Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm setting up a new CentOS 6 server and am looking into some security audit tools to validate my configuration and to point out weak spots in the server.

  • There are a lot of non up2date tools out there on source forge no longer updated

  • Which Linux (distro) is recommended for auditing and guidance in terms of security configuration of the server?

  • Are there any tools that can help guide an administrator to configure a new server to determine if anything has been setup incorrectly/insecurely?

share|improve this question

2 Answers 2

you can use a combination of a vulnerability scanner and credentialed checking to achieve a decent level of confidence in a base build.

Nessus, Nexpose and OpenVAS will all do scans of servers and if provided with credentials to log into the server will so some more detailed checks. Nessus and Nexpose are commercial products but have options which can be used for free for (AFAICR) non-commercial use only.

OpenVAS is open source so is freely usuable.

In addition to that the commercial version of Nessus can do compliance checking against Center for Internet Security or other security standards.

The benchmarks that CIS provide are usually worth reading in and of themselves as they have some decent suggestions for build hardening (although they don't have RedHat CentOS 6 coverage yet as far as I can see, I'd imagine that the v5 standard would still be largely applicable)

share|improve this answer
    
+1 for mentioning CIS benchmarks. These are by far the system administrator's reference for hardening –  lisa17 Apr 5 '12 at 21:01

Backtrack Linux Distribution include the tools you need to scan for vulnerabilities in your server but first you have to determine what your server is used for and after that use the right tools , if it is web app server you can scan the server with the tools mentioned above plus web application security scanners (acuentix , w3af ,burp suite ...etc) and so on

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.