Skip to main content
Information Security

Return to Question

Tweeted twitter.com/#!/StackSecurity/status/277352403483910144
added 9 characters in body
Source Link
orokusaki
orokusaki
  • 1.4k
  • 2
  • 10
  • 13

Obvious things:

  1. Disable root login (rather, don't enable it)
  2. Secure SSH (no root login, key auth only, timeout after inactivity, whitelist users who can SSH in, etc.)
  3. IP Tables firewall whitelisting only the proper traffic on 80/443/22
  4. Update all packages
  5. Disable Control-Alt-Delete for the console

The OS is Ubuntu 12.04.1 x86-64 (server) and the use is as a web application server. The software used is:

  1. Nginx (run as www-data)
  2. Supervisor (run as root with no HTTP server or RPC server)
  3. uWSGI (run as www-data)
  4. Celery (run as www-data)
  5. Redis (run as www-data)
  6. Memcached (run as www-data)

I ask because I'm not sure what things that are installed with Ubuntu 12.04.1 which might be have potential security vulnerabilities, which things I may have accidentally left off my "obvious" checklist and which of the packages I've mentioned above which might have security vulnerabilities (all installed as packages vs manually compiling, btw).

Obvious things:

  1. Disable root login (rather, don't enable it)
  2. Secure SSH (no root login, key auth only, timeout after inactivity, whitelist users who can SSH in, etc.)
  3. IP Tables firewall whitelisting only the proper traffic on 80/443/22
  4. Update all packages
  5. Disable Control-Alt-Delete for the console

The OS is Ubuntu 12.04.1 x86-64 and the use is as a web application server. The software used is:

  1. Nginx (run as www-data)
  2. Supervisor (run as root with no HTTP server or RPC server)
  3. uWSGI (run as www-data)
  4. Celery (run as www-data)
  5. Redis (run as www-data)
  6. Memcached (run as www-data)

I ask because I'm not sure what things that are installed with Ubuntu 12.04.1 which might be have potential security vulnerabilities, which things I may have accidentally left off my "obvious" checklist and which of the packages I've mentioned above which might have security vulnerabilities (all installed as packages vs manually compiling, btw).

Obvious things:

  1. Disable root login (rather, don't enable it)
  2. Secure SSH (no root login, key auth only, timeout after inactivity, whitelist users who can SSH in, etc.)
  3. IP Tables firewall whitelisting only the proper traffic on 80/443/22
  4. Update all packages
  5. Disable Control-Alt-Delete for the console

The OS is Ubuntu 12.04.1 x86-64 (server) and the use is as a web application server. The software used is:

  1. Nginx (run as www-data)
  2. Supervisor (run as root with no HTTP server or RPC server)
  3. uWSGI (run as www-data)
  4. Celery (run as www-data)
  5. Redis (run as www-data)
  6. Memcached (run as www-data)

I ask because I'm not sure what things that are installed with Ubuntu 12.04.1 which might be have potential security vulnerabilities, which things I may have accidentally left off my "obvious" checklist and which of the packages I've mentioned above which might have security vulnerabilities (all installed as packages vs manually compiling, btw).

Source Link
orokusaki
orokusaki
  • 1.4k
  • 2
  • 10
  • 13

What are some steps to take for securing a Linux server that aren't in this list of obvious ones?

Obvious things:

  1. Disable root login (rather, don't enable it)
  2. Secure SSH (no root login, key auth only, timeout after inactivity, whitelist users who can SSH in, etc.)
  3. IP Tables firewall whitelisting only the proper traffic on 80/443/22
  4. Update all packages
  5. Disable Control-Alt-Delete for the console

The OS is Ubuntu 12.04.1 x86-64 and the use is as a web application server. The software used is:

  1. Nginx (run as www-data)
  2. Supervisor (run as root with no HTTP server or RPC server)
  3. uWSGI (run as www-data)
  4. Celery (run as www-data)
  5. Redis (run as www-data)
  6. Memcached (run as www-data)

I ask because I'm not sure what things that are installed with Ubuntu 12.04.1 which might be have potential security vulnerabilities, which things I may have accidentally left off my "obvious" checklist and which of the packages I've mentioned above which might have security vulnerabilities (all installed as packages vs manually compiling, btw).