 votes
4 answers
2k views

Service to harden an Ubuntu Server [closed]

I have a webserver which is hosted on mosso- Ubuntu 8.04. It does not have Cpanel installed. I wanted know if anyone can recommend any good services to harden my server from hacking etc. I tried ...
elated's user avatar
  • 289
4 votes
2 answers
13k views

how to configure postfix behind haproxy?

During the last years I had an emailserver running for my small business without problems. Now that my company has grown, I wanted to add a bit of redundancy and added a failover emailserver with a ...
Joe Silencio's user avatar
4 votes
5 answers
41k views

How Can I Enable MSS Group Policy Settings Windows Server 2012

In the past I have gone through a server hardening checklist on a Windows Server 2008 web server for PCI compliance. Basically there are a lot of Group Policy, Registry, and other settings that need ...
ibsk8in31's user avatar
  • 113
4 votes
2 answers
1k views

WebDAV Security and Hardening

What are the security ramifications that one should be aware of when considering using WebDAV? How does one go about securing it? What else should I know about it?
John's user avatar
  • 2,276
3 votes
3 answers
11k views

Hardening Apache: How to disable Apache manual or make it unreachable?

I just found requests like this in my access log: 180.76.15.134 - - [30/Oct/2017:22:38:05 +0100] "GET /manual/en/server-wide.html HTTP/1.1" 200 3551 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +...
Robert's user avatar
  • 163
3 votes
3 answers
8k views

Users cleaning in debian

I'm running a webserver at slicehost and decided to delete unused/unnecessary users. But I really don't know which ones are necessary for the system to work I use it as apache webserver with mysql, ...
The Disintegrator's user avatar
3 votes
2 answers
8k views

NFS server + client : Recommended hardening / final touches

We have just setup a lovely little nfs share / client for the first time. a) The UID for files on the client side, is showing up as 4294967294 when listed via ls, but the client is able to create and ...
anonymous-one's user avatar
3 votes
1 answer
10k views

Account Lockout with pam_faillock in RHEL6

Previously, I asked about using pam_tally2 under RHEL6. I would like to pose this question and answer to document the recommended use of pam_faillock over pam_tally2 for the same function; What is ...
Aaron Copley's user avatar
  • 12.7k
3 votes
5 answers
382 views

Windows hardening [closed]

Can anyone point me at some good resources on Windows hardening servers and desktop? From 2000 upwards. Thanks.
zorba's user avatar
  • 31
3 votes
1 answer
1k views

Did anyone know about update in Bastille for unix/linux?

I'm just wonder that bastille project is still active or not? which alternative tools are proper for both unix and linux? Thanky you very much
Wingless-Archangel's user avatar
3 votes
2 answers
7k views

Recommendations for sysctl.conf settings to harden Linux against DDoS attacks?

A recent article from UNIXy http://blog.unixy.net/2010/08/the-penultimate-guide-to-stopping-a-ddos-attack-a-new-approach/ has suggestions to harden a Linux box against DDoS attacks. Example of sysctl....
Eureka Ikara's user avatar
3 votes
0 answers
2k views

Changed policy: locked out local and domain administrator account on Windows Server 2012

I'm kind of a rookie when it comes to servers and server hardening. I was following the CIS benchmark for Windows Server 2012 and changed the allow log on locally policy to include administrator, ...
Mvh's user avatar
  • 31
2 votes
2 answers
280 views

General guide for securing windows server 2008

Is there a guide for securing windows server 2008? I seem to remember reading a MS doc on how to harden a Win2k server, but I can not find a publication for win2k8.
CLJ's user avatar
  • 333
2 votes
3 answers
4k views

securing/hardening ntp client on Linux servers - config file

I have a clean install of Debian with the NTP client. I was given settings to secure secure my NTP client configuration. I know how to add them to the /etc/ntp.conf file but I am not if settings need ...
IMTheNachoMan's user avatar
2 votes
1 answer
1k views

Does SSH compression make the protocol more insecure?

I'm auditing one ubuntu server using a tool named lynis, which performs several tests to configuration files and give suggestions to harden the servers. For example, it suggest to reduce the value of ...
Rockcat's user avatar
  • 131
2 votes
1 answer
441 views

Hardening web server cyphers: which cypher list to choose, or how to map between Mozilla and Hynek

Until now I was only aware of Hynek Schlawack's blog post on hardening web server cyphers having a relatively short list of cyphers. But recently I found How to fix 'logjam' vulnerability in ...
Jeroen Wiert Pluimers's user avatar
2 votes
3 answers
1k views

Which services to disable on a CentOs 5.8 web/database server?

I have just setup my CentOS 5.8 64 [final] server as a webserver. Specs: 2x E5620 Intel CPU, DDR3 RAM, Hardware Adaptec RAID 10, 4x SAS drives. I have installed myself: Nginx PHP-FPM MySQL [...
Mr.Boon's user avatar
  • 1,481
2 votes
1 answer
149 views

Benefits of separating operating system files from user files onto different partitions

I am in the process of hardening a CentOS box, and came across an article that suggested mounting these filesystems onto different partitions: /usr /home /var and /var/tmp /tmp I was wondering what ...
user avatar
2 votes
1 answer
285 views

FAPolicyD overhead slowing down a server

We have a server with the Alma Linux 9.3 OS. By default (as well as all current RHEL-like OSs) it has fapolicyd enabled. There is also an application server (WildFly/JBoss/Java) running on that server....
McLayn's user avatar
  • 193
2 votes
3 answers
2k views

SELinux restrict Apache/PHP access

I installed a minimal CentOS system with Apache, PHP and SELinux in a default configuration: SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root ...
jbrsn's user avatar
  • 21
2 votes
1 answer
574 views

Hardening Ubuntu with Docker.io

I am new to Docker so please keep in mind. The old way: Create cloud instance Add Ubuntu OS Provision / harden Linux via Chef Develop app locally Deploy via Capistrano or some other deployment ...
csi's user avatar
  • 1,575
2 votes
2 answers
898 views

Searching For a Desktop Security Software to harden Windows machines, anybody?

I'm a network administrator of a small/medium network. I'm looking for a software (Free or Not) which can harden Windows Computers (XP And Win7) for the propose of hardening standalone desktop ...
MosheH's user avatar
  • 21
2 votes
0 answers
301 views

Attempting to delete cron directory in docker gives "Invalid argument"

I'm trying to write a hardening script to remove the cron directory in an alpine Linux based docker image. docker run -it alpine:3.7 rm -rf /var/spool/cron rm: can't remove '/var/spool/cron': Invalid ...
Daniel Powell's user avatar
2 votes
1 answer
4k views

Windows Server 2016 + CIS security benchmarks: "access denied" on GP objects, locked out of all shares incl. SYSVOL

We have got an Active Directory domain with Windows Server 2016 on the domain controller and up-to-date Windows 10 on all clients. Not long ago I began deploying the Center for Internet Security (CIS) ...
Marecki's user avatar
  • 21
2 votes
1 answer
744 views

CIS benchmark differences between 2008R2 to 2012R2

I'm looking at hardening our golden image inline with the CIS benchmarks for Windows Server 2008R2 and 2012R2. But, after looking at the two benchmark documents(registration required - sorry) from CIS,...
House's user avatar
  • 121
1 vote
8 answers
2k views

Turning off FTP

I'm setting up a new debian server and I don't need FTP so I want to remove it. According to netstat -tap, ftp isn't listening on anything. However when I do a port scan (nmap) externally it says the ...
Malfist's user avatar
  • 807
1 vote
2 answers
1k views

How to block users from seeing others processes?

Generally it's one of the functionalities of (For example) grsecurity - user sees only his own processes, and not all others. But - I'd prefer to avoid installing grsecurity - perhaps something like ...
user avatar
1 vote
3 answers
86 views

Picking up a lot of failed authentications for various accounts

My server is getting a lot of various failed authentication attempts for various accounts. The most common one (that I've seen ) or the root account. I have since enabled Fail2Ban and ran several ...
Josh K's user avatar
  • 454
1 vote
3 answers
1k views

ipv6 on Ubuntu server - how do I secure?

On our Ubuntu server, ipv4 & ipv6 are enabled. We have taken these steps so far. Enabled iptables & ip6tables Copied the rules exactly from our iptables to ip6tables Do we need to make ...
csi's user avatar
  • 1,575
1 vote
1 answer
1k views

Which IPv4/6 ICMP types should I drop to block ping?

I'm using ufw. I want to block pings for IPv4 and IPv6. I've read guides by ubuntu as well as hosting companies I use, and answers on StackExchange sites. Advice is always to edit /etc/ufw/before....
lonix's user avatar
  • 938
1 vote
1 answer
1k views

How to secure a 'public' sftp?

I have a server which enables some users of my services to upload files using SFTP. When I talk about users, I can neither be sure who they are nor how many have access. I have set up the access as ...
q9f's user avatar
  • 640
1 vote
4 answers
4k views

Server setup - Removing unnecessary Ubuntu 10.4 LTS packages

When setting a system up as a server with Ubuntu 10.4LTS, what packages are unnecessary and could be removed (to help harden the system)? For example, I'm confident the gcc package can (and should) ...
Brian M. Hunt's user avatar
1 vote
2 answers
3k views

OpenSSH internal-sftp not accepting allowed/denied_requests

Trying to set up a highly restricted SFTP server with OpenSSH_7.4p1 for remote scripts to upload data. The goal is a black hole where the scripts can do a "put" with user level keys and no ...
netdxr's user avatar
  • 13
1 vote
1 answer
2k views

Windows 10: Kerberos settings not found

In our company, we want to configure our Windows-based infrastructure compliant to the IASE SCAP specifications, e.g., the Microsoft Windows Server 2016 STIG Benchmark. In this document, there is the ...
Patrick Stoeckle's user avatar
1 vote
1 answer
6k views

Editing Authselect files

I'm hardening fedora OS following the CIS Benchmark for fedora 28. In one of the remediations, the Benchmark provides an script that modifies the files system-auth and password-auth. When I apply the ...
Luis Gc's user avatar
  • 11
1 vote
1 answer
3k views

Hardening TLS web server Apache settings [closed]

OS: GNU/Linux Debian 9.2, fully updated. Under the title Hardening TLS web server Apache settings I mean the following: disabling TLS 1.0, already done with this setting: SSLProtocol -all +TLSv1.1 +...
Vlastimil Burián's user avatar
1 vote
1 answer
613 views

Outlook 2010 Security Settings and Hardening

We are looking at rolling out Outlook 2010 in the near future. What recommendations, guides, settings, tools, etc. would you recommend to secure and harden the installation and usage of Outlook 2010? ...
John's user avatar
  • 2,276
1 vote
0 answers
138 views

Running hardened Ubuntu 22.04 desktop in an air gapped environment

I am trying to run Ubuntu 22.04 in an a semi Air Gapped environment. The OS has been hardened using CSI hardening. There is no direct connection to the internet, but there is a Nexus Repo server ...
PrestonDocks's user avatar
1 vote
3 answers
272 views

Locally and durably remove some files of a Debian package

Context: On Debian, when hardening PHP I disabled and deleted a few unused PHP modules: for example, for wddx I deleted: /etc/php/7.3/*/conf.d/20-wddx.ini /etc/php/7.3/mods-available/wddx.ini /usr/...
Seb35's user avatar
  • 220
1 vote
0 answers
46 views

Small business/charity first-time server build; Initializing and hardening?

I'm the volunteer IT coordinator for our small church. We currently use a Synology NAS as a file server, surveillance controller, web server, email server and DNS. It does a decent job with most of ...
Eric H. Bowen's user avatar