Tag Info

Hot answers tagged

41

Identify required applications and processes and apply a checklist to either avoid installing them, or worst case uninstall them after the initial build. Here I'm thinking those common culprits which still seem to go on to far too many distros by default! NFS services: nfsd, lockd, mountd, statd, portmapper telnet server and ftp server R services: rlogin, ...


22

Grab the Center for Internet Security (CIS) guide for securing Apache (it describes in detail how to enhance the security): Edit: Updated link CIS Apache HTTP Server 2.2.x Benchmark If you have a license to Nessus, then you can run an automated check by grabbing their audit template:


22

Run only MySQL on the Server - If possible run only MySQL on the server and remove any unused services. Firewall - Limit access by IP address to only the servers / clients that require access. User Privileges - When creating users always give the minimum amount of privileges and expand as needed. Also try to avoid using '%' wildcard for hosts and instead ...


21

The "Linux Server" space includes a huge range of distributions, each with their own default configuration update strategy, package management toolchain, and approach to default services and open ports. There is also a wide range of deployment scenarios: hardening a web server is quite different than hardening a linux-based router. You may get better ...


16

Point in time system hardening is a beneficial feat, but what really defines deploying a server securely is what is done to maintain that state. Pick any of the quality checklists (see links below) that detail the recommended configuration modifications to make to strengthen the security of your servers and apply those changes that make sense for your ...


15

Along with advice on how to use Burp, you should also not forget to customise the following: Form Submission: To set suitable names and values for forms submitted by Burp, as I presume you don't want to send 'Weiner' :-) Within the Burp window - navigate to the 'Spider' tab and then the 'options' menu. From here you should update the standard values ...


13

The main ones are: Use SSL sitewide. Don't offer anything over http. Instead, any connection via http should immediately redirect to the main site's landing page via https. Use HTTPS Strict Transport Security. This will tell users' browsers: please, only connect to me over https. This defends against sslstrip and similar man-in-the-middle attacks. Set ...


13

You could do a lot worse than starting with the Sans checklist. My only criticism of this is that it does not place enough emphasis on managing the security of a deployed system - particularly ensuring vendor patches are up to date, planning a good permissions model, managing IDS exception reporting etc.


11

You cannot really hide the domain name, because if someone connects to the port 443 of your server and begins initiating a SSL connection, your server will respond by sending his certificate... which contains the server name. Actually, the client may send the intended client name as part of a Server Name Indication, which is a rather recent extension which ...


10

SSL Labs rocks for verifying all the nuances of a proper SSL setup - just put your domain name in and hit submit: https://www.ssllabs.com/


10

Right now, there is no known weakness with MD5 or CBC encryption or 96-bit MAC as they are used in SSH. So there is, stricto sensu, no security benefit in enacting the configuration modifications that your are proposing. It could be argued that removing support for some algorithms might lead to security issues because it may prevent some clients from ...


9

You might also wanna check the Secure Configuration of the Apache Web Server, Apache Server Version 1.3.3 on Red Hat Linux 5.1 . It's a guide from NSA


9

First, you have to figure out the purpose of the server and the threat model you are trying to defend against. Is it a single-use server? Do multiple users have access? If multiple users have access, do you trust them all, or not? Let me assume that this server is used only for network services, and you do not have to deal with the threat of attacks from ...


8

Everything: As root, just do this: rm /dev/random mknod /dev/random c 1 9 Now /dev/random will actually access the same underlying logic as /dev/urandom. After this change, both /dev/random and /dev/urandom will draw from the non-blocking pool. The non-blocking pool will draw from the blocking pool, which the system will still fill.


8

Use SSH key based logins Secure MySQL Disable phpMyAdmin, webmin, etc Close all ports/process's that are not needed Use a file integrity checker Use mod_security Set the proper permissions/groups This is a good guide: http://serverfault.com/questions/212269/tips-for-securing-a-lamp-server Basic guide for hardening http://www.wpsecure.net/server-guide/ ...


8

What a great question. I think this is one of the things that divides the games industry- do you centralise your servers to keep control over them, but then suffer from lack of flexibility to gamer needs and be accused of ruling with an iron fist or do you give control over to the gamer population and run the risk of malicious or tainted servers. Three ...


8

I will first dispute your reasons for deactivating DSA and ECDSA: There is no known weakness in either which makes them "more vulnerable" than plain RSA. There has been badly made implementations of DSA or ECDSA; however, there has also been badly made implementations of RSA, and in some case it resulted in RSA key leakage (e.g. Bleichenbacher's attack). ...


7

I suppose the usual OS methods (including fail2ban if remote ssh admin is required), then block all external access to the MySQL port, or allow a whitelist to connect if absolutely necessary. Set a password for the mysqladmin user. After that, the mysqladmin user should only be allowed to connect from localhost and should be the only user granted any ...


7

Stricto sensu, you cannot really have a generic test. In HTTP, the client announces whether it supports compression with an Accept-Encoding header line. The server will then feel allowed to use these compression schemes. @Adnan points to this blog post which describes how one can manually send a HTTP request to a server and see what the server responds with. ...


6

I've had some interesting feedback on this question both here and on Stack Overflow. There have been lots of responses related to stack traces (a custom errors issue, not a debug issue) and performance (not [directly] a security issue). The most compelling response is that conditional compilation constants (#if DEBUG...) could cause unexpected behavior, but ...


6

All of these configurations should be default from your distribution and most of them don't have a security impact if read. If an attacker could modify .bashrc then they could pull off a sudo hijack, but just being able to read the .bashrc isn't a problem. Sometimes the .bash_history file will contain passwords. Sometimes passwords are an argument to a ...


6

One good sequence of tutorials I've seen is on the Security Ninja site. That links got the last one in the series (focuses on the scanner tab) but there's links to the other ones from that page.


6

The Center for Internet Security Benchmarks tend to be my go to source for hardening advice. They will, of course, need to be tailored to your environment, but I have found them to be fairly general purpose and easily modified. On the linked download page you will find both IIS and SQL Server documents. As for the other half of your question, it seems like ...


6

There's lots of good advice here, so I won't repeat things already mentioned. But what I will say is: Don't forget to replace the default error pages with things that don't give away your Web Server release or kernel revision. I tend to replace each default html with 1 liners that are something like "Error 400." It gives very little about the system away. ...


6

Whitelisting applications is a defense-in-depth measure. While it won't prevent a truly determined person from doing something nefarious, it will stop most people -- especially if users are running as non-admin. Practicality is relative to your environment. If it's as you say, a home system, then the liklihood is that you don't have group policy in place. ...


6

Absolutely absolutely pick up the Web Application Hackers Handbook by Portswigger (author of Burp), which is written as both an introduction to the concepts relevant to Web App reversing / hacking, but also as a step-by-step guide for applying those concepts with Burp Suite. Note that the Second Edition is now available.


5

The message you are seeing is from the default apache "400 error page". You can override the 400 error page via: ErrorDocument 400 /error-docs/400.shtml in the appropriate location in your config file. Replace the default text with a generic message that doesn't include the host name.


5

I think gowenfawr and George Bailey have it right. Terminating a HTTP protocol connection instead of returning an error response is a very low level mechanism. As a perpetual escapee of the unintended consequences beast, I recommend against implementing a mechanism without a clear purpose. Humans are error prone and you may by accident prevent a valid ...


5

From the IETF draft [ http://tools.ietf.org/html/draft-ietf-websec-strict-transport-sec-06 ]: 10.1 HSTS Policy expiration time considerations Server implementations and deploying web sites need to consider whether they are setting an expiry time that is a constant value into the future, e.g., by constantly sending the same max-age value to UAs. ...


5

And what about the Grsecurity/PAX kernel patches, these include very nice features for hardening the server at kernel level. Summary: Protect heap and stack overflows Hide other users processes Role based access control list Chroot hardening /proc, FIFO and dmesg restrictions Advanced logging capabilities



Only top voted, non community-wiki answers of a minimum length are eligible