Tag Info

Hot answers tagged

76

Shodan references publicly available machines which work like this: Just don't do it. Edit: analogy is relevant ! Shodan connects to machines and asks for their "banner", a publicly available text which may simply say: "to enter, use this default password: 1234". You might want to avoid people knocking at the door by the simple expedient of installing a ...


59

The Shodan project is pretty cool, but at its core isn't much more than a big honkin nmap database. The project has scanners that routinely scan the Internet and publish the findings into the database. That database is what you're searching. Since they are using standard detection routines the protections you would put in for a normal scan should protect you ...


48

Blocking outbound traffic is usually of benefit in limiting what an attacker can do once they've compromised a system on your network. So for example if they've managed to get malware onto a system (via an infected e-mail or browser page), the malware might try to "call home" to a command and control system on the Internet to get additional code downloaded ...


41

Identify required applications and processes and apply a checklist to either avoid installing them, or worst case uninstall them after the initial build. Here I'm thinking those common culprits which still seem to go on to far too many distros by default! NFS services: nfsd, lockd, mountd, statd, portmapper telnet server and ftp server R services: rlogin, ...


39

For most home users, the only internet-facing device is their router. So, how do you secure the router from stuff like Shodan? Firstly, change the default password. Anyone armed with an IP scanning tool (Angry IP Scanner is the one I've tried) can find you if they input the relevant IP range and break in with the bog standard admin/admin login. What can ...


31

You don't need to find out how they got your IP - the entire Internet is constantly being scanned by malicious individuals, bots etc. If you have an FTP server on the Internet, one of these scans will find it and a whole series of attack attempts will commence. Your downside is - you can't secure an FTP server. FTP just wasn't designed to provide encryption ...


27

This issue has come up on a couple SE forums already, so most of this is going to just be echoing my existing answers. How can I prevent someone from accessing a Windows XP system via boot disk? How to secure my Windows 7 PC? A couple of fairly major issues exist here, which are really working against you: Unless there's something you haven't mentioned, ...


27

Please keep in mind the Holy Trinity of Information Security: C(onfidentiality), I(ntegrity), and A(vailability). So when we talk about configuration hardening you need to consider the technology you're working with, the information being protected, how the information is used within the organization, and the threats. Based on those answers, and possibly ...


25

Disable Root Login - Most automated attacks will concentrate on the root account so disallowing logins from that account is a good place to start. Only Allow Certain Groups/Users - Limit what users and groups can SSH to the system. Limit by IP or IP Range - One of the most effective ways of securing your system against SSH attacks. Use Key Based ...


22

Grab the Center for Internet Security (CIS) guide for securing Apache (it describes in detail how to enhance the security): Edit: Updated link CIS Apache HTTP Server 2.2.x Benchmark If you have a license to Nessus, then you can run an automated check by grabbing their audit template:


22

Run only MySQL on the Server - If possible run only MySQL on the server and remove any unused services. Firewall - Limit access by IP address to only the servers / clients that require access. User Privileges - When creating users always give the minimum amount of privileges and expand as needed. Also try to avoid using '%' wildcard for hosts and instead ...


21

The "Linux Server" space includes a huge range of distributions, each with their own default configuration update strategy, package management toolchain, and approach to default services and open ports. There is also a wide range of deployment scenarios: hardening a web server is quite different than hardening a linux-based router. You may get better ...


19

NoSQL databases are relatively new (although arguably an old concept), I haven't seen any specific MongoDB hardening guides and the usual places I look (CISSecurity, vendor publications, Sans etc all come up short). Suggests it would be a good project for an organisation, uni student, infosec community to write one and maintain it. There is some basic ...


19

I recommend the following steps, in rough order of priority: Enable automatic updates. This is the best way to ensure you are always running the best, patched version of all software. Turn on a firewall. A simple policy often suffices for desktops: roughly speaking, allow all outgoing connections, block all incoming connections. This is a lot easier than ...


18

The real issue here is that the attacker only needs physical access to your hard drive in order to read or manipulate the files which contain your password hashes. There is already a thread on SuperUser which has some recommendations, which I will likely repeat here. How to secure my Windows 7 PC? As security compromises of a PC go, physical access is ...


16

Point in time system hardening is a beneficial feat, but what really defines deploying a server securely is what is done to maintain that state. Pick any of the quality checklists (see links below) that detail the recommended configuration modifications to make to strengthen the security of your servers and apply those changes that make sense for your ...


16

First let me say, I'm not a security expert by any means. While you ask about securing linux desktops, I take your question to mean "how do I implement overall security using free unixes as a person who does personal computing as opposed to web serving." So I thought I would gather my thoughts on the subject and see what other people have to say about ...


16

Another thing you can do is add an iptables 'bruteforce' rule. This will allow ip's to make NEW connections x times within y seconds. After these limits have been reached the packets will be dropped. This prevents brute-forces from continuously attacking your server. I have such protection on common scanned ports like FTP, SSH, IMAP, POP3, SMTP, etc.... ...


15

There are lots of programs trawling the internet looking for vulnerable hosts. Certainly there are people who target their attacks - but starting from torrent logs will not yield very interesting targets. Have a look at the sans.org site for basic checklists on securing your server.


14

So the short answer is that if you're providing a publicly available service (e.g. to the general Internet) your service has to be accessible and therefore search engines like shodan can find it, and all shodan does it to index publicly available information. What you can do is minimize the information that shodan finds, by removing banners from ...


14

Some commentary: Defending from common thieves Rather than wiping Windows 7, I've left it as a honeypot operating system. If a thief steals the laptop, when they turn it on, it will automatically boot up into Windows, without so much as even being prompted for a password. I installed a free application called Prey which will allow me to grab ...


13

There is actually a really good guide to this on the wordpress website - Hardening WordPress. However my personal short check list is mod_security - @atdre already mentioned mod_security it is a very good step. However it does require a lot of tweaking of the core ruleset in order to allow wordpress to operate correctly. You will also most likely need ...


13

You could do a lot worse than starting with the Sans checklist. My only criticism of this is that it does not place enough emphasis on managing the security of a deployed system - particularly ensuring vendor patches are up to date, planning a good permissions model, managing IDS exception reporting etc.


13

The only true technical reason I'm aware of is the possibility of malicious file substitution. Consider an attacker who finds a way to write to arbitrary files. If they can overwrite /sbin/nologin or /bin/false with a copy of /bin/bash, then they can conceivably find a way to log in as a service user and continue to elevate their privilege from there. ...


13

Coming from a security role, particularly if you've ever been involved in incident response, the idea of outbound filtering would seem a natural course in a high security environment. However, it is a very large and complex undertaking. Mention the words "egress filtering" to a firewall, network, or systems administrator and you'll likely get this response. ...


12

I'm guessing that uninstalling IE is impossible or impractical. Go to Control Panel -> Uninstall a program -> Turn Windows features on or off. There you can deselect Internet Explorer. You need to harden IE as well. An application could launch or embed an IE window that could then be used to gain control of the system. Consider this attack: an attacker ...



Only top voted, non community-wiki answers of a minimum length are eligible