1

What security best-practices would you strongly recommend in maintaining a Linux server?
(i.e. bring up a firewall, disable unnecessary services, beware of suid executables, and so on.)

Also: is there a definitive reference on Selinux?

EDIT: Yes, I'm planning to put the machine on the Internet, with at least openvpn, ssh and apache (at the moment, without dynamic content), and to provide shell access to some people.

8 Answers 8

5

For SELinux I've found SELinux By Example to be really useful. It goes quite in-depth into keeping a sever as secure as possible and is pretty well written for such a wide topic.

In general though:

  • Disable anything you don't need. The wider the attack domain, the more likely you'll have a breach.
  • Use an intrusion detection system (IDS) layer in front of any meaningful servers.
  • Keep servers in a different security zone from your internal network.
  • Deploy updates as fast as possible.
  • Keep up to date on 0-day attacks for your remotely-accessible apps.
4

The short answer is, it depends. It depends on what you're using it for, which in turn influences how much effort you should put into securing the thing.

There are some handy hints in the answers to this question: Securing a linux webserver for public access

If you're not throwing the box up onto the internet, some of those answers won't be relevant. if you're throwing it up onto the internet and hosting something even vaguely interesting on it, those answers are far too laissez-faire for you.

4

There's an NSA document "NSA Security Guide for RHEL5" available at:

http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf

which is pretty helpful and at least systematic.

2
  • Limit the software to the only ones you really use
  • Limit the rights of the users, through sudo, ACLs, kernel capabilities and SELinux/AppArmor/PaX policies
  • Enforce use of hard passwords (no human understandable words, no birthday dates, etc.)
  • Make LXC countainers, chroot or vserver jails for the "dangerous" applications
  • Install some IDS, e.g. Snort for the network traffic and OSSEC for the log analysis
  • Monitor the server
  • Encrypt your sensible datas (truecrypt is a gift of the gods)
  • Patch your kernel with GRSecurity : this add a really nice level of paranoïa

That's more or less what I would do.

Edit : I added some ideas that I previously forgot to name ...

1

1.) Enabling only necessary and relevant ports.

2.) Regular scan of the network data in - out

3.) Regular Scan of ip addresses accessing the server and verify if any unusual data activity associated with those ip address as found from logs/traces

4.) If some some critical and confidential data and code, needs to be present on the server , may be it can be encrypted

-AD

1

Goals: The hardest part is always defining your security goals. Everything else is relatively easy at that point.

Probing/research: Consider the same approach that attackers would take, ie network reconnaissance (namp is pretty helpful for that).

More information: SELinux by example is a helpful book, finding a good centralized source for SELinux information is still hard. I have a small list of helpful links that I find useful time to time http://delicious.com/reverand_13/selinux

Helpful solution/tools: As with what most people will say less is more. For an out of the box stripped down box with SELinux I would suggest clip (http://oss.tresys.com/projects/clip). A friend of mine used it in an academic simulation in which the box was under direct attack from other participants. I recall the story concluded very favorably for said box.

You will want to become familiar with writing SELinux policy. Modular policy can also become helpful. such tools as SLIDE and seedit (have not tried) may help you.

0

Don't use a DNS Server unless you have to . BIND has been a hotspot of security issues and exploits.

1
  • And, if you need a DNS server for a local subnet but do not need to provide external DNS, then both configure BIND to not listen to external ports and firewall block external DNS incoming access.
    – Eddie
    Feb 23, 2009 at 20:56
0

Hardening a Linux server is a vast topic and it primarily depend on your needs.

In general, you need to consider the following groups of concern (I'll give example of best practices in each group):

  1. Boot and Disk
    Ex1: Disable booting from external devices.
    Ex2: Set a password for the GRUB bootloader - Ref.

  2. File system partitioning
    Ex1: Separate user Partitions (/home, /tmp, /var) from OS Partitions.
    Ex2: Setup nosuid on partitions – in order to prevent privilege escalation with the setuid bit.

  3. Kernel
    Ex1: Update security patches.
    Ex2: Read more in here.

  4. Networking
    Ex1: Close unused ports.
    Ex2: Disable IP forwarding.
    Ex3: Disable send packet redirects.

  5. Users / Accounts
    Ex1 : Enforce strong passwords (SHA512).
    Ex2: Set up password aging and expiration.
    Ex3: Restrict Users to Use Old Passwords.

  6. Auditing and logging
    Ex1: Configure auditd - ref.
    Ex2: Configure logging with journald - ref.

  7. Services
    Ex1: Remove unused services like: FTP, DNS, LDAP, SMB, DHCP, NFS, SNMP, etc'.
    EX2: If you're using a web server like Apache or nginx - don't run them as root - read more here.
    Ex3: Secure SSH ref.

  8. Software
    Make sure you remove unused packages.

Read more:

https://www.computerworld.com/article/3144985/linux-hardening-a-15-step-checklist-for-a-secure-linux-server.html

https://www.tecmint.com/linux-server-hardening-security-tips/

https://cisofy.com/checklist/linux-security/

https://www.ucd.ie/t4cms/UCD%20Linux%20Security%20Checklist.pdf

https://www.cyberciti.biz/faq/linux-kernel-etcsysctl-conf-security-hardening/

https://securecompliance.co/linux-server-hardening-checklist/


Now specifically for SELinux:
First of all, make sure that SELinux is enabled in your machine.

Continue with the following guides:
https://www.digitalocean.com/community/tutorials/an-introduction-to-selinux-on-centos-7-part-1-basic-concepts

https://linuxtechlab.com/beginners-guide-to-selinux/

https://www.computernetworkingnotes.com/rhce-study-guide/selinux-explained-with-examples-in-easy-language.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.