Several partners and I have just started a small business and we would like to employ a good secure setup from day one. This is a problem however as there are many piecemeal packages, and I am stuck jamming them together and hoping there are no holes.
Are there any papers, tutorials, books, etc. that give use cases of fully secured systems? Specifically:
- Web server will be totally dedicated, no connection to the internal network for safety.
- Main server is used for internal collaboration, file storage, contact management, email server, things like that
- Each person has a laptop and would need a way of securely communicating with everyone else as well as a way to store files securely.
Currently we use Linux for everything. Ubuntu with users' homes encrypted and a truecrypt file for secure storage. I would like to up this to a Debian install that requires a passphrase at the boot loader as the entire partition is encrypted. We use RetroShare for communications as it has security built in, but it is just a temporary measure, and we would like to learn how to set up a secure centralized information server.
Webserver will be hosted off site through a third party. Has no useful information besides a few email addresses.
Laptops are crossing US/Canada border, they will need to be secure from entry without a warrant. The way I am thinking to secure them is:
- Apricorn Aegis USB Keys (They have a keypad to unlock the drive)
- Thay will have the laptops boot partition, the keyfile, users PGP, SSH, and any other keys.
The server will be Debian based, I have not settled on ANY packages as I have no idea which ones will work with what security packages. The servers location is physically secure so I am only worried about network intrusion. Last intrusion detection system I used was BlackFin or something on Windows in the Blaster32 days.
- SNORT for intrusion detection
- GnuPG, SSH
Remote file system access:
1 - Users can either VPN into the system through SSH
2 - Users can mount via SSHFS just what they need
3 - Presumably the VPN is a better idea.