10

I attended B-Sides in Orlando FL where one of the speakers had mentioned a site which contains hardened configs for popular services such as apache and postfix. The author of these configs is anonymous and although he doesn't claim to be an expert most would agree his configs are pretty locked down. I want to say it's "clipso" something but I'm not entirely sure.

Does anyone happen to know this source, or another good source which has hardened base configurations. I'd like to use these as a "wide-net" starting point to hardening some servers.

Improve this question
7
  • What conference? Try 'Calypso'
    – schroeder ♦
    May 30, 2014 at 16:04
  • B-Sides in Orlando FL. The guy was giving a talk about SDR (software defined radios) and mentioned it.
    – user47581
    May 30, 2014 at 16:07
  • sort thru videos? bsidesorlando.org/2014
    – schroeder ♦
    May 30, 2014 at 16:08
  • I don't think it wasn't recorded... :(. It doesn't have to be that particular source. Is there another "go-to" source that is pretty popular in the community?
    – user47581
    May 30, 2014 at 16:12
  • 1
    A quick check of the BSides Orlando site showed the speaker was Lee V. Mangold. Google his name, leemangold.com comes up. You can probably ask him directly. The two answers offered so far (CSI and NIST) are right on the money, good references there. Many, many other tools too.
    – 0xSheepdog
    May 30, 2014 at 19:00

3 Answers 3

Reset to default
6

The first repository that comes to my mind for secure baselines is NIST.

You can review the baselines for various software and operating systems, inluding Apache here: http://web.nvd.nist.gov/view/ncp/repository

Improve this answer
6

One option for this would the Center for Internet Security . Their Security Benchmarks cover a relatively wide range of systems and generally have some useful information in there.

Improve this answer
2

There is also the DISA STIG (Security Technical Implementation Guide) website - it has hardening guides for a wide range of technologies, including some of the software you mentioned: http://iase.disa.mil/stigs/a-z.html

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .