Questions tagged [hardening]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
19 views

Editing Authselect files

I'm hardening fedora OS following the CIS Benchmark for fedora 28. In one of the remediations, the Benchmark provides an script that modifies the files system-auth and password-auth. When I apply the ...
0
votes
0answers
26 views

I am trying to setup some auditd rules but getting error -F missing operation for auid

i am trying to setup the below rule in /etc/audit/audit.rules -a always,exit -S unlink -S unlinkat -S rename -S renameat -F auid>= 1000 -F auid!=4294967295 -k delete which didn't work so i tried ...
0
votes
0answers
41 views

ModSecurity rules for Wordpress running on IIS server for blocking multiple login tries (unable to use Locationmatch)

has someone tried to run ModSecurity on IIS server and block login attempts to wp-login.php (xmlrpc.php too) after X tries in some period of time (or without any period of time but after Z seconds ...
1
vote
1answer
113 views

Which IPv4/6 ICMP types should I drop to block ping?

I'm using ufw. I want to block pings for IPv4 and IPv6. I've read guides by ubuntu as well as hosting companies I use, and answers on StackExchange sites. Advice is always to edit /etc/ufw/before....
0
votes
1answer
141 views

Why does `lynis audit system` suggest to change the `sshd` port from `22` to '' (empty)?

I ran a lynis audit system on a reasonably fresh ubuntu 18.04 instance, and of the more intriguing suggestions it made was: Test: Checking Port in /tmp/lynis.AT7qAndGzq Result: Option Port found ...
0
votes
0answers
35 views

Webserver (Apache/NGINX): Disabling connections / binding on IP address

I was wondering if I would be able to harden my Apache configuration in such a way it would only respond to one of it's actual vhost configuration (e.g. https://myhost.example.com/) and make it ...
0
votes
0answers
114 views

WINDOWS - deploy CIS hardened image with SCCM (or other deployment tool)

My objective is to use a golden image to deploy multiple Windows Server 2016 machines. I have read posts where people configure a reference server that contains all the needed applications. Next, they ...
1
vote
3answers
807 views

securing/hardening ntp client on Linux servers - config file

I have a clean install of Debian with the NTP client. I was given settings to secure secure my NTP client configuration. I know how to add them to the /etc/ntp.conf file but I am not if settings need ...
2
votes
0answers
125 views

Attempting to delete cron directory in docker gives “Invalid argument”

I'm trying to write a hardening script to remove the cron directory in an alpine Linux based docker image. docker run -it alpine:3.7 rm -rf /var/spool/cron rm: can't remove '/var/spool/cron': Invalid ...
0
votes
0answers
346 views

Debian 9 file system CIS-CAT hardening issues

I'm performing a CIS-CAT scan and I'm questioning the results of the scanner being poorly designed. Now I am running on Debian 9 which isn't officially supported by the scanner but I can get it to run ...
1
vote
0answers
65 views

How to configure Dovecot to disable NIST's curves and still rertain EECDH?

I am interested in configuring Dovecot's TLS so as to retain forward secrecy, but eliminate all of NIST's elliptic curves. Besides being subject to side channel attacks, in some quarters there is a ...
1
vote
1answer
460 views

Windows 10: Kerberos settings not found

In our company, we want to configure our Windows-based infrastructure compliant to the IASE SCAP specifications, e.g., the Microsoft Windows Server 2016 STIG Benchmark. In this document, there is the ...
-1
votes
1answer
74 views

When someone gains remote access to a server are there other ways to execute system commands other than the bash shell?

I am hardening a server and attempting to build a restrictive layer to a potential hacker even with root access to the server to do harm. If a user gains root or user access to the shell via say ...
3
votes
3answers
4k views

how to configure postfix behind haproxy?

During the last years I had an emailserver running for my small business without problems. Now that my company has grown, I wanted to add a bit of redundancy and added a failover emailserver with a ...
1
vote
0answers
293 views

Solaris 11 Auditing, audit_control file cannot be found

First of all I would like to say I'm not a Linux/Solaris guy, but just assigned task to look at 1 particular item in hardening checklist, so thinking to seek help here to understand more. From the ...
1
vote
1answer
3k views

Hardening TLS web server Apache settings [closed]

OS: GNU/Linux Debian 9.2, fully updated. Under the title Hardening TLS web server Apache settings I mean the following: disabling TLS 1.0, already done with this setting: SSLProtocol -all +TLSv1.1 +...
-2
votes
3answers
4k views

Hardening Apache: How to disable Apache manual or make it unreachable?

I just found requests like this in my access log: 180.76.15.134 - - [30/Oct/2017:22:38:05 +0100] "GET /manual/en/server-wide.html HTTP/1.1" 200 3551 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +...
0
votes
3answers
2k views

Security advantages of a SSH jumphost / jumpserver

I want to learn more about hardening Webservers and currently stopped on the topic Jumphost. So for me it seems like a Jumphost for example is connected to a webserver via VPN and the only server who ...
2
votes
1answer
3k views

Windows Server 2016 + CIS security benchmarks: “access denied” on GP objects, locked out of all shares incl. SYSVOL

We have got an Active Directory domain with Windows Server 2016 on the domain controller and up-to-date Windows 10 on all clients. Not long ago I began deploying the Center for Internet Security (CIS) ...
1
vote
1answer
896 views

How to secure a 'public' sftp?

I have a server which enables some users of my services to upload files using SFTP. When I talk about users, I can neither be sure who they are nor how many have access. I have set up the access as ...
3
votes
0answers
2k views

Changed policy: locked out local and domain administrator account on Windows Server 2012

I'm kind of a rookie when it comes to servers and server hardening. I was following the CIS benchmark for Windows Server 2012 and changed the allow log on locally policy to include administrator, ...
1
vote
1answer
247 views

Hardening web server cyphers: which cypher list to choose, or how to map between Mozilla and Hynek

Until now I was only aware of Hynek Schlawack's blog post on hardening web server cyphers having a relatively short list of cyphers. But recently I found How to fix 'logjam' vulnerability in ...
3
votes
3answers
884 views

SELinux restrict Apache/PHP access

I installed a minimal CentOS system with Apache, PHP and SELinux in a default configuration: SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root ...
0
votes
1answer
159 views

Securing local repository with SSH and chroot

I've got a local Debian repository server in my network and I want my clients to upgrade, update, and install packages from it through SSH. I configured my sources.list so it would look like this : ...
2
votes
1answer
687 views

CIS benchmark differences between 2008R2 to 2012R2

I'm looking at hardening our golden image inline with the CIS benchmarks for Windows Server 2008R2 and 2012R2. But, after looking at the two benchmark documents(registration required - sorry) from CIS,...
4
votes
5answers
47k views

Use Script To Edit Local Group Policy Windows Server 2012

I'm hardening a Windows Server 2012 R2 machine for serving secure web pages and following a guide that lays out multiple Local Group Policy Settings and Registry Settings. When researching how to ...
14
votes
2answers
2k views

How to prevent users from extending their window of valid login

Been working on some security hardening procedures for a RedHat box, and I wanted to know if would be possible to prevent a user from changing his password, once it's expired. For one of our clients ...
4
votes
5answers
35k views

How Can I Enable MSS Group Policy Settings Windows Server 2012

In the past I have gone through a server hardening checklist on a Windows Server 2008 web server for PCI compliance. Basically there are a lot of Group Policy, Registry, and other settings that need ...
3
votes
1answer
4k views

Using App Pool Identity vs Local Account in IIS

I am supposed to harden web applications we have developed in our company.I decided to create separate application pool for each web site for this purpose. My question is whether using Application ...
0
votes
1answer
131 views

cache_dir and some hardening squid

Suppose i'm going to define multiple cache_dir such as : cache_dir ..... # disk 1 cache_dir ..... # disk 2 cache_dir ..... # disk 3 Question: Do i need to define maximum_object_size and ...
0
votes
1answer
442 views

Local port access blocked by iptables

Although experienced with Linux, I'm new to iptables, having set it up following a Rackspace virtual server setup guide. Using port scans and checking remote access to required ports, I can see all ...
2
votes
1answer
512 views

Hardening Ubuntu with Docker.io

I am new to Docker so please keep in mind. The old way: Create cloud instance Add Ubuntu OS Provision / harden Linux via Chef Develop app locally Deploy via Capistrano or some other deployment ...
-1
votes
1answer
3k views

How do I disable unnecessary Windows services and test for stability?

When I configure a minimal Server (unselecting any role in SCW) I still have quite a number of (obscure) services running or set up as manual. Requirements in my project say that the Server shall ...
4
votes
1answer
10k views

Account Lockout with pam_faillock in RHEL6

Previously, I asked about using pam_tally2 under RHEL6. I would like to pose this question and answer to document the recommended use of pam_faillock over pam_tally2 for the same function; What is ...
-6
votes
1answer
2k views

In standalone Windows, safely force all apps to use AppData\Local\ instead of AppData\Roaming\ and Hardening security [closed]

In "standalone" or individual windows (vista & above: Vista, Win7, Win8, Win8.1, etc OS based) computers & tablets, which are configured to use only "TCP/IP" network component, each has ...
1
vote
3answers
1k views

ipv6 on Ubuntu server - how do I secure?

On our Ubuntu server, ipv4 & ipv6 are enabled. We have taken these steps so far. Enabled iptables & ip6tables Copied the rules exactly from our iptables to ip6tables Do we need to make ...
0
votes
1answer
346 views

prevent explorer.exe from launching internet explorer

In a Windows Terminal Server (2003 R2) where the users are not allowed to run a remote desktop, but just the applications they want (that's Citrix work), i've published "Explorer.exe" for the users to ...
5
votes
4answers
11k views

How do I secure a Dell Idrac card?

I'm trying to completely lock down a server which has to exist outside of a firewall/directly routed to the internet and whilst I have hardened the base OS to the best of my ability, I had a moment of ...
0
votes
1answer
609 views

Is debootstrap chroot safe?

I followed this tutorial http://wiki.debian.org/chroot on Debian Squeeze AMD64, to get a separated environment. This chroot is really safe? In others chroot tutorials, create a chroot for an ...
6
votes
2answers
23k views

Account Lockout with pam_tally2 in RHEL6

I am using pam_tally2 to lockout accounts after 3 failed logins per policy, however, the connecting user does not receive the error indicating pam_tally2's action. (Via SSH.) I expect to see on the ...
2
votes
3answers
1k views

Which services to disable on a CentOs 5.8 web/database server?

I have just setup my CentOS 5.8 64 [final] server as a webserver. Specs: 2x E5620 Intel CPU, DDR3 RAM, Hardware Adaptec RAID 10, 4x SAS drives. I have installed myself: Nginx PHP-FPM MySQL [...
0
votes
1answer
442 views

Lock down a user on a stand-alone windows web server

I have a Windows Web Server 2008 R2 Core, which runs several web sites. There is no AD. One of the web applications requires Windows Authentication for a single user. I would like to restrict the ...
-7
votes
2answers
958 views

How strong is parallels plesk 11 inbuilt firewall for linux os? from an newbie [closed]

I am new to Linux Dedicated server hosting and plesk panel 11 and i would like to know about inbuilt plesk 11 firewall security features and how harden it is?
1
vote
1answer
555 views

Outlook 2010 Security Settings and Hardening

We are looking at rolling out Outlook 2010 in the near future. What recommendations, guides, settings, tools, etc. would you recommend to secure and harden the installation and usage of Outlook 2010? ...
4
votes
2answers
740 views

WebDAV Security and Hardening

What are the security ramifications that one should be aware of when considering using WebDAV? How does one go about securing it? What else should I know about it?
1
vote
2answers
5k views

NFS server + client : Recommended hardening / final touches

We have just setup a lovely little nfs share / client for the first time. a) The UID for files on the client side, is showing up as 4294967294 when listed via ls, but the client is able to create and ...
7
votes
3answers
7k views

CentOS 6 Minimal or Hardened Install

I am working on building some new CentOs 6 servers and creating documentation for the installation of said servers. I would like to create a base CentOS 6 server install that would be light on the ...
2
votes
2answers
864 views

Searching For a Desktop Security Software to harden Windows machines, anybody?

I'm a network administrator of a small/medium network. I'm looking for a software (Free or Not) which can harden Windows Computers (XP And Win7) for the propose of hardening standalone desktop ...
0
votes
2answers
317 views

Server is too optimized?

I have a linux 4gb Quad core server w/ apache that is used for this website. I notice when I go to SSH and type TOP to see load averages, they are usually around 0.80. Now from what I understand, if ...
3
votes
1answer
1k views

Did anyone know about update in Bastille for unix/linux?

I'm just wonder that bastille project is still active or not? which alternative tools are proper for both unix and linux? Thanky you very much