1

I want to build a quite secure UNIX-Server. Mechanisms I already implemented:

  • SNORT + fwsnort for banning
  • psad to block network-scanning attempts
  • Portknocking to start+open SSH (key-based login - no password)
  • hourly update of IP-Tables-Rules from a Security-Subscription
  • Fail2Ban
  • ClamAV & Rootkithunter + Logwatch

What service-independent security mechanism would you add to this? What mechanism are you using? The server will run Apache&Postfix. For Apache hiding the server-information ofc. and nothing I can think of for Postfix. Thanks

3 Answers 3

4

Wow, you really threw everything but the kitchen sink on that machine. Please don't take this the wrong way, but it seems from your question that you might not be super experienced. If I'm mistaken I apologize.

My point is, you are going to matter a lot more than what crazy amount of security software you throw on your machine. Specifically, your level of knowledge, experience, and attention to detail are all paramount to the success of your security setup.

If you don't have the experience or ability to maintain these applications you're running the risk of lulling yourself into a false sense of security.

That said, you've really covered a lot of bases there. The only thing I don't see is a host based intrusion detection. e.g. AIDE or Tripwire

3
  • Excellent answer; your sure your a programmer not a sys admin?
    – Jacob
    Feb 23, 2011 at 1:43
  • 1
    @Jacob: I'm a good geek :)
    – hobodave
    Feb 23, 2011 at 2:21
  • I'm a CISSP so I assume I know what I am talking about. I think exchange of ideas and possible configurations is a good start, especially in such rapid-developing IT-world. Noone is perfect and can be up-to date - especially not regarding security, as a ISO has to read a lot of different material.
    – Phoibe
    Feb 23, 2011 at 5:06
2

I would add backups.

You've really gone all out on the network security front. Using only a subset of those tools would likely be adequate.

Disable any and all network services you don't need. If you have network service that are only accessed on the server, have them listen on the loopback interface only.

2

A downside to implementing all that on your server is this:

Every application adds potential vulnerabilities. If you aren't skilled in securing applications, you may well have made your server LESS secure!

If you know how to configure and tune snort then keep it there, otherwise it will give you a false sense of security.

Portknocking - fairly pointless unless you have a specific requirement for an invisible service. You'd possibly be better off using a normal SSHD with cert based authentication.

Check out this question on security stack exchange for some ideas.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .