Several partners and I have just started a small business and we would like to employ a good secure setup from day one. This is a problem however as there are many piecemeal packages, and I am stuck jamming them together and hoping there are no holes.

Are there any papers, tutorials, books, etc. that give use cases of fully secured systems? Specifically:

  • Web server will be totally dedicated, no connection to the internal network for safety.
  • Main server is used for internal collaboration, file storage, contact management, email server, things like that
  • Each person has a laptop and would need a way of securely communicating with everyone else as well as a way to store files securely.

Currently we use Linux for everything. Ubuntu with users' homes encrypted and a truecrypt file for secure storage. I would like to up this to a Debian install that requires a passphrase at the boot loader as the entire partition is encrypted. We use RetroShare for communications as it has security built in, but it is just a temporary measure, and we would like to learn how to set up a secure centralized information server.

More Info:

  • Webserver will be hosted off site through a third party. Has no useful information besides a few email addresses.

  • Laptops are crossing US/Canada border, they will need to be secure from entry without a warrant. The way I am thinking to secure them is:

    • Apricorn Aegis USB Keys (They have a keypad to unlock the drive)
    • Thay will have the laptops boot partition, the keyfile, users PGP, SSH, and any other keys.
  • The server will be Debian based, I have not settled on ANY packages as I have no idea which ones will work with what security packages. The servers location is physically secure so I am only worried about network intrusion. Last intrusion detection system I used was BlackFin or something on Windows in the Blaster32 days.

    • SNORT for intrusion detection
    • GnuPG, SSH
    • Remote file system access:

      1 - Users can either VPN into the system through SSH

      2 - Users can mount via SSHFS just what they need

      3 - Presumably the VPN is a better idea.

  • 2
    Making a system "secure" is impossible without understanding what the system's goals are, and what adversaries it needs to protect against. It seems that you're asking for general advice but also at the same time specific advice regarding your system -- if you want specific advice then you need to provide what I mentioned earlier (long before discussing any specific tools you are using to secure your system currently). – Darius Jahandarie Jul 7 '13 at 1:57
  • The laptops will be crossing the US/Canada border quite a bit so they need to be protected. The email, file server needs network based protection. – uMinded Jul 7 '13 at 4:30
  • Thanks for adding more info! I'm nominating your question for reopening, hope other reviewers will agree. – TildalWave Jul 7 '13 at 17:09
  • Note that RetroShare might have some security issues specialmeaning.blogspot.com/2016/09/… – Sergei Oct 11 '16 at 18:40

First of all check this out. It has great guidelines on hardening Ubuntu machines. My recommendations

  • If possible have your webserver hosted in a different location than the office with no access or communication to the office. If that's not an option make sure it's completely separated from your internal network.
  • For the internal network of course setup a firewall, have AV running on all machines and setup an IDS/IPS. Snort is a popular ids/ips for Linux.
  • Use full disk encryption on the laptops. TrueCrypt can't do full disk encryption on Linux devices, I haven't used it in a couple of yeas so maybe that's changed if truecrypt is your only option at least make sure the users know how to use it properly and don't accidently save a database of SSNs unencrypted.
  • Don't directly allow access to any machine in your internal network. If you want people to work remotely the best option is to make them VPN into the network. If you want to get really secure about it you can setup the VPN with a keyfob or a certificate on an sd card that the user has to physically have.
  • There's so much more you can do but it all depends on the amount of time and money you're willing to put into it.

There is no such thing as a "Fully secured system" if you want to harden a server to the point where it will be near impossible to hack you would have to fill it with cement and drop it in the deepest trench in the pacific ocean and even then I would say it's only about 96.2% secure but it's 100% unusable.

You have to accept the fact that you are vulnerable and you will be attacked. Determine the value of all assets in the organization. Have a baseline security policy for all devices on your network and focus your resources on the mission critical systems.

My 2 cents. Hope this helps

| improve this answer | |
  • 2
    For the laptops I was thinking of using an Apricorn Aegis Secure Key with the laptops boot partition and the keyfile. Then totally encrypt the block device with LUKS. For remote access have them VPN with ssh keys on the usb stick. The webserver for security sake we might as well just hire some webhost. That way a web based attack would be useless. – uMinded Jul 7 '13 at 4:22

Not the answer you're looking for? Browse other questions tagged or ask your own question.