Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Currently, I am a junior application consultant and we are maintaining huge amounts of redhat machines as servers. I am given the chance and liberty by my boss (unbelieveable!) to go do my own research regarding the security of our own systems. So I thought, maybe I should ask around here.... Hope you don't mind :)

So the question is: What should be audited in a Red Hat 5.x+ system to ensure the safety and make sure that proper measures will be taken to realize the given points here below:

  • Critical data protection
  • illegal access prevention
  • system integrity
  • uptime
  • system updates and patches are most recent
  • and etc...

What I want to achieve with this is to create a uniform and secure process to audit our systems and chart the status to intervene. In the end, I would like to look for possibilities to integrate this process with our monitoring systems.

share|improve this question

look at this CIS benchmark RHEL 5 Benchmark

share|improve this answer
This one is pretty much like what I was looking for :) But of course, this one is very much specific on RHEL systems which I asked for, too. Thank you very much :) I wish I could Vote up, becuase this answer and the one below is all I needed for a start :) More questions will follow later. – lightblack Apr 19 '12 at 14:41

This isn't 100% duplicated, but have a read of our Hardening a Linux Server question - what this will help you do is cover off security controls across your installed Linux server base.

If you are including Linux desktops in your remit, some of the recommendations on that question will be less appropriate, but at least in thinking about what access users need, you will get a better view of controls required.

But step one for any hardening is to understand what and where your assets are - don't spend money protecting something that doesn't need to be protected.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.