Questions tagged [hardening]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
16 views

Printing on hardened windows clients

I have inherited hardened clients with a lot of policies applied to them. There is an application running on this clients, that should show the windows printing dialog, but it does not pop up. There ...
user avatar
0 votes
2 answers
100 views

Network Security: Hardening IPv6 on Ubuntu Server?

I am familiar with hardening IPv4 on Ubuntu server, but when I use the same rules for IPv6 with ip6tables, the IPv6 connectivity is lost resulting in Destination unreachable: Address unreachable ...
user avatar
  • 13
0 votes
0 answers
135 views

Is it worth it to install and configure fail2ban for an Bind9 authoritative DNS server?

In our project infrastructure we have a nameserver, based on bind9. This nameserver is configured as primary and authoritative, so it is quite important. The question is, should I install and ...
user avatar
  • 31
0 votes
0 answers
88 views

OpenLDAP/ds-389 Secure Hardening Guide

I am in the process of setting up an Open Ldap Server (ds-389) however, I cannot find many good resources which define a security or hardening guide which can be applied to the configuration or schema ...
user avatar
0 votes
1 answer
37 views

Locally and durably remove some files of a Debian package

Context: On Debian, when hardening PHP I disabled and deleted a few unused PHP modules: for example, for wddx I deleted: /etc/php/7.3/*/conf.d/20-wddx.ini /etc/php/7.3/mods-available/wddx.ini /usr/...
user avatar
  • 250
1 vote
0 answers
43 views

Small business/charity first-time server build; Initializing and hardening?

I'm the volunteer IT coordinator for our small church. We currently use a Synology NAS as a file server, surveillance controller, web server, email server and DNS. It does a decent job with most of ...
user avatar
1 vote
2 answers
628 views

OpenSSH internal-sftp not accepting allowed/denied_requests

Trying to set up a highly restricted SFTP server with OpenSSH_7.4p1 for remote scripts to upload data. The goal is a black hole where the scripts can do a "put" with user level keys and no ...
user avatar
  • 13
0 votes
1 answer
55 views

Block IIS GUI sites configuration change for hardening

I am trying to find the configuration settings for this hardening on Windows 2019: Block IIS sites configuration change from the IIS GUI, even for administrators. The sites web.config change should ...
user avatar
  • 98
0 votes
0 answers
95 views

IS this error an Ancient “su – hostile” vulnerability in Debian 8 & 9 ? $ bash: cannot set terminal process group (-1): Inappropriate ioctl for device

Just received this error >> bash: cannot set terminal process group (-1): Inappropriate ioctl for device then the disk partition went into READ-Only mode ; also noticed gnome-software was ...
user avatar
0 votes
1 answer
29 views

iptables policy & saving in RHEL

As part of a "Hardening" task, I need to run iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP On our servers. Normally we would run this command and then run /sbin/...
user avatar
1 vote
1 answer
3k views

Editing Authselect files

I'm hardening fedora OS following the CIS Benchmark for fedora 28. In one of the remediations, the Benchmark provides an script that modifies the files system-auth and password-auth. When I apply the ...
user avatar
  • 11
0 votes
1 answer
1k views

I am trying to setup some auditd rules but getting error -F missing operation for auid

i am trying to setup the below rule in /etc/audit/audit.rules -a always,exit -S unlink -S unlinkat -S rename -S renameat -F auid>= 1000 -F auid!=4294967295 -k delete which didn't work so i tried ...
user avatar
1 vote
1 answer
626 views

Which IPv4/6 ICMP types should I drop to block ping?

I'm using ufw. I want to block pings for IPv4 and IPv6. I've read guides by ubuntu as well as hosting companies I use, and answers on StackExchange sites. Advice is always to edit /etc/ufw/before....
user avatar
  • 745
0 votes
1 answer
473 views

Why does `lynis audit system` suggest to change the `sshd` port from `22` to '' (empty)?

I ran a lynis audit system on a reasonably fresh ubuntu 18.04 instance, and of the more intriguing suggestions it made was: Test: Checking Port in /tmp/lynis.AT7qAndGzq Result: Option Port found ...
user avatar
  • 173
0 votes
0 answers
41 views

Webserver (Apache/NGINX): Disabling connections / binding on IP address

I was wondering if I would be able to harden my Apache configuration in such a way it would only respond to one of it's actual vhost configuration (e.g. https://myhost.example.com/) and make it ...
user avatar
1 vote
3 answers
2k views

securing/hardening ntp client on Linux servers - config file

I have a clean install of Debian with the NTP client. I was given settings to secure secure my NTP client configuration. I know how to add them to the /etc/ntp.conf file but I am not if settings need ...
user avatar
2 votes
0 answers
209 views

Attempting to delete cron directory in docker gives "Invalid argument"

I'm trying to write a hardening script to remove the cron directory in an alpine Linux based docker image. docker run -it alpine:3.7 rm -rf /var/spool/cron rm: can't remove '/var/spool/cron': Invalid ...
user avatar
0 votes
0 answers
437 views

Debian 9 file system CIS-CAT hardening issues

I'm performing a CIS-CAT scan and I'm questioning the results of the scanner being poorly designed. Now I am running on Debian 9 which isn't officially supported by the scanner but I can get it to run ...
user avatar
  • 250
1 vote
0 answers
109 views

How to configure Dovecot to disable NIST's curves and still rertain EECDH?

I am interested in configuring Dovecot's TLS so as to retain forward secrecy, but eliminate all of NIST's elliptic curves. Besides being subject to side channel attacks, in some quarters there is a ...
user avatar
1 vote
1 answer
1k views

Windows 10: Kerberos settings not found

In our company, we want to configure our Windows-based infrastructure compliant to the IASE SCAP specifications, e.g., the Microsoft Windows Server 2016 STIG Benchmark. In this document, there is the ...
user avatar
-1 votes
1 answer
81 views

When someone gains remote access to a server are there other ways to execute system commands other than the bash shell?

I am hardening a server and attempting to build a restrictive layer to a potential hacker even with root access to the server to do harm. If a user gains root or user access to the shell via say ...
user avatar
3 votes
3 answers
10k views

how to configure postfix behind haproxy?

During the last years I had an emailserver running for my small business without problems. Now that my company has grown, I wanted to add a bit of redundancy and added a failover emailserver with a ...
user avatar
1 vote
0 answers
379 views

Solaris 11 Auditing, audit_control file cannot be found

First of all I would like to say I'm not a Linux/Solaris guy, but just assigned task to look at 1 particular item in hardening checklist, so thinking to seek help here to understand more. From the ...
user avatar
  • 122
1 vote
1 answer
3k views

Hardening TLS web server Apache settings [closed]

OS: GNU/Linux Debian 9.2, fully updated. Under the title Hardening TLS web server Apache settings I mean the following: disabling TLS 1.0, already done with this setting: SSLProtocol -all +TLSv1.1 +...
user avatar
2 votes
3 answers
8k views

Hardening Apache: How to disable Apache manual or make it unreachable?

I just found requests like this in my access log: 180.76.15.134 - - [30/Oct/2017:22:38:05 +0100] "GET /manual/en/server-wide.html HTTP/1.1" 200 3551 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +...
user avatar
  • 153
0 votes
3 answers
4k views

Security advantages of a SSH jumphost / jumpserver

I want to learn more about hardening Webservers and currently stopped on the topic Jumphost. So for me it seems like a Jumphost for example is connected to a webserver via VPN and the only server who ...
user avatar
2 votes
1 answer
3k views

Windows Server 2016 + CIS security benchmarks: "access denied" on GP objects, locked out of all shares incl. SYSVOL

We have got an Active Directory domain with Windows Server 2016 on the domain controller and up-to-date Windows 10 on all clients. Not long ago I began deploying the Center for Internet Security (CIS) ...
user avatar
  • 21
1 vote
1 answer
1k views

How to secure a 'public' sftp?

I have a server which enables some users of my services to upload files using SFTP. When I talk about users, I can neither be sure who they are nor how many have access. I have set up the access as ...
user avatar
  • 630
3 votes
0 answers
2k views

Changed policy: locked out local and domain administrator account on Windows Server 2012

I'm kind of a rookie when it comes to servers and server hardening. I was following the CIS benchmark for Windows Server 2012 and changed the allow log on locally policy to include administrator, ...
user avatar
1 vote
1 answer
362 views

Hardening web server cyphers: which cypher list to choose, or how to map between Mozilla and Hynek

Until now I was only aware of Hynek Schlawack's blog post on hardening web server cyphers having a relatively short list of cyphers. But recently I found How to fix 'logjam' vulnerability in ...
user avatar
2 votes
3 answers
1k views

SELinux restrict Apache/PHP access

I installed a minimal CentOS system with Apache, PHP and SELinux in a default configuration: SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root ...
user avatar
  • 21
0 votes
1 answer
212 views

Securing local repository with SSH and chroot

I've got a local Debian repository server in my network and I want my clients to upgrade, update, and install packages from it through SSH. I configured my sources.list so it would look like this : ...
user avatar
2 votes
1 answer
737 views

CIS benchmark differences between 2008R2 to 2012R2

I'm looking at hardening our golden image inline with the CIS benchmarks for Windows Server 2008R2 and 2012R2. But, after looking at the two benchmark documents(registration required - sorry) from CIS,...
user avatar
  • 121
4 votes
5 answers
52k views

Use Script To Edit Local Group Policy Windows Server 2012

I'm hardening a Windows Server 2012 R2 machine for serving secure web pages and following a guide that lays out multiple Local Group Policy Settings and Registry Settings. When researching how to ...
user avatar
  • 103
14 votes
2 answers
2k views

How to prevent users from extending their window of valid login

Been working on some security hardening procedures for a RedHat box, and I wanted to know if would be possible to prevent a user from changing his password, once it's expired. For one of our clients ...
user avatar
4 votes
5 answers
39k views

How Can I Enable MSS Group Policy Settings Windows Server 2012

In the past I have gone through a server hardening checklist on a Windows Server 2008 web server for PCI compliance. Basically there are a lot of Group Policy, Registry, and other settings that need ...
user avatar
  • 103
4 votes
1 answer
5k views

Using App Pool Identity vs Local Account in IIS

I am supposed to harden web applications we have developed in our company.I decided to create separate application pool for each web site for this purpose. My question is whether using Application ...
user avatar
0 votes
1 answer
138 views

cache_dir and some hardening squid

Suppose i'm going to define multiple cache_dir such as : cache_dir ..... # disk 1 cache_dir ..... # disk 2 cache_dir ..... # disk 3 Question: Do i need to define maximum_object_size and ...
user avatar
0 votes
1 answer
453 views

Local port access blocked by iptables

Although experienced with Linux, I'm new to iptables, having set it up following a Rackspace virtual server setup guide. Using port scans and checking remote access to required ports, I can see all ...
user avatar
2 votes
1 answer
543 views

Hardening Ubuntu with Docker.io

I am new to Docker so please keep in mind. The old way: Create cloud instance Add Ubuntu OS Provision / harden Linux via Chef Develop app locally Deploy via Capistrano or some other deployment ...
user avatar
  • 1,525
-1 votes
1 answer
3k views

How do I disable unnecessary Windows services and test for stability?

When I configure a minimal Server (unselecting any role in SCW) I still have quite a number of (obscure) services running or set up as manual. Requirements in my project say that the Server shall ...
user avatar
  • 107
3 votes
1 answer
10k views

Account Lockout with pam_faillock in RHEL6

Previously, I asked about using pam_tally2 under RHEL6. I would like to pose this question and answer to document the recommended use of pam_faillock over pam_tally2 for the same function; What is ...
user avatar
  • 12.3k
-6 votes
1 answer
3k views

In standalone Windows, safely force all apps to use AppData\Local\ instead of AppData\Roaming\ and Hardening security [closed]

In "standalone" or individual windows (vista & above: Vista, Win7, Win8, Win8.1, etc OS based) computers & tablets, which are configured to use only "TCP/IP" network component, each has ...
user avatar
  • 101
1 vote
3 answers
1k views

ipv6 on Ubuntu server - how do I secure?

On our Ubuntu server, ipv4 & ipv6 are enabled. We have taken these steps so far. Enabled iptables & ip6tables Copied the rules exactly from our iptables to ip6tables Do we need to make ...
user avatar
  • 1,525
0 votes
1 answer
352 views

prevent explorer.exe from launching internet explorer

In a Windows Terminal Server (2003 R2) where the users are not allowed to run a remote desktop, but just the applications they want (that's Citrix work), i've published "Explorer.exe" for the users to ...
user avatar
  • 181
6 votes
4 answers
13k views

How do I secure a Dell Idrac card?

I'm trying to completely lock down a server which has to exist outside of a firewall/directly routed to the internet and whilst I have hardened the base OS to the best of my ability, I had a moment of ...
user avatar
0 votes
1 answer
704 views

Is debootstrap chroot safe?

I followed this tutorial http://wiki.debian.org/chroot on Debian Squeeze AMD64, to get a separated environment. This chroot is really safe? In others chroot tutorials, create a chroot for an ...
user avatar
  • 89
7 votes
2 answers
23k views

Account Lockout with pam_tally2 in RHEL6

I am using pam_tally2 to lockout accounts after 3 failed logins per policy, however, the connecting user does not receive the error indicating pam_tally2's action. (Via SSH.) I expect to see on the ...
user avatar
  • 12.3k
2 votes
3 answers
1k views

Which services to disable on a CentOs 5.8 web/database server?

I have just setup my CentOS 5.8 64 [final] server as a webserver. Specs: 2x E5620 Intel CPU, DDR3 RAM, Hardware Adaptec RAID 10, 4x SAS drives. I have installed myself: Nginx PHP-FPM MySQL [...
user avatar
  • 1,421
0 votes
1 answer
491 views

Lock down a user on a stand-alone windows web server

I have a Windows Web Server 2008 R2 Core, which runs several web sites. There is no AD. One of the web applications requires Windows Authentication for a single user. I would like to restrict the ...
user avatar