Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Are there any proven concepts or "installers" to get up and running based on the best practices securing and locking down a CentOS installation?

I'm hoping for an automated tool that would scan the system, give suggestions, change security settings, install a good network intrusion detection, and have some simple admin panel to check.

Is there such thing or is this just a fantasy?

share|improve this question
add comment

4 Answers

I doubt you will find a One-Stop-Shop kind of solution that actually works well. Your best bet will be to review one of the excellent hardening guidelines and implement what makes sense for you.

That being said, you should probably check out two projects

  1. Bastille
  2. Tiger

If you have a little more resources available some vulnerability assessment products can do configuration audits. For instance, ProfessionalFeed subscribers to Nessus have a large number of configuration audits available, including many CIS benchmarks.

All of these will inspect your install and make some recommendations on what to change or tell you how this install deviates from the standard. However, their base rulesets may very well not work for you. You really need to modify their checks to match how you want your environment to look.

share|improve this answer
    
Very Nice I found out about Bastille a while later Tiger haven't heard of that one yet. Are there also some tools like that to have network intrusion detection and firewall setup based on a guidance installer on best practice? Going to look into both options, install fresh centOS 6 today! Thx –  Rubytastic Oct 20 '11 at 12:18
    
Bastille looks awesome, but hasn't been in active development since about 7 years if I gather the information from their site correctly. –  user857990 May 15 '13 at 10:49
    
@user857990 That sounds about right. Tiger isn't exactly daily releases either but unfortunately we don't really have many choices in this area. –  Scott Pack May 15 '13 at 11:50
add comment

I think Scott Pack has a great answer. Probably also worth noting that you should at least have some passing familarity with the DISA STIGs here are some specific to RedHat. They will at least give you some idea on wrapping your mind around what you need to do as far as technical controls.

STIGs are mostly impractical to implement everything, but its not a bad starting point molding your own technical policy around.

  • You need to have a process
  • Realize it is going to take some time

Our brightest minds get it wrong all of the time. Alas, such is the way when your adversaries have the distinct advantage they have.

share|improve this answer
add comment

There is a new tool by David 'Rel1k' that not only applies to centOS but to all other Linux distros, have a look at Artillery on TrustedSec or Artillery on Github.

Tool name is Artillery! Easy to install and I think might do what you need! It gets constant updates and if you have any questions you can ask on Twitter about it to Dave Kennedy (ReL1K) @HackingDave

share|improve this answer
add comment

Two tools that do the checking/scanning bit, from the view of an attacker (which I find very helpful for hardening):

The second one is fairly new.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.