Sincerly , Gabriel

Google is your friend. I found the above link in less than 30 seconds. We Linux geeks like to be helpful. Most will tell you how to hunt, but most won’t hunt for you, cook for you, and feed you too. :)

Thx to add this :)

Sites with thousands of servers and understaffed admins can’t possibly do all of this, and even on smaller sites with only a few dozen boxes, there needs to be some focus on which of these offer the best bang for the amount of time spent.

You must do these:

#1: Encryption – This is good, but the suggestion to remove xinetd wholesale is generally bad, ideally use chef to only enable xinetd where needed.
#3: One service one box – This is a good goal, much more achievable in the virtualization era. Exceptions can be made, particularly with lightweight internal services.
#6: Password policy – Largely you have to do this, auditors expect it. I share the concerns about rotation leading to sickies on monitors, but I know I won’t win that argument with auditors.
#7: Disable root login – Yes, remote root needs to be disabled to prevent non-reputability, I actually agree here.
#9: Disable services – Very good. Do this. Highly likely that unneeded and unmaintained services lead to actual security compromise.
#10: Disable X11 – Yep, unneeded on servers generally, don’t install. Some software installation requires it, which is annoying and you’ll need to make exceptions for on limited case-by-case basis.
#11: Sysctl hardening – Good and reasonably cheap. Use chef.
#15: Disable unwanted SUIDs and SGIDs – I agree, time well spent, reduces attack surface.
#17: Logging and Auditing – Past some point this just becomes using a loghost with enough disk to retain logs, and the noise level becomes insane. I wouldn’t spend too much time watching all the logs all the time, although its nice if you’ve got a junior admin with enough free time to watch for events. In PCI situations you have to not only watch this, but respond and it becomes mandatory.

You should try to do these, but they’re costly:

#4: Kernel upgrades – This is expensive in time, but worthwhile.
#11: Iptables/TCPwrappers – If #9 is done correctly and you’ve got a good corporate border firewall, this is not necessary and can lead to headaches. This is almost in my “do not bother” list, but if you *dont* have a firewall and you’ve just got servers hanging out in the breeze on EC2 this becomes more necessary.
#16: Centralized Auth – I actually like spending the time to do Kerberos

Do not bother with these, your energy is best spent elsewhere:

#2: Removing/auditing RPMs – This became laughable to me a decade ago, nearly a complete waste of time.
#5: SElinux – Also largely a waste of time, and ongoing maintenance nightmare, most actual intrusions would be prevented by getting easier stuff right
#8: Locking down BIOS and Grub – Servers should be secure in datacenters, physical access means a compromise anyway and grub passwords get in the way of administration
#13: Seperate Partitions for Everything – Oh, FFS, I have a job to do. Complete waste of my time.
#14: Turn off IPv6 – this is laughable and becoming more indefensible now
#19: IDS – Also mostly a source of noise. I suggest using fail2ban to automate iptables blocking in response to attacks, which does something useful (e.g. ssh attacks actually chew up your cpu, and fail2ban gets that back).
#20: Encryption of files – largely a waste of time within the enterprise, other than *very* targetted systems that are high-value targets. Just get your account management right.

Most important completely missed aspect:

USE CHEF, PUPPET OR SOME OTHER CONFIG MANAGEMENT ENGINE TO ENFORCE POLICY

And yes, I wrote that in all CAPS for a reason. That should be policy #0 that comes before all else.

need to know which file we need to edit or how we can set password rules in redhat such as “password should include alphanumeric,special characters,numbers etc.

Thanks
Renjith

Venkat

thanks,

debian apt-get may break system if cannot use /tmp. Tmp may be set noexec, nosuid, etc.
To harden, may need to write pre-process script and post-process scriipt after
apt-get upgrade.

alert: re”: Also, setting the “noexec” flag in fstab
not confirmed and demonstrated and fully tested. sorry.

Linux hostnamm 2.6.39-3.slh.xxx-aptosid-xxx64 #1 SMP PREEMPT Sat Jul xxx 2011 x86_64 GNU/Linux

Great article. Advanced persistent threats and rootkits. Kernel is the last line
of defense.

obviously, strategy involves both HARDENING and SOFTENING. example of softening
is honeypot and other ‘trap doors.’ Basic – set your firefox or google chrome to
send browser message as IE Internet Explorer.

Excellent Article. Intermediate. Highest return on value is getting to known
how to tune the KERNEL. Second highest is learning how to compress data and
‘backup it up’ across the wide spread NET. as well as separate physical devices -
SSD preferred.

I have been trying to implement OpenLDAP server in CentOS5.4 for the past 10 months. But, till i haven’t implemented. I studied and gathered so many books and articles.. even though am not succeeded. So, could you send openldap server configuration article in CentOS5. Then i can follow your help to complete the task..And i need exactly what is ldap ? why for Ldap? where to Implement ldap ?
I have so many doubts are there on ldap scenario. And how can join windows client to linux openldap server ? . If joins, how to do that ? .. So, could you explain detailedly…

with best regards..

thanks,

Ramakrishna – krrish

Thanks