Security is not a product, but a process.
241
votes
10answers
39k views
How do I deal with a compromised server?
This is a Canonical Question about Server Security - Responding to Breach Events (Hacking)
See Also:
Tips for Securing a LAMP Server
Reinstall after a Root Compromise?
Canonical ...
40
votes
2answers
4k views
Tips for Securing a LAMP Server
This is a Canonical Question about Securing a LAMP stack
What are the absolute guidelines for securing a LAMP server?
28
votes
2answers
11k views
What are the best linux permissions to use for my website?
This is a Canonical Question about File Permissions on a Linux web server.
I have a Linux web server running Apache2 that hosts several websites. Each website has its own folder in /var/www/.
...
36
votes
6answers
3k views
Reinstall after a Root Compromise?
After reading this question on a server compromise, I started to wonder why people continue to seem to believe that they can recover a compromised system using detection/cleanup tools, or by just ...
9
votes
5answers
10k views
Cygwin SSHd Autoblock Failed Logins
I'm running Cygwin with an SSH deamon on a Windows Server 2008 machine. I was looking at the Event Viewer and noticed as much as 5 to 6 failed login attempts per second (brute force) for the last week ...
14
votes
5answers
8k views
How can I chroot ssh connections?
I would like to setup a chroot jail for most (not all) users logging in though SSH. I've heard it's possible with the latest versions of openssh, but I've not been able to find out how to do it. The ...
232
votes
20answers
44k views
How do you search for backdoors from the previous IT person?
We all know it happens. A bitter old IT guy leaves a backdoor into the system and network in order to have fun with the new guys and show the company how bad things are without him.
I've never ...
66
votes
19answers
12k views
Why should I firewall servers?
PLEASE NOTE: I'm not interested in making this into a flame war! I understand that many people have strongly-held beliefs about this subject, in no small part because they've put a lot of effort into ...
42
votes
40answers
4k views
How do you manage your passwords?
Obviously seeing as how many of us here are system administrator type people, we have a lot of passwords strung out across numerous systems and accounts. Some of them are low priority, others could ...
44
votes
15answers
6k views
Are IP addresses “trivial to forge”?
I was reading through some of the notes on Google's new public DNS service:
Performance Benefits
Security Benefits
I noticed under the security section this paragraph:
Until a standard ...
5
votes
5answers
2k views
Is it worth the effort to block failed login attempts
Is it worthwhile running fail2ban, sshdfilter or similar tools, which blacklist IP addresses which attempt and fail to login?
I've seen it argued that this is security theatre on a "properly ...
0
votes
0answers
3k views
Aftermath of Hack
We recently faced a full scale attack on one of our servers running Open SUSE 11.0; the intruder deleted a lot of files necessary for day to day operation. Although the backups came in handy but for a ...
14
votes
8answers
9k views
How do I know if my Linux server has been hacked?
What are the tell-tale signs that a Linux server has been hacked? Are there any tools that can generate and email an audit report on a scheduled basis?
34
votes
10answers
10k views
Securing a fresh Ubuntu server [closed]
Say I've got a fresh install of Ubuntu, what steps should I take to secure it for use as a Rails application server?
20
votes
8answers
8k views
Why not block ICMP?
I think I almost have my iptables setup complete on my CentOS 5.3 system. Here is my script...
# Establish a clean slate
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
...
12
votes
1answer
795 views
How to do a post-mortem of a server hack
I have a Windows Server 2003 SP2 machine with IIS6, SQL Server 2005, MySQL 5 and PHP 4.3 installed on it. This is not a production machine, but it is exposed to the world via a domain name. Remote ...
49
votes
13answers
16k views
What steps do you take to secure a Debian server?
I am installing a Debian server which is connected directly to the Internet. Obviously I want to make it as secure as possible. I would like you guys/gals to add your ideas to secure it and what ...
38
votes
15answers
3k views
Preventing brute force attacks against ssh?
What tool or technique do you use to prevent brute force attacks against your ssh port. I noticed in my Security logs, that I have millions of attempts to login as various users through ssh.
This is ...
13
votes
7answers
7k views
Live view of Linux shell commands executed by another user?
Is it possible for the root user in Linux to have a real-time (or close to real-time) view of the shell commands being run by another user logged in via a terminal or SSH? Obviously they're stored in ...
8
votes
4answers
667 views
Updating Malware cleaning skills
I have seen some sites offering 'Malware University', training classes on getting rid of malware. Do you think that updating your malware removal skills (or arsenal) is necessary from time to time? ...
5
votes
6answers
863 views
What resources are best for staying current about information security? [duplicate]
What types of sites do you visit, on a regular basis, to stay current on information security issues? Some examples from my list include:
http://isc.sans.org/
http://www.kaspersky.com/viruswatch3
...
5
votes
9answers
3k views
What is the best Antivirus for a Windows Domain Network? [closed]
What is the best Antivirus for a Windows Domain Network?
75
votes
6answers
20k views
SSH keypair generation: RSA or DSA?
SSH supports two signature algorithms for key pairs: RSA and DSA. Which is preferred, if any? For RSA, what is the minimum acceptable key length?
39
votes
8answers
2k views
Why would I need a firewall if my server is well configured?
I admin a handful of cloud-based (VPS) servers for the company I work for.
The servers are minimal ubuntu installs that run bits of LAMP stacks / inbound data collection (rsync). The data is large ...
18
votes
2answers
35k views
How can I allow one user to su to another without allowing root access?
I'd like to allow certain users to su to another user account without having to know that account's password, but not allow access to any other user account (i.e. root).
For instance, I'd like to ...
11
votes
3answers
758 views
Log every command executed from root
I want to give access to my root server to an external system administrator, but i want to be sure to double check what he is doing to my server, e.g. copying data i don't want them to do and so on. I ...
11
votes
2answers
1k views
Auto-booting and Securing a Linux Server with an Encrypted Filesystem
I'm setting up some new Ubuntu servers, and I'd like to secure the data on them against theft. The threat model is attackers desiring the hardware or rather naïve attackers desiring the data.
...
14
votes
7answers
9k views
Monitor an incoming SSH session in real time
Is there any linux software to monitor an incoming ssh session. At a previous job I was told that if you ever needed support from Red Hat for example you could have them SSH into your machine and you ...
4
votes
2answers
2k views
SYN Flood Advice
Today I've been dealing with a server suffering from what looked like a SYN flood attack. It was a bit of a rush to get the site back online, so we did these three steps to bring the service back to a ...
19
votes
5answers
1k views
Avoid to keep command in history
I use bash and I would like to avoid some commands being kept in the history.
Is it possible to do that for the next command only?
Is it possible to do that for the entire session?
9
votes
6answers
3k views
How would you send syslog *securely* over the public Internet?
So I've got a few servers which I'd like to log centrally but obviously I don't want to pass the data insecurely over the internet.
I've tried syslog-ng but can't make it work in a secure way, a ...
14
votes
19answers
2k views
How should I securely wipe data from a hard drive?
How do you recommend destroying sensitive information on a hard drive? I've used DBAN in the past, is that good enough?
9
votes
2answers
782 views
Apache: Scammers point dozens of domain names at my dedicated IP. How to prevent this?
For the sake of discussion, pretend that I have an Apache webserver which serves a website at www.example.org. This domain name resolves to the public IP address at 192.168.1.100 (pretend this is a ...
5
votes
3answers
1k views
Is SSH logging capabilities equivalent to su logging for private/public key authentication?
Here at work, we have a non-root shared login account on UNIX that is used to admin a particular application. The policy is to not allow direct logins to the shared account; you must login as yourself ...
4
votes
5answers
2k views
Deep Format of a Harddrive on a Linux System
I've got an original Asus Eee PC Netbook that I'd like to sell. When I've sold old computers in the past, I've typically done a deep/secure/zeroing out style format. How can I do this on a Linux ...
5
votes
4answers
686 views
Any security tips for my first server? (complete beginner)
I'm paying for a VPS and hoping to launch my first website on it in the next few days.
I'm worried there might be some glaringly obvious security holes in the standard setup, so I'm keen to get some ...
0
votes
1answer
239 views
how to Upgrade apache httd and openssh to the latest version on endian firewall(Endian Firewall Community is a “turn-key” linux security distribution)?
how to Upgrade apache httd and openssh to the latest version on endian firewall(Endian Firewall Community is a "turn-key" linux security distribution)?
Can anyone help me?
120
votes
3answers
116k views
What is a Pem file and how does it differ from other OpenSSL Generated Key File Formats?
I'm pretty much a n00b at system administration and I am responsible for maintaining two Debian servers. Every time I have to do anything with security certificates, I google for tutorials and beat ...
25
votes
5answers
2k views
Linux hardening - web servers
What are your checklist/routine when setting up a Linux web server?
What do you recommend to achieve maximum security?
Is there any preferred way to perform repeated maintenance?
25
votes
8answers
2k views
Securing PHP webservers
PHP applications have a reputation for higher than average security problems. What configuration techniques do you use for making sure the application is secure as possible?
I'm looking for ideas ...
39
votes
19answers
2k views
The IT Manager is Leaving - What do I lockdown?
The IT Manager may be leaving, and it's possible that the parting of ways may not be completely civil. I wouldn't really expect any malice but just in case, what do I check, change or lock down?
...
19
votes
4answers
7k views
Why do people tell me not to use VLANs for security?
As per title, why do people tell me not to use VLANs for security purposes?
I have a network, where a have a couple of VLANS. There is a firewall between the 2 VLANs. I am using HP Procurve switches ...
21
votes
7answers
3k views
Reasons to disable / enable SELinux
In the line of this question on StackOverflow and the completely different crowd we have here, I wonder: what are your reasons to disable SELinux (assuming most people still do)? Would you like to ...
8
votes
6answers
1k views
What should every sysadmin know before administrating a public server?
Similar to this question on Stack Overflow, what should a sysadmin who is used to private, intranet-type situations know before being the administrator of a public site?
These could be security ...
19
votes
2answers
11k views
What's best practice for communication between Amazon EC2 instances?
I've been setting up Amazon EC2 instances for an upcoming project. They are all micro instances, running Ubuntu Server 64bit. Here's what I've setup so far:
Web Server -- Apache
Database Server ...
14
votes
8answers
2k views
What are main steps doing forensic analysis of linux box after it was hacked?
What are main steps doing forensic analysis of linux box after it was hacked?
Lets say it is a generic linux server mail/web/database/ftp/ssh/samba. And it started sending spam, scanning other ...
7
votes
4answers
830 views
VPS Administration for the Absolute Beginner
I have a new site that I want to build, something that I as a programmer wish existed. While there is no way this site would ever reach StackOverflow levels of success, I do hope that it will have a ...
5
votes
3answers
2k views
Managing service passwords with Puppet
I'm setting up my Bacula configuration in Puppet. One thing I want to do is ensure that each password field is different. My current thought is to hash the hostname with a secret value that would ...
25
votes
22answers
2k views
Password best practices
Given the recent events with a 'hacker' learning and retrying passwords from website administrators, what can we suggest to everyone about best practices when it comes to passwords?
use unique ...
17
votes
9answers
993 views
User password age/complexity policy
Has anyone got any resources for determining a reasonable password policy for my users? My personal leaning is to ratchet up password complexity and allow them to change them less often as a kind of ...
