10

I attended B-Sides in Orlando FL where one of the speakers had mentioned a site which contains hardened configs for popular services such as apache and postfix. The author of these configs is anonymous and although he doesn't claim to be an expert most would agree his configs are pretty locked down. I want to say it's "clipso" something but I'm not entirely sure.

Does anyone happen to know this source, or another good source which has hardened base configurations. I'd like to use these as a "wide-net" starting point to hardening some servers.

  • What conference? Try 'Calypso' – schroeder May 30 '14 at 16:04
  • B-Sides in Orlando FL. The guy was giving a talk about SDR (software defined radios) and mentioned it. – user47581 May 30 '14 at 16:07
  • sort thru videos? bsidesorlando.org/2014 – schroeder May 30 '14 at 16:08
  • I don't think it wasn't recorded... :(. It doesn't have to be that particular source. Is there another "go-to" source that is pretty popular in the community? – user47581 May 30 '14 at 16:12
  • 1
    A quick check of the BSides Orlando site showed the speaker was Lee V. Mangold. Google his name, leemangold.com comes up. You can probably ask him directly. The two answers offered so far (CSI and NIST) are right on the money, good references there. Many, many other tools too. – 0xSheepdog May 30 '14 at 19:00
6

The first repository that comes to my mind for secure baselines is NIST.

You can review the baselines for various software and operating systems, inluding Apache here: http://web.nvd.nist.gov/view/ncp/repository

6

One option for this would the Center for Internet Security . Their Security Benchmarks cover a relatively wide range of systems and generally have some useful information in there.

2

There is also the DISA STIG (Security Technical Implementation Guide) website - it has hardening guides for a wide range of technologies, including some of the software you mentioned: http://iase.disa.mil/stigs/a-z.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.