7

Are there any proven concepts or "installers" to get up and running based on the best practices securing and locking down a CentOS installation?

I'm hoping for an automated tool that would scan the system, give suggestions, change security settings, install a good network intrusion detection, and have some simple admin panel to check.

Is there such thing or is this just a fantasy?

5 Answers 5

7

I doubt you will find a One-Stop-Shop kind of solution that actually works well. Your best bet will be to review one of the excellent hardening guidelines and implement what makes sense for you.

That being said, you should probably check out two projects

  1. Bastille
  2. Tiger

If you have a little more resources available some vulnerability assessment products can do configuration audits. For instance, ProfessionalFeed subscribers to Nessus have a large number of configuration audits available, including many CIS benchmarks.

All of these will inspect your install and make some recommendations on what to change or tell you how this install deviates from the standard. However, their base rulesets may very well not work for you. You really need to modify their checks to match how you want your environment to look.

4
  • Very Nice I found out about Bastille a while later Tiger haven't heard of that one yet. Are there also some tools like that to have network intrusion detection and firewall setup based on a guidance installer on best practice? Going to look into both options, install fresh centOS 6 today! Thx
    – Rubytastic
    Commented Oct 20, 2011 at 12:18
  • Bastille looks awesome, but hasn't been in active development since about 7 years if I gather the information from their site correctly.
    – user857990
    Commented May 15, 2013 at 10:49
  • @user857990 That sounds about right. Tiger isn't exactly daily releases either but unfortunately we don't really have many choices in this area.
    – Scott Pack
    Commented May 15, 2013 at 11:50
  • CIS also has their own commercial offering called CIS-CAT !
    – atdre
    Commented Dec 16, 2014 at 20:37
2

I think Scott Pack has a great answer. Probably also worth noting that you should at least have some passing familarity with the DISA STIGs here are some specific to RedHat. They will at least give you some idea on wrapping your mind around what you need to do as far as technical controls.

STIGs are mostly impractical to implement everything, but its not a bad starting point molding your own technical policy around.

  • You need to have a process
  • Realize it is going to take some time

Our brightest minds get it wrong all of the time. Alas, such is the way when your adversaries have the distinct advantage they have.

2

There is a new tool by David 'Rel1k' that not only applies to centOS but to all other Linux distros, have a look at Artillery on TrustedSec or Artillery on Github.

Tool name is Artillery! Easy to install and I think might do what you need! It gets constant updates and if you have any questions you can ask on Twitter about it to Dave Kennedy (ReL1K) @HackingDave

1
  • This is a very different way to look at the problem! Kudos to this answer!! Threat intelligence feeds such as ThreatRecon are making the rounds, supported by tools such as CRITs, PizzaCat, and Maltego. Other free options include OpenDNS, PassiveTotal, and totalhash -- with may other demos from the commercial cyber threat intelligence offerings
    – atdre
    Commented Dec 16, 2014 at 22:05
1

Two tools that do the checking/scanning bit, from the view of an attacker (which I find very helpful for hardening):

The second one is fairly new.

1
  • These are wonderful tools and I'm happy to "suggest" that there are Windows equivalents! Google for them!
    – atdre
    Commented Dec 16, 2014 at 20:38
0

Both LSAT and YASAT had active development in 2014. The other suggestions here have been great, you may see me upvote some of them!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .