Hot answers tagged hardening
66
Shodan references publicly available machines which work like this:
Just don't do it.
Edit: analogy is relevant ! Shodan connects to machines and asks for their "banner", a publicly available text which may simply say: "to enter, use this default password: 1234". You might want to avoid people knocking at the door by the simple expedient of installing a ...
54
The Shodan project is pretty cool, but at its core isn't much more than a big honkin nmap database. The project has scanners that routinely scan the Internet and publish the findings into the database. That database is what you're searching. Since they are using standard detection routines the protections you would put in for a normal scan should protect you ...
34
For most home users, the only internet-facing device is their router.
So, how do you secure the router from stuff like Shodan?
Firstly, change the default password. Anyone armed with an IP scanning tool (Angry IP Scanner is the one I've tried) can find you if they input the relevant IP range and break in with the bog standard admin/admin login. What can ...
30
You don't need to find out how they got your IP - the entire Internet is constantly being scanned by malicious individuals, bots etc. If you have an FTP server on the Internet, one of these scans will find it and a whole series of attack attempts will commence.
Your downside is - you can't secure an FTP server. FTP just wasn't designed to provide encryption ...
26
Identify required applications and processes and apply a checklist to either avoid installing them, or worst case uninstall them after the initial build.
Here I'm thinking those common culprits which still seem to go on to far too many distros by default!
NFS services: nfsd, lockd, mountd, statd, portmapper
telnet server and ftp server
R services: rlogin, ...
26
This issue has come up on a couple SE forums already, so most of this is going to just be echoing my existing answers.
How can I prevent someone from accessing a Windows XP system via boot disk?
How to secure my Windows 7 PC?
A couple of fairly major issues exist here, which are really working against you:
Unless there's something you haven't mentioned, ...
20
Disable Root Login - Most automated attacks will concentrate on the root account so disallowing logins from that account is a good place to start.
Only Allow Certain Groups/Users - Limit what users and groups can SSH to the system.
Limit by IP or IP Range - One of the most effective ways of securing your system against SSH attacks.
Use Key Based ...
18
Run only MySQL on the Server - If possible run only MySQL on the server and remove any unused services.
Firewall - Limit access by IP address to only the servers / clients that require access.
User Privileges - When creating users always give the minimum amount of privileges and expand as needed. Also try to avoid using '%' wildcard for hosts and instead ...
17
Grab the Center for Internet Security (CIS) guide for securing Apache (it describes in detail how to enhance the security):
Edit: Updated link
CIS Apache HTTP Server 2.2.x Benchmark
If you have a license to Nessus, then you can run an automated check by grabbing their audit template:
17
The "Linux Server" space includes a huge range of distributions, each with their own default configuration update strategy, package management toolchain, and approach to default services and open ports. There is also a wide range of deployment scenarios: hardening a web server is quite different than hardening a linux-based router. You may get better ...
17
The real issue here is that the attacker only needs physical access to your hard drive in order to read or manipulate the files which contain your password hashes. There is already a thread on SuperUser which has some recommendations, which I will likely repeat here.
How to secure my Windows 7 PC?
As security compromises of a PC go, physical access is ...
16
Another thing you can do is add an iptables 'bruteforce' rule.
This will allow ip's to make NEW connections x times within y seconds. After these limits have been reached the packets will be dropped. This prevents brute-forces from continuously attacking your server. I have such protection on common scanned ports like FTP, SSH, IMAP, POP3, SMTP, etc....
...
16
NoSQL databases are relatively new (although arguably an old concept), I haven't seen any specific MongoDB hardening guides and the usual places I look (CISSecurity, vendor publications, Sans etc all come up short). Suggests it would be a good project for an organisation, uni student, infosec community to write one and maintain it.
There is some basic ...
15
There are lots of programs trawling the internet looking for vulnerable hosts. Certainly there are people who target their attacks - but starting from torrent logs will not yield very interesting targets.
Have a look at the sans.org site for basic checklists on securing your server.
13
I recommend the following steps, in rough order of priority:
Enable automatic updates. This is the best way to ensure you are always running the best, patched version of all software.
Turn on a firewall. A simple policy often suffices for desktops: roughly speaking, allow all outgoing connections, block all incoming connections. This is a lot easier than ...
12
Point in time system hardening is a beneficial feat, but what really defines deploying a server securely is what is done to maintain that state.
Pick any of the quality checklists (see links below) that detail the recommended configuration modifications to make to strengthen the security of your servers and apply those changes that make sense for your ...
12
I'm guessing that uninstalling IE is impossible or impractical.
Go to Control Panel -> Uninstall a program -> Turn Windows features on or off. There you can deselect Internet Explorer.
You need to harden IE as well. An application could launch or embed an IE window that could then be used to gain control of the system. Consider this attack: an attacker ...
11
You could do a lot worse than starting with the Sans checklist.
My only criticism of this is that it does not place enough emphasis on managing the security of a deployed system - particularly ensuring vendor patches are up to date, planning a good permissions model, managing IDS exception reporting etc.
11
First let me say, I'm not a security expert by any means. While you ask about securing linux desktops, I take your question to mean "how do I implement overall security using free unixes as a person who does personal computing as opposed to web serving." So I thought I would gather my thoughts on the subject and see what other people have to say about ...
11
So the short answer is that if you're providing a publicly available service (e.g. to the general Internet) your service has to be accessible and therefore search engines like shodan can find it, and all shodan does it to index publicly available information.
What you can do is minimize the information that shodan finds, by removing banners from ...
10
There is actually a really good guide to this on the wordpress website - Hardening WordPress.
However my personal short check list is
mod_security - @atdre already mentioned mod_security it is a very good step. However it does require a lot of tweaking of the core ruleset in order to allow wordpress to operate correctly. You will also most likely need ...
10
The Center for Internet Security publishes Benchmark configurations for several operating systems and other products, including: servers, workstations, infrastructure devices, and more.
The United States National Institute of Standards and Technology has published configurations for Windows 7 as the United States Government Configuration Baseline, and for ...
10
When it comes to something like a hardening guide, RHEL 6 is still considered fairly new. As sad as it seems, many of these types of guides take several months or years to produce. That being said, by and large, for your purposes the difference between EL 5 and EL 6 should be fairly minimal. When I began supporting EL 6, most of my changes were rather ...
9
I find a good step for hardening your php.ini file is to use the PHPSecInfo tool, this tool will outline what settings you have currently in your php.ini that may cause a security risk.
In addition to using that tool give this article on Hardening PHP from php.ini a look its good and picks up most of the major concerns.
Personally the two main things I ...
9
Baseline Server Hardening (aka, start here): http://technet.microsoft.com/en-us/library/cc526440.aspx
Intro to Hardening Server 2000: http://technet.microsoft.com/en-us/library/dd277465.aspx
Hardening Server 2003: http://www.microsoft.com/downloads/en/details.aspx?familyid=8A2643C1-0685-4D89-B655-521EA6C7B4DB&displaylang=en
Infrastructure Threat ...
9
You have to define what you are trying to protect and against whom. There are several assets:
Your geographical position
Who you call and who calls you
The contents of your conversations and SMS
Your phone bill
Then things are quite different, depending on whether the phone operator is a cooperative friend, a not-too-competent neutral third party, or an ...
9
The only true technical reason I'm aware of is the possibility of malicious file substitution. Consider an attacker who finds a way to write to arbitrary files. If they can overwrite /sbin/nologin or /bin/false with a copy of /bin/bash, then they can conceivably find a way to log in as a service user and continue to elevate their privilege from there.
...
9
To focus on your individual cases:
Absolutely anything he wants. Malware, rootkits, backdoors, keyloggers, the whole shebang.
Again, absolutely anything. It's exactly the same as having the USB disk, because he can set up a site where he can download the files he needs, or just download them from existing sites.
Wipe the disk, delete system files, write ...
Only top voted, non community-wiki answers of a minimum length are eligible
