1

When hardening a LINUX system what command line tools would you remove first in order to make an attackers life really difficult?

closed as primarily opinion-based by symcbean, AndrolGenhald, Arminius, forest, Steffen Ullrich Jun 28 '18 at 3:10

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • What is the system supposed to do? What sort of attacker? Security is pointless without defining these things. – RibaldEddie Jun 28 '18 at 0:36
  • 1
    Generally, any command line tool can be re-implemented by an attacker. Removing it does not slow them down. The only exception is for executables that are setuid, setgid, or setcap. – forest Jun 28 '18 at 2:51
  • 1
    That's the wrong approach. Don't remove commands from a complex system but start with a small system (like Alpine Linux) and whenever you add something to it ask yourself why this really needs to be on the system and how it could be abused - especially with powerful things like compilers, scripting languages, network tools etc which makes it easy for an attacker to add any functionality they need themselves. Apart from that, it is unclear what you have installed on your system so it is unclear what all can be removed. – Steffen Ullrich Jun 28 '18 at 3:09
2

Most of the native tools are necessary for system administration. There are very few that you could remove without being concerned that you'll need them one day.

You run a serious risk of extending outages or delaying projects when administrators are missing essential tools.

Instead, you should focus on:

  1. Making it difficult for an attacker to communicate with the system (network boundaries, packet inspection, removal of unnecessary services)

  2. Isolating hosts based on sensitivity of data (DMZs, network ACLs)

  3. Blocking inappropriate communication (HIPS, network IDS/IPS, local firewall/iptables)

  4. Preventing exploitation and limiting escalation (patching, app-specific hardening, least privilege users, chmod jails, sandboxing)

2

The first thing I would do, is to keep off any insecure Telnet/FTP/Rlogin/RSH or other analogous superannuated services.

There are various commands and files that can be captured from people when they are connected on the same network. The solvent of the problem would be the usage of services that implement protocols with SSL/TLS encryption (FTPS, OpenSSH, and others).

Example on a Debian/Ubuntu system:

~ $ sudo apt-get --purge remove nis yp-tools xinetd atftpd tftpd tftpd-hpa telnetd rsh-server rsh-redone-server
1

First? First I would remove compilers like gcc, g++, etc. No need for development tools on a prod system.

  • Who said it was a prod system? – symcbean Jun 27 '18 at 21:34
  • Many tools and commands recommend building from source rather than binary download – elsadek Jun 27 '18 at 21:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.