Questions tagged [hardening]
The hardening tag has no usage guidance.
78
questions
0
votes
0
answers
48
views
DISA STIG False Positives and Tailoring Profile
we currently use oscap to run security scans to validate configurations in DISA STIG for our Linux machines. We are seeing a lot of false positives and we are trying to figure out if there is a way to ...
1
vote
1
answer
468
views
Does SSH compression make the protocol more insecure?
I'm auditing one ubuntu server using a tool named lynis, which performs several tests to configuration files and give suggestions to harden the servers. For example, it suggest to reduce the value of ...
- 121
0
votes
0
answers
66
views
Why should I disable insecure SSH hostkeys if I never plan on using them?
A number of articles suggest removing insecure (broken) SSH key types in order to have a more secure server. In practice, if I only connect to the server with secure key types, why should I bother ...
0
votes
0
answers
30
views
Printing on hardened windows clients
I have inherited hardened clients with a lot of policies applied to them. There is an application running on this clients, that should show the windows printing dialog, but it does not pop up.
There ...
0
votes
2
answers
379
views
Network Security: Hardening IPv6 on Ubuntu Server?
I am familiar with hardening IPv4 on Ubuntu server, but when I use the same rules for IPv6 with ip6tables, the IPv6 connectivity is lost resulting in Destination unreachable: Address unreachable ...
- 13
0
votes
0
answers
434
views
Is it worth it to install and configure fail2ban for an Bind9 authoritative DNS server?
In our project infrastructure we have a nameserver, based on bind9. This nameserver is configured as primary and authoritative, so it is quite important. The question is, should I install and ...
- 21
0
votes
0
answers
325
views
OpenLDAP/ds-389 Secure Hardening Guide
I am in the process of setting up an Open Ldap Server (ds-389) however, I cannot find many good resources which define a security or hardening guide which can be applied to the configuration or schema ...
- 1
1
vote
3
answers
213
views
Locally and durably remove some files of a Debian package
Context: On Debian, when hardening PHP I disabled and deleted a few unused PHP modules: for example, for wddx I deleted:
/etc/php/7.3/*/conf.d/20-wddx.ini
/etc/php/7.3/mods-available/wddx.ini
/usr/...
- 220
1
vote
0
answers
46
views
Small business/charity first-time server build; Initializing and hardening?
I'm the volunteer IT coordinator for our small church. We currently use a Synology NAS as a file server, surveillance controller, web server, email server and DNS. It does a decent job with most of ...
1
vote
2
answers
2k
views
OpenSSH internal-sftp not accepting allowed/denied_requests
Trying to set up a highly restricted SFTP server with OpenSSH_7.4p1 for remote scripts to upload data. The goal is a black hole where the scripts can do a "put" with user level keys and no ...
- 13
0
votes
1
answer
90
views
Block IIS GUI sites configuration change for hardening
I am trying to find the configuration settings for this hardening on Windows 2019:
Block IIS sites configuration change from the IIS GUI, even for administrators.
The sites web.config change should ...
- 98
0
votes
0
answers
130
views
IS this error an Ancient “su – hostile” vulnerability in Debian 8 & 9 ? $ bash: cannot set terminal process group (-1): Inappropriate ioctl for device
Just received this error >>
bash: cannot set terminal process group (-1): Inappropriate ioctl for device
then the disk partition went into READ-Only mode ; also noticed gnome-software was ...
- 1
0
votes
1
answer
55
views
iptables policy & saving in RHEL
As part of a "Hardening" task, I need to run
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
On our servers. Normally we would run this command and then run /sbin/...
- 281
1
vote
1
answer
5k
views
Editing Authselect files
I'm hardening fedora OS following the CIS Benchmark for fedora 28.
In one of the remediations, the Benchmark provides an script that modifies the files system-auth and password-auth. When I apply the ...
- 11
0
votes
1
answer
2k
views
I am trying to setup some auditd rules but getting error -F missing operation for auid
i am trying to setup the below rule in /etc/audit/audit.rules
-a always,exit -S unlink -S unlinkat -S rename -S renameat -F auid>= 1000 -F auid!=4294967295 -k delete
which didn't work so i tried ...
user438713
1
vote
1
answer
1k
views
Which IPv4/6 ICMP types should I drop to block ping?
I'm using ufw.
I want to block pings for IPv4 and IPv6. I've read guides by ubuntu as well as hosting companies I use, and answers on StackExchange sites.
Advice is always to edit /etc/ufw/before....
- 898
0
votes
1
answer
626
views
Why does `lynis audit system` suggest to change the `sshd` port from `22` to '' (empty)?
I ran a lynis audit system on a reasonably fresh ubuntu 18.04 instance, and of the more intriguing suggestions it made was:
Test: Checking Port in /tmp/lynis.AT7qAndGzq
Result: Option Port found
...
- 215
0
votes
0
answers
45
views
Webserver (Apache/NGINX): Disabling connections / binding on IP address
I was wondering if I would be able to harden my Apache configuration in such a way it would only respond to one of it's actual vhost configuration (e.g. https://myhost.example.com/) and make it ...
2
votes
3
answers
3k
views
securing/hardening ntp client on Linux servers - config file
I have a clean install of Debian with the NTP client. I was given settings to secure secure my NTP client configuration. I know how to add them to the /etc/ntp.conf file but I am not if settings need ...
- 255
2
votes
0
answers
262
views
Attempting to delete cron directory in docker gives "Invalid argument"
I'm trying to write a hardening script to remove the cron directory in an alpine Linux based docker image.
docker run -it alpine:3.7
rm -rf /var/spool/cron
rm: can't remove '/var/spool/cron': Invalid ...
0
votes
0
answers
507
views
Debian 9 file system CIS-CAT hardening issues
I'm performing a CIS-CAT scan and I'm questioning the results of the scanner being poorly designed. Now I am running on Debian 9 which isn't officially supported by the scanner but I can get it to run ...
- 250
1
vote
0
answers
157
views
How to configure Dovecot to disable NIST's curves and still rertain EECDH?
I am interested in configuring Dovecot's TLS so as to retain forward secrecy, but eliminate all of NIST's elliptic curves.
Besides being subject to side channel attacks, in some quarters there is a ...
- 280
1
vote
1
answer
1k
views
Windows 10: Kerberos settings not found
In our company, we want to configure our Windows-based infrastructure compliant to the IASE SCAP specifications, e.g., the Microsoft Windows Server 2016 STIG Benchmark.
In this document, there is the ...
-1
votes
1
answer
82
views
When someone gains remote access to a server are there other ways to execute system commands other than the bash shell?
I am hardening a server and attempting to build a restrictive layer to a potential hacker even with root access to the server to do harm.
If a user gains root or user access to the shell via say ...
- 212
4
votes
2
answers
12k
views
how to configure postfix behind haproxy?
During the last years I had an emailserver running for my small business without problems.
Now that my company has grown, I wanted to add a bit of redundancy and added a failover emailserver with a ...
- 41
1
vote
0
answers
446
views
Solaris 11 Auditing, audit_control file cannot be found
First of all I would like to say I'm not a Linux/Solaris guy, but just assigned task to look at 1 particular item in hardening checklist, so thinking to seek help here to understand more.
From the ...
- 132
1
vote
1
answer
3k
views
Hardening TLS web server Apache settings [closed]
OS: GNU/Linux Debian 9.2, fully updated.
Under the title Hardening TLS web server Apache settings I mean the following:
disabling TLS 1.0, already done with this setting:
SSLProtocol -all +TLSv1.1 +...
- 499
2
votes
3
answers
10k
views
Hardening Apache: How to disable Apache manual or make it unreachable?
I just found requests like this in my access log:
180.76.15.134 - - [30/Oct/2017:22:38:05 +0100] "GET /manual/en/server-wide.html HTTP/1.1" 200 3551 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +...
- 153
0
votes
3
answers
4k
views
Security advantages of a SSH jumphost / jumpserver
I want to learn more about hardening Webservers and currently stopped on the topic Jumphost. So for me it seems like a Jumphost for example is connected to a webserver via VPN and the only server who ...
- 137
2
votes
1
answer
4k
views
Windows Server 2016 + CIS security benchmarks: "access denied" on GP objects, locked out of all shares incl. SYSVOL
We have got an Active Directory domain with Windows Server 2016 on the domain controller and up-to-date Windows 10 on all clients. Not long ago I began deploying the Center for Internet Security (CIS) ...
- 21
1
vote
1
answer
1k
views
How to secure a 'public' sftp?
I have a server which enables some users of my services to upload files using SFTP. When I talk about users, I can neither be sure who they are nor how many have access.
I have set up the access as ...
- 640
3
votes
0
answers
2k
views
Changed policy: locked out local and domain administrator account on Windows Server 2012
I'm kind of a rookie when it comes to servers and server hardening. I was following the CIS benchmark for Windows Server 2012 and changed the allow log on locally policy to include administrator, ...
- 31
2
votes
1
answer
421
views
Hardening web server cyphers: which cypher list to choose, or how to map between Mozilla and Hynek
Until now I was only aware of Hynek Schlawack's blog post on hardening web server cyphers having a relatively short list of cyphers.
But recently I found How to fix 'logjam' vulnerability in ...
2
votes
3
answers
1k
views
SELinux restrict Apache/PHP access
I installed a minimal CentOS system with Apache, PHP and SELinux in a default configuration:
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root ...
- 21
0
votes
1
answer
246
views
Securing local repository with SSH and chroot
I've got a local Debian repository server in my network and I want my clients to upgrade, update, and install packages from it through SSH.
I configured my sources.list so it would look like this :
...
2
votes
1
answer
743
views
CIS benchmark differences between 2008R2 to 2012R2
I'm looking at hardening our golden image inline with the CIS benchmarks for Windows Server 2008R2 and 2012R2. But, after looking at the two benchmark documents(registration required - sorry) from CIS,...
- 121
4
votes
5
answers
54k
views
Use Script To Edit Local Group Policy Windows Server 2012
I'm hardening a Windows Server 2012 R2 machine for serving secure web pages and following a guide that lays out multiple Local Group Policy Settings and Registry Settings.
When researching how to ...
- 103
14
votes
2
answers
2k
views
How to prevent users from extending their window of valid login
Been working on some security hardening procedures for a RedHat box, and I wanted to know if would be possible to prevent a user from changing his password, once it's expired.
For one of our clients ...
- 243
4
votes
5
answers
40k
views
How Can I Enable MSS Group Policy Settings Windows Server 2012
In the past I have gone through a server hardening checklist on a Windows Server 2008 web server for PCI compliance. Basically there are a lot of Group Policy, Registry, and other settings that need ...
- 103
5
votes
1
answer
6k
views
Using App Pool Identity vs Local Account in IIS
I am supposed to harden web applications we have developed in our company.I decided to create separate application pool for each web site for this purpose.
My question is whether using Application ...
- 277
0
votes
1
answer
144
views
cache_dir and some hardening squid
Suppose i'm going to define multiple cache_dir such as :
cache_dir ..... # disk 1
cache_dir ..... # disk 2
cache_dir ..... # disk 3
Question:
Do i need to define maximum_object_size and ...
- 612
0
votes
1
answer
485
views
Local port access blocked by iptables
Although experienced with Linux, I'm new to iptables, having set it up following a Rackspace virtual server setup guide.
Using port scans and checking remote access to required ports, I can see all ...
- 103
2
votes
1
answer
567
views
Hardening Ubuntu with Docker.io
I am new to Docker so please keep in mind.
The old way:
Create cloud instance
Add Ubuntu OS
Provision / harden Linux via Chef
Develop app locally
Deploy via Capistrano or some other deployment ...
- 1,555
-1
votes
1
answer
3k
views
How do I disable unnecessary Windows services and test for stability?
When I configure a minimal Server (unselecting any role in SCW) I still have quite a number of (obscure) services running or set up as manual.
Requirements in my project say that the Server shall ...
- 107
3
votes
1
answer
10k
views
Account Lockout with pam_faillock in RHEL6
Previously, I asked about using pam_tally2 under RHEL6. I would like to pose this question and answer to document the recommended use of pam_faillock over pam_tally2 for the same function;
What is ...
- 12.5k
-6
votes
1
answer
3k
views
In standalone Windows, safely force all apps to use AppData\Local\ instead of AppData\Roaming\ and Hardening security [closed]
In "standalone" or individual windows (vista & above: Vista, Win7, Win8, Win8.1, etc OS based) computers & tablets, which are configured to use only "TCP/IP" network component, each has ...
- 101
1
vote
3
answers
1k
views
ipv6 on Ubuntu server - how do I secure?
On our Ubuntu server, ipv4 & ipv6 are enabled. We have taken these steps so far.
Enabled iptables & ip6tables
Copied the rules exactly from our iptables to ip6tables
Do we need to make ...
- 1,555
0
votes
1
answer
353
views
prevent explorer.exe from launching internet explorer
In a Windows Terminal Server (2003 R2) where the users are not allowed to run a remote desktop, but just the applications they want (that's Citrix work), i've published "Explorer.exe" for the users to ...
- 181
6
votes
4
answers
13k
views
How do I secure a Dell Idrac card?
I'm trying to completely lock down a server which has to exist outside of a firewall/directly routed to the internet and whilst I have hardened the base OS to the best of my ability, I had a moment of ...
- 3,536
0
votes
1
answer
763
views
Is debootstrap chroot safe?
I followed this tutorial http://wiki.debian.org/chroot on Debian Squeeze AMD64, to get a separated environment.
This chroot is really safe? In others chroot tutorials, create a chroot for an ...
- 89