Hot answers tagged

50

Identify required applications and processes and apply a checklist to either avoid installing them, or worst case uninstall them after the initial build. Here I'm thinking those common culprits which still seem to go on to far too many distros by default! NFS services: nfsd, lockd, mountd, statd, portmapper telnet server and ftp server R services: rlogin, ...


29

Grab the Center for Internet Security (CIS) guide for securing Apache (it describes in detail how to enhance the security): Edit: Updated link CIS Apache HTTP Server 2.2.x Benchmark If you have a license to Nessus, then you can run an automated check by grabbing their audit template:


28

Right now, there is no known weakness with MD5 or CBC encryption or 96-bit MAC as they are used in SSH. So there is, stricto sensu, no security benefit in enacting the configuration modifications that your are proposing. It could be argued that removing support for some algorithms might lead to security issues because it may prevent some clients from ...


23

The "Linux Server" space includes a huge range of distributions, each with their own default configuration update strategy, package management toolchain, and approach to default services and open ports. There is also a wide range of deployment scenarios: hardening a web server is quite different than hardening a linux-based router. You may get better ...


22

Run only MySQL on the Server - If possible run only MySQL on the server and remove any unused services. Firewall - Limit access by IP address to only the servers / clients that require access. User Privileges - When creating users always give the minimum amount of privileges and expand as needed. Also try to avoid using '%' wildcard for hosts and instead ...


20

Point in time system hardening is a beneficial feat, but what really defines deploying a server securely is what is done to maintain that state. Pick any of the quality checklists (see links below) that detail the recommended configuration modifications to make to strengthen the security of your servers and apply those changes that make sense for your setup....


17

The main ones are: Use SSL sitewide. Don't offer anything over http. Instead, any connection via http should immediately redirect to the main site's landing page via https. Use HTTPS Strict Transport Security. This will tell users' browsers: please, only connect to me over https. This defends against sslstrip and similar man-in-the-middle attacks. Set ...


16

You could do a lot worse than starting with the Sans checklist. My only criticism of this is that it does not place enough emphasis on managing the security of a deployed system - particularly ensuring vendor patches are up to date, planning a good permissions model, managing IDS exception reporting etc.


15

Along with advice on how to use Burp, you should also not forget to customise the following: Form Submission: To set suitable names and values for forms submitted by Burp, as I presume you don't want to send 'Weiner' :-) Within the Burp window - navigate to the 'Spider' tab and then the 'options' menu. From here you should update the standard values ...


12

First, you have to figure out the purpose of the server and the threat model you are trying to defend against. Is it a single-use server? Do multiple users have access? If multiple users have access, do you trust them all, or not? Let me assume that this server is used only for network services, and you do not have to deal with the threat of attacks from ...


12

General advice Any program written in Java Add -Djava.security.egd=file:///dev/urandom switch or -Djava.security.egd=file:/dev/./urandom to the command line invocation used to start the Java process. (Without this, Java uses /dev/random to seed its SecureRandom class, which can cause Java code to block unexpectedly.) Alternatively, in the $...


12

There may be harm in divulging your .htaccess file. This is usually one of the reasons why there's a rule to block access to .htaccess, like this: <Files .htaccess> Order Allow,Deny Deny from all </Files> The contents of this file may tell users about your configuration, such as where passwords, certificates, and so on reside in the system, ...


11

Use SSH key based logins Secure MySQL Disable phpMyAdmin, webmin, etc Close all ports/process's that are not needed Use a file integrity checker Use mod_security Set the proper permissions/groups This is a good guide: http://serverfault.com/questions/212269/tips-for-securing-a-lamp-server Basic guide for hardening: http://www.wpsecure.net/server-guide/ ...


11

SSL Labs rocks for verifying all the nuances of a proper SSL setup - just put your domain name in and hit submit: https://www.ssllabs.com/


11

You cannot really hide the domain name, because if someone connects to the port 443 of your server and begins initiating a SSL connection, your server will respond by sending his certificate... which contains the server name. Actually, the client may send the intended client name as part of a Server Name Indication, which is a rather recent extension which ...


11

I will first dispute your reasons for deactivating DSA and ECDSA: There is no known weakness in either which makes them "more vulnerable" than plain RSA. There has been badly made implementations of DSA or ECDSA; however, there has also been badly made implementations of RSA, and in some case it resulted in RSA key leakage (e.g. Bleichenbacher's attack). ...


10

From the IETF draft [ http://tools.ietf.org/html/draft-ietf-websec-strict-transport-sec-06 ]: 10.1 HSTS Policy expiration time considerations Server implementations and deploying web sites need to consider whether they are setting an expiry time that is a constant value into the future, e.g., by constantly sending the same max-age value to UAs. ...


10

Everything: As root, just do this: rm /dev/random mknod /dev/random c 1 9 Now /dev/random will actually access the same underlying logic as /dev/urandom. After this change, both /dev/random and /dev/urandom will draw from the non-blocking pool. The non-blocking pool will draw from the blocking pool, which the system will still fill.


9

I've had some interesting feedback on this question both here and on Stack Overflow. There have been lots of responses related to stack traces (a custom errors issue, not a debug issue) and performance (not [directly] a security issue). The most compelling response is that conditional compilation constants (#if DEBUG...) could cause unexpected behavior, but ...


9

There is a very extensive article at Wikipedia and it does not make sense to reiterate everything here. But to give you some highlights: It replaces OpenSSL on OpenBSD, OS X since 10.11 and on some other systems. It started with throwing away lots of stuff which was considered useless for the target platforms or insecure by design and it also added some ...


8

What a great question. I think this is one of the things that divides the games industry- do you centralise your servers to keep control over them, but then suffer from lack of flexibility to gamer needs and be accused of ruling with an iron fist or do you give control over to the gamer population and run the risk of malicious or tainted servers. Three ...


7

I suppose the usual OS methods (including fail2ban if remote ssh admin is required), then block all external access to the MySQL port, or allow a whitelist to connect if absolutely necessary. Set a password for the mysqladmin user. After that, the mysqladmin user should only be allowed to connect from localhost and should be the only user granted any ...


7

Whitelisting applications is a defense-in-depth measure. While it won't prevent a truly determined person from doing something nefarious, it will stop most people -- especially if users are running as non-admin. Practicality is relative to your environment. If it's as you say, a home system, then the liklihood is that you don't have group policy in place. ...


7

The originally highly voted answer to this question that was accepted was deleted because it was a direct plagiarism of 20 ways to secure your Apache configuration. That page is a fantastic resource. @RoryMcCune also posted this as a link on that answer: There's an OWASP project to develop a ModSecurity Core Rule Set here which could be of use.


7

The Center for Internet Security Benchmarks tend to be my go to source for hardening advice. They will, of course, need to be tailored to your environment, but I have found them to be fairly general purpose and easily modified. On the linked download page you will find both IIS and SQL Server documents. As for the other half of your question, it seems like ...


7

The message you are seeing is from the default apache "400 error page". You can override the 400 error page via: ErrorDocument 400 /error-docs/400.shtml in the appropriate location in your config file. Replace the default text with a generic message that doesn't include the host name.


7

When you use an SSH tunnel, as far as the target server is concerned, its client is the SSH server, not the actual client connecting to the SSH tunnel. For example, if you have an SSH client running on 10.1.1.1, connecting to an SSH server on 10.2.2.2 and establishing a tunnel to 10.3.3.3, when a client (possibly from 10.4.4.4 or anywhere else) connects to ...


7

Stricto sensu, you cannot really have a generic test. In HTTP, the client announces whether it supports compression with an Accept-Encoding header line. The server will then feel allowed to use these compression schemes. @Adnan points to this blog post which describes how one can manually send a HTTP request to a server and see what the server responds with. ...


7

The answer to this comes down to a risk-management decision that the organization makes. There are best practices, but even the bestest of practices can be compromised by risk-management decisions. There are no absolutes, even patch broken stuff is not an absolute. You had a clue in their response: compensating controls This phrase is used to justify ...


7

It is very good advice to not use the web browser for Internet traffic on the server. It's our policy (I work in cyber security for a federal agency) to never use a web browser (for Internet, or external websites) for any sort of Internet traffic even if it's to download a file that will be used on the server. As another user mentioned in their answer, it ...



Only top voted, non community-wiki answers of a minimum length are eligible