Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [hardening]

The tag has no usage guidance.

0
votes
0answers
35 views

Debian 9 file system CIS-CAT hardening issues

I'm performing a CIS-CAT scan and I'm questioning the results of the scanner being poorly designed. Now I am running on Debian 9 which isn't officially supported by the scanner but I can get it to run ...
1
vote
0answers
27 views

How to configure Dovecot to disable NIST's curves and still rertain EECDH?

I am interested in configuring Dovecot's TLS so as to retain forward secrecy, but eliminate all of NIST's elliptic curves. Besides being subject to side channel attacks, in some quarters there is a ...
1
vote
1answer
53 views

Windows 10: Kerberos settings not found

In our company, we want to configure our Windows-based infrastructure compliant to the IASE SCAP specifications, e.g., the Microsoft Windows Server 2016 STIG Benchmark. In this document, there is the ...
-1
votes
1answer
67 views

When someone gains remote access to a server are there other ways to execute system commands other than the bash shell?

I am hardening a server and attempting to build a restrictive layer to a potential hacker even with root access to the server to do harm. If a user gains root or user access to the shell via say ...
2
votes
2answers
598 views

how to configure postfix behind haproxy?

During the last years I had an emailserver running for my small business without problems. Now that my company has grown, I wanted to add a bit of redundancy and added a failover emailserver with a ...
0
votes
0answers
29 views

Auditing CIS hardening

I am an auditor for IT and Cybersecurity. I am often at client site where I have to review settings on servers and computers, all different operating systems, Oracle databases, even legacy like ...
1
vote
0answers
157 views

Solaris 11 Auditing, audit_control file cannot be found

First of all I would like to say I'm not a Linux/Solaris guy, but just assigned task to look at 1 particular item in hardening checklist, so thinking to seek help here to understand more. From the ...
0
votes
0answers
67 views

Blank sections in CIS Benchmark for Windows 2016 Server

When reviewing the CIS benchmarks for Windows 2012 and Windows 2016 Server, many sections, such as Event Log, Local Policies, etc. say "This section is intentionally blank and exists to ensure the ...
1
vote
1answer
1k views

Hardening TLS web server Apache settings [closed]

OS: GNU/Linux Debian 9.2, fully updated. Under the title Hardening TLS web server Apache settings I mean the following: disabling TLS 1.0, already done with this setting: SSLProtocol -all +TLSv1.1 +...
-3
votes
3answers
1k views

Hardening Apache: How to disable Apache manual or make it unreachable?

I just found requests like this in my access log: 180.76.15.134 - - [30/Oct/2017:22:38:05 +0100] "GET /manual/en/server-wide.html HTTP/1.1" 200 3551 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +...
0
votes
3answers
1k views

Security advantages of a SSH jumphost / jumpserver

I want to learn more about hardening Webservers and currently stopped on the topic Jumphost. So for me it seems like a Jumphost for example is connected to a webserver via VPN and the only server who ...
2
votes
1answer
2k views

Windows Server 2016 + CIS security benchmarks: “access denied” on GP objects, locked out of all shares incl. SYSVOL

We have got an Active Directory domain with Windows Server 2016 on the domain controller and up-to-date Windows 10 on all clients. Not long ago I began deploying the Center for Internet Security (CIS) ...
1
vote
1answer
700 views

How to secure a 'public' sftp?

I have a server which enables some users of my services to upload files using SFTP. When I talk about users, I can neither be sure who they are nor how many have access. I have set up the access as ...
3
votes
0answers
1k views

Changed policy: locked out local and domain administrator account on Windows Server 2012

I'm kind of a rookie when it comes to servers and server hardening. I was following the CIS benchmark for Windows Server 2012 and changed the allow log on locally policy to include administrator, ...
1
vote
1answer
215 views

Hardening web server cyphers: which cypher list to choose, or how to map between Mozilla and Hynek

Until now I was only aware of Hynek Schlawack's blog post on hardening web server cyphers having a relatively short list of cyphers. But recently I found How to fix 'logjam' vulnerability in ...
3
votes
3answers
592 views

SELinux restrict Apache/PHP access

I installed a minimal CentOS system with Apache, PHP and SELinux in a default configuration: SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root ...
0
votes
1answer
133 views

Securing local repository with SSH and chroot

I've got a local Debian repository server in my network and I want my clients to upgrade, update, and install packages from it through SSH. I configured my sources.list so it would look like this : ...
2
votes
1answer
598 views

CIS benchmark differences between 2008R2 to 2012R2

I'm looking at hardening our golden image inline with the CIS benchmarks for Windows Server 2008R2 and 2012R2. But, after looking at the two benchmark documents(registration required - sorry) from CIS,...
4
votes
5answers
38k views

Use Script To Edit Local Group Policy Windows Server 2012

I'm hardening a Windows Server 2012 R2 machine for serving secure web pages and following a guide that lays out multiple Local Group Policy Settings and Registry Settings. When researching how to ...
14
votes
2answers
2k views

How to prevent users from extending their window of valid login

Been working on some security hardening procedures for a RedHat box, and I wanted to know if would be possible to prevent a user from changing his password, once it's expired. For one of our clients ...
4
votes
5answers
30k views

How Can I Enable MSS Group Policy Settings Windows Server 2012

In the past I have gone through a server hardening checklist on a Windows Server 2008 web server for PCI compliance. Basically there are a lot of Group Policy, Registry, and other settings that need ...
3
votes
1answer
3k views

Using App Pool Identity vs Local Account in IIS

I am supposed to harden web applications we have developed in our company.I decided to create separate application pool for each web site for this purpose. My question is whether using Application ...
0
votes
1answer
121 views

cache_dir and some hardening squid

Suppose i'm going to define multiple cache_dir such as : cache_dir ..... # disk 1 cache_dir ..... # disk 2 cache_dir ..... # disk 3 Question: Do i need to define maximum_object_size and ...
0
votes
1answer
340 views

Local port access blocked by iptables

Although experienced with Linux, I'm new to iptables, having set it up following a Rackspace virtual server setup guide. Using port scans and checking remote access to required ports, I can see all ...
2
votes
1answer
447 views

Hardening Ubuntu with Docker.io

I am new to Docker so please keep in mind. The old way: Create cloud instance Add Ubuntu OS Provision / harden Linux via Chef Develop app locally Deploy via Capistrano or some other deployment ...
-1
votes
1answer
3k views

How do I disable unnecessary Windows services and test for stability?

When I configure a minimal Server (unselecting any role in SCW) I still have quite a number of (obscure) services running or set up as manual. Requirements in my project say that the Server shall ...
4
votes
1answer
9k views

Account Lockout with pam_faillock in RHEL6

Previously, I asked about using pam_tally2 under RHEL6. I would like to pose this question and answer to document the recommended use of pam_faillock over pam_tally2 for the same function; What is ...
-6
votes
1answer
2k views

In standalone Windows, safely force all apps to use AppData\Local\ instead of AppData\Roaming\ and Hardening security [closed]

In "standalone" or individual windows (vista & above: Vista, Win7, Win8, Win8.1, etc OS based) computers & tablets, which are configured to use only "TCP/IP" network component, each has ...
1
vote
3answers
1k views

ipv6 on Ubuntu server - how do I secure?

On our Ubuntu server, ipv4 & ipv6 are enabled. We have taken these steps so far. Enabled iptables & ip6tables Copied the rules exactly from our iptables to ip6tables Do we need to make ...
0
votes
1answer
338 views

prevent explorer.exe from launching internet explorer

In a Windows Terminal Server (2003 R2) where the users are not allowed to run a remote desktop, but just the applications they want (that's Citrix work), i've published "Explorer.exe" for the users to ...
4
votes
4answers
9k views

How do I secure a Dell Idrac card?

I'm trying to completely lock down a server which has to exist outside of a firewall/directly routed to the internet and whilst I have hardened the base OS to the best of my ability, I had a moment of ...
0
votes
1answer
553 views

Is debootstrap chroot safe?

I followed this tutorial http://wiki.debian.org/chroot on Debian Squeeze AMD64, to get a separated environment. This chroot is really safe? In others chroot tutorials, create a chroot for an ...
6
votes
2answers
22k views

Account Lockout with pam_tally2 in RHEL6

I am using pam_tally2 to lockout accounts after 3 failed logins per policy, however, the connecting user does not receive the error indicating pam_tally2's action. (Via SSH.) I expect to see on the ...
2
votes
3answers
1k views

Which services to disable on a CentOs 5.8 web/database server?

I have just setup my CentOS 5.8 64 [final] server as a webserver. Specs: 2x E5620 Intel CPU, DDR3 RAM, Hardware Adaptec RAID 10, 4x SAS drives. I have installed myself: Nginx PHP-FPM MySQL [...
0
votes
1answer
419 views

Lock down a user on a stand-alone windows web server

I have a Windows Web Server 2008 R2 Core, which runs several web sites. There is no AD. One of the web applications requires Windows Authentication for a single user. I would like to restrict the ...
-7
votes
2answers
954 views

How strong is parallels plesk 11 inbuilt firewall for linux os? from an newbie [closed]

I am new to Linux Dedicated server hosting and plesk panel 11 and i would like to know about inbuilt plesk 11 firewall security features and how harden it is?
1
vote
1answer
504 views

Outlook 2010 Security Settings and Hardening

We are looking at rolling out Outlook 2010 in the near future. What recommendations, guides, settings, tools, etc. would you recommend to secure and harden the installation and usage of Outlook 2010? ...
4
votes
2answers
581 views

WebDAV Security and Hardening

What are the security ramifications that one should be aware of when considering using WebDAV? How does one go about securing it? What else should I know about it?
1
vote
2answers
4k views

NFS server + client : Recommended hardening / final touches

We have just setup a lovely little nfs share / client for the first time. a) The UID for files on the client side, is showing up as 4294967294 when listed via ls, but the client is able to create and ...
7
votes
3answers
7k views

CentOS 6 Minimal or Hardened Install

I am working on building some new CentOs 6 servers and creating documentation for the installation of said servers. I would like to create a base CentOS 6 server install that would be light on the ...
2
votes
2answers
836 views

Searching For a Desktop Security Software to harden Windows machines, anybody?

I'm a network administrator of a small/medium network. I'm looking for a software (Free or Not) which can harden Windows Computers (XP And Win7) for the propose of hardening standalone desktop ...
0
votes
2answers
317 views

Server is too optimized?

I have a linux 4gb Quad core server w/ apache that is used for this website. I notice when I go to SSH and type TOP to see load averages, they are usually around 0.80. Now from what I understand, if ...
3
votes
1answer
1k views

Did anyone know about update in Bastille for unix/linux?

I'm just wonder that bastille project is still active or not? which alternative tools are proper for both unix and linux? Thanky you very much
0
votes
3answers
149 views

Different techniques to secure a server

I am trying to secure a Linux server but i even also want to know the types of vulnerabilities associated and the attacks that happen and how so that i can completely understand securing a server
0
votes
2answers
834 views

what should be limit to use for IPTABLE rate limiting for a webserver

I see on my webserver some logs as follows 203.252.157.98 - :25:02 "GET //phpmyadmin/ HTTP/1.1" 404 393 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro" 203.252.157.98 - :25:03 "GET //...
2
votes
5answers
336 views

Windows hardening [closed]

Can anyone point me at some good resources on Windows hardening servers and desktop? From 2000 upwards. Thanks.
5
votes
3answers
592 views

What are some specific changes you make when hardening a new NetBSD install?

I know most of the general advice: "turn off unnecessary services", "no really, turn off unnecessary services", "least privilege", etc. I've also seen a few guides and/or tools, e.g., Bastille, for ...
2
votes
2answers
267 views

General guide for securing windows server 2008

Is there a guide for securing windows server 2008? I seem to remember reading a MS doc on how to harden a Win2k server, but I can not find a publication for win2k8.
3
votes
2answers
4k views

Recommendations for sysctl.conf settings to harden Linux against DDoS attacks?

A recent article from UNIXy http://blog.unixy.net/2010/08/the-penultimate-guide-to-stopping-a-ddos-attack-a-new-approach/ has suggestions to harden a Linux box against DDoS attacks. Example of sysctl....
1
vote
2answers
302 views

How to block users from seeing others processes?

Generally it's one of the functionalities of (For example) grsecurity - user sees only his own processes, and not all others. But - I'd prefer to avoid installing grsecurity - perhaps something like ...