There are many tutorials on how to set up a new secured server.

But what if I have to administrate a server someone else had set up some time ago and I don't know much about its configuration yet?

Is there some tool which automatically checks the "usual suspects" or some checklist I can go through to make sure no obvious security holes exist? Are there web services which check remotely for vulnerabilities?

12 Answers 12


Download Nessus and perform a network check on it. It will tell you about remotely exploitable vulnerabilities.

Also, install Ossec; although it is not its primary purpose, it will find some common misconfigurations (improperly configured accounts for example). And its primary function -- host based intrusion detection -- will help find if someone is trying to exploit vulnerabilities.

  • 5
    Nessus is not open-source anymore. Its open-source fork is called openvas.
    – Anonymous
    Aug 11, 2009 at 10:41
  • 1
    I know. But it's still free-as-in-beer IIRC, and the poster never said he only wanted F/OSS.
    – niXar
    Aug 11, 2009 at 10:57
  • +1 Nessus is very good, I'd also carryout and Nmap scan loading the results into Nessus might help it pick up on a few more vulnerabilites in some cases. Aug 11, 2009 at 11:43
  • 1
    +1 for OSSEC. It also has a rootkit/system auditing module that you can run standalone: ossec.net/rootcheck
    – sucuri
    Aug 11, 2009 at 12:06

I would start with the Center for Internet Security's "benchmark" checklists. These are consensus based checklists compiled by security professionals for a variety of platforms and software packages. Some tools mentioned by the checklists, or otherwise commonly recommended that will aid in your hunt for security issues:

  • Nessus/OpenVAS (vulnerability scanner)
  • Nmap (port scanner)
  • TCPdump/Wireshark (libpcap packet capture)
  • SNORT (intrusion detection system)

(tcpdump is installed on many linux systems by default, or may be easily installed from a package repository, and has a comprehensive man page)

If this is for the company you work for, make sure that security analysis is authorized by management, and that the scans aren't going to cause any outage or application silliness. Yes a simple portscan can cause problems - portscan older HP Laserjet printers and they'll spit out heaps of paper.


As a very quick first check:


netstat -ltnp

as root. That will show you all services listening on the network:

This might show you stuff you want to shut down right away. Then you can continue with the solutions in the other answers.

For services that need to run, but not be accessible from the outside (such as a local DB server), consider changing the config so it only listens on localhost/ That way it can only be accessed by local users.


I would check out Bastille-Linux at http://www.bastille-unix.org/, its a set of scripts that you can run and it will check the system settings, file permissions, user setup etc. I've used it once or twice on my own boxes, and if finds issues on default installs (mostly r_x on rsh/rsync utils). It outputs as html/java+curses/flat text.


What distro?


  • Review iptables and/or firewall settings
  • Review SSHD configs
  • Review all externally accessible service configs
  • Ensure that you are running latest software available
  • Check for kernel vulnerabilities (uname -a and then google)
  • Review user permission and group permissions on editable files
  • No special distribution / all distributions Aug 11, 2009 at 7:52
  • Also, you might want to grab a list of installed packages. Something like dpkg --get-selections > installed_pkgs.txt for debian distros. Aug 11, 2009 at 7:55
  • 2
    You may also need to check for unusual setuid/setgid files, which accounts have passwords set, what their login shell is, etc. to eliminate the easy back doors.
    – mas
    Aug 11, 2009 at 8:15
  • Great suggestion mas, I completely forgot that one, which is potentially a huge hole. Aug 11, 2009 at 8:17

Another good first check is to run nmap hostname from another host on the network. This gives an outsider's view of what netstat showed on the host.


If you are worried, I would recommend following those tutorials you mentioned and rebuilding the server. Especially if you think the other admin might have left something bad. As the new admin, you should know how to deploy whatever service it is running again anyways.

Just make sure you back everything up first, you could image all the partitions to to make sure you really get it right.

If your boss won't let you, then everyone else recommendations sound good to me :-)

  • +1: If it's creation/configuration isn't documented and you have the time, then perhaps take the opportunity to rebuild it. Rather than having to do it under duress at a later date. Then you can be sure that it is secure and it will be documented for future reference.
    – Dan Carley
    Aug 11, 2009 at 21:05

In addition to some of the very good responses here, check out http://www.sans.org/. They have some very good documents if you're willing to do a little reading to get a better comprehension of "defense in depth".

Some of the very basic premises tho:

  • keep your servers patched
  • run only those services that need to be running
  • limit user access to the server
  • 1
    Remember to limit also physical access, not only from network.
    – iny
    Aug 11, 2009 at 13:55

Also try chkrootkit, it comes in the standard repository of most distribution and is anyway very easy to install. It will check your system for many known vulnerabilities, rootkit and worms.


One thing you can do to get a feel for the system is diff the /etc folder against a fresh install (with the same updates applied.) This will tell you what has changed so you can focus your security concerns there.


To expand on what mas said, here's a simple find command to list all the setuid and setgid files on the system for review.

find / -type f \( -perm -4000 -o -perm -2000 \) -print

Of course, like others have said, this is all assuming the machine doesn't have a rootkit on it already...


Chrootkit/rkhunter are the long hanging fruit. If you got a rootkit installed, everything that's reported will be compromised and thus not much help, so please download them from a known source, don't use the ones already on the box. Another good trick is to install a kernel you know is good (either from packages or roll your own). Check for backdoors (lsof -i and 0 uid non-root accounts). Inspecting firewall rules can usually tell you a lot about the previous admins' habits. Put a wireshark/snort on it, try to spot anything unusual. Look at where the logs are going. Check out all the .profile/.bashrc sort of files for any unusual commands. Look in .ssh/known_hosts for any dodgy hosts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.