When it comes to having a Linux server hosted in a data center or it is not behind any kind of Firewall or NAT device there are a number of security requirements that need to be addressed. Linux servers generally come with no protection configured by default and depending on the hosting company or distro can come preconfigured with many services installed that are not required, including Web Servers, FTP Servers, Mail Servers and SSH Remote Access.<\/p>\n
The following is a compilation of various settings and techniques you can employ to harden the security of your vulnerable Linux systems. While I have tried to put them in order of the most important features first I would recommend all of these options be used on your critical production servers.<\/p>\n
Always create long passwords that contain upper and lower case letters, numbers and non alpha-numeric characters. Enforce password ageing so users need to change their passwords regularly. Lock user accounts after a certain number of failed login attempts.<\/p>\n
Make use of Public\/Private SSH keys for login of remote users instead of passwords, this provides the benefit of turning off password authentication in SSH so that your server can\u2019t be Brute-Force cracked. However this does introduce a new problem whereby a malicious person could compromise a user\u2019s computer or steal their laptop and then have access to the server. This can be overcome by using a password on the client certificate which must be entered before connecting, a kind of two factor authentication.<\/p>\n
Disable the Root user from being able to login either via the console or remote SSH connections. Instead have users use Sudo to run programs that require root privileges, or use sudo su to change to the Root user once logged in. This provides an audit path to show which user installed a piece of software or ran a program.<\/p>\n
Always use the encrypted equivalent protocol when transferring critical and sensitive data such as passwords and confidential material. Remove RSH and always use SSH for remote access. Instead of using FTP for file transfer, consider using SFTP or FTP\/S (FTP over SSL) or RSYNC. Instead of having remote access open to the internet i.e. SSH or VNC setup an OpenVPN SSL VPN Server to connect to first.<\/p>\n
Consider implementing either a LDAP or Kerebos server to perform password authentication. This allows for a central database to maintain user\u2019s passwords between multiple servers for easy management. This prevents user account and password data from becoming inconsistent and out of date, and prevents user accounts that should have been deleted on all servers being left behind on one server.<\/p>\n
Implementing a secure IPTABLES firewall will limit your exposure to network threats such as DOS and Port Scanning attacks. You can lock down any ports that don\u2019t require access from external networks. For instance you can use the following command to only allow SSH access to the server from the local network.<\/p>\n
You can install a TCP Wrapper named libwrap which will give information like who connected, when and from where and even which services they connected to. It can also be used for locking down access to ports and services for certain hosts or IP\u2019s.<\/p>\n Consider installing both a Network IDS (NIDS) and a Host Based IDS (HIDS). NIDS\u2019s are used to protect against malicious threats such as DOS and Port Scan Attacks. HIDS\u2019s such as AIDE are used to monitor file system changes such as an intruder replacing core system files like ls or ps with malicious ones that hide their Trojan from file or process lists. It will produce a report that tells you what files have been modified so you can repair or replace them.<\/p>\n Disable Shell access to users that don\u2019t need it (ftp, mail users etc) by changing to \/bin\/noshell in the \/etc\/passwd file. Setup a group for standard users and remove permissions to tools that can be used to download malicious software like wget, lynx, ftp etc. Consider chrooting users to their home directories to stop them from modifying critical system files.<\/p>\n Only install software that is actually needed, some systems come preconfigured with many software packages that you may never need or use. When installing always choose the Minimal Installation or Manual Installation option if they exist. Then simply install the software that you actually need.<\/p>\n Always try to keep your software packages up to date, such as ensuring the latest version of Apache, MySQL and PHP on a standard LAMP setup will protect you against any vulnerabilities that have been discovered in previous versions.<\/p>\n Your servers will most likely have many background services (Daemons) running which are not required and some may be configured to run on start-up. The following command (Red Hat, Cent OS only) can be used to show all services that will start on boot.<\/p>\n Or just use the following command to view services which are turned on only for Run Level 3.<\/p>\n You would then use a command like this to remove the service from start-up.<\/p>\n Consider completely removing X Windows from the system and just using the command line for management. There isn\u2019t anything that you can do in the GUI that you can\u2019t do using the command line and removing it will not only enhance security but also performance because no system resources are wasted displaying the GUI.<\/p>\n You can secure your Linux Kernel by modifying the \/etc\/sysctl.conf file, this file is read by the Kernel at boot time and can be edited with the following settings to add extra security.<\/p>\n You should have a written security policy for handling Linux Kernel Patches, which should include which Linux security notices have been received, which updates have been tested to ensure problems don\u2019t arise and which patches have been installed on the system. Always ensure Production servers are updated regularly to avoid any potential known vulnerability from being exploited on your system.<\/p>\n You should create separate partitions for user modifiable directories and block write and execute access to unneeded partitions. You should consider placing the following file systems on different partitions. Make use of software like SELinux, AppArmor or GRSecurity to provide additional hardening to your Linux Kernel. These products provide additional policies to restrict processes and services based on Access Control Lists.<\/p>\n Consider setting up different physical or virtual servers for different roles, i.e. separate your Mail server and your Webserver, or your Database server and your Application server. This ensures that if one particular service is compromised it is contained to just one server.<\/p>\n You can secure your server as much as possible from remote attacks, but if you don\u2019t do anything to protect the physical hardware it is pointless. If someone has access to your physical server they can remove your hard drive and read your confidential data or boot from a CD and access your data. Consider creating a BIOS password and disabling booting from CD or USB. Also you should password protect your boot loader (GRUB, LILO, etc) to prevent users from accessing Single User Mode or Recovery Environments where passwords are not required.<\/p>\n Having an accurate system clock is important for reviewing log files and determining when an event occurred. Often system clocks can become out of sync or be reset to an older date and this can cause havoc with tracking of errors. Consider creating a Cron job rather than running ntpd (See Tip #12) to update the time daily or hourly with a common source for all servers.<\/p>\n Setup logging and auditing software to track errors and changes to your servers, such as Auditd and Logwatch\/Logcheck. Consider configuring a remote logging server that is updated regularly to protect against an intruder compromising your log files without your knowledge.<\/p>\n IPv6 is very rarely needed at this stage as most traffic only utilizes IPv4 and having IPV6 enabled is just another network you need to monitor and protect. Disabling IPv6 is the easiest option but if for some reason you do require it then you should configure an IPv6 Firewall.<\/p>\n After you have setup and configured your system and software you should run the following commands to search for all file and folders with either the SUID, SGID bit set or world writeable folders. To find all SGID files:<\/p>\n To find all World Writeable Dirs:<\/p>\n You should then inspect each file and folder to determine if they have the correct settings and if not use the chmod command to make changes to them.<\/p>\n Your data is usually stored on a hard drive in an unencrypted format so any user that has access to the server can remove the hard drive and install it in another system and read all your data. You should consider configuring Linux disk or folder encryption on either your home directories or your sensitive folders (i.e. Database Files, Emails, etc). While you could encrypt your entire drive this is a lot of work and may not be worth the hassle.<\/p>\n It is great to have a highly secure Linux server but your system is only secure as the software you run on it. You should always install the latest versions of software and ensure they stay up to date. Also most programs have ways to make them more secure by editing their configuration files and disabling unnecessary parts of the software. The following is an example for hardening your OpenSSH Server settings, simply add the following \u00a0to your OpenSSH config file.<\/p>\n When it comes to having a Linux server hosted in a data center or it is not behind any kind of Firewall or NAT device there are a number of security requirements that need to be addressed. Linux servers generally come with no protection configured by default and depending on the hosting company or distro […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"_links":{"self":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/1705"}],"collection":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1705"}],"version-history":[{"count":1,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/1705\/revisions"}],"predecessor-version":[{"id":1707,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/1705\/revisions\/1707"}],"wp:attachment":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1705"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1705"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1705"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}# iptables \u2013A INPUT \u2013s 192.168.0.0\/24 \u2013p tcp \u2013dport 22 \u2013j ACCEPT<\/code><\/p>\nTIP #8 \u2013 Use Intrusion Detection Systems<\/h3>\n
TIP #9 \u2013 Users Assigned Least Privileges<\/h3>\n
TIP #10 \u2013 Minimize Software<\/h3>\n
TIP #11 \u2013 Keep Software Updated<\/h3>\n
TIP #12 \u2013 Disable Unwanted Services<\/h3>\n
# chkconfig --list | grep : on<\/code><\/p>\n# chkconfig --list | grep 3:on<\/code><\/p>\n# chkconfig --del \u2018service-name\u2019<\/code><\/p>\nTIP #13 \u2013 Remove X Windows<\/h3>\n
TIP #14 \u2013 Secure Linux Kernel<\/h3>\n
# Turn on execshield
kernel.exec-shield = 1
kernel.randomize_va_space = 1
# Don't reply to broadcasts. Prevents joining a smurf attack
net.ipv4.icmp_echo_ignore_broadcasts = 1
# Enable protection for bad icmp error messages
net.ipv4.icmp_ignore_bogus_error_responses = 1
# Enable syncookies for SYN flood attack protection
net.ipv4.tcp_syncookies = 1
# Enable IP spoofing protection
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
# Log spoofed, source routed, and redirect packets
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
# Don't allow source routed packets
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
# Don't allow outsiders to alter the routing tables
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
# Don't pass traffic between networks or act as a router
net.ipv4.ip_forward = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0<\/code><\/p>\nTIP #15 \u2013 Install Linux Kernel Patches<\/h3>\n
TIP #16 \u2013 Separate Partitions<\/h3>\n
\/usr
\/home
\/var and \/var\/tmp
\/tmp<\/code>
Then you can edit the \/etc\/fstab file to prevent execution of binary files, disable block devices on the partition and prevent the SUID\/SGID from being set on files. Here is a common fstab file entry to limit user access to the ftpdata directory.<\/p>\n\/dev\/sda5 \u00a0\/ftpdata \u00a0ext3 \u00a0\u00a0\u00a0defaults,noexec,nodev,nosuid 1 2
<\/code><\/p>\nTIP #17 \u2013 Use Linux Security Extensions<\/h3>\n
TIP #18 \u2013 Separate Servers for Services<\/h3>\n
TIP #19 \u2013 Physical Server Security<\/h3>\n
TIP #20 \u2013 Setup NTP<\/h3>\n
TIP #21 \u2013 Monitor All Logs<\/h3>\n
TIP #22 \u2013 Disable IPv6<\/h3>\n
TIP #23 \u2013 Remove SUID and SGID from Files<\/h3>\n
To find all SUID files:<\/p>\n# find \/ -xdev -type f -perm +u=s \u2013print<\/code><\/p>\n# find \/ -xdev -type f -perm +g=s -print<\/code><\/p>\n# find \/ -xdev -perm +o=w ! \\( -type d -perm +o=t \\) ! -type l -print<\/code><\/p>\nTIP #24 \u2013 Encrypt Confidential Data<\/h3>\n
TIP #25 \u2013 Harden Your Software<\/h3>\n
# Use only SSH Protocol Ver 2
Protocol 2
# Only allow the following users SSH Access
AllowUsers User1 User2 etc
# Deny access to the following users
DenyUsers admin etc
# Set the timeout period for idle sessions (in seconds)
ClientAliveInterval 300
ClientAliveCountMax 0
# Disable .rhosts files
IgnoreRhosts yes
# Disable Host-Based Authentication
HostbasedAuthentication no
# Remove ability to login as Root
PermitRootLogin no
# Change the default SSH Port (Not essential but can help uncomment if you want)
#Port 22
#ListenAddress 192.168.1.1
# Consider CHRooting users to their own directories.
# Subsystem sftp internal-sftp
#Match group sftponly
# \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0ChrootDirectory \/home\/%u
# \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0X11Forwarding no
# \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0AllowTcpForwarding no
# \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0ForceCommand internal-sftp
# Disable empty passwords from login
PermitEmptyPasswords no
# Set your required Log Level (Either INFO or DEBUG)
LogLevel INFO
# \u00a0Turn on privilege separation
UsePrivilegeSeparation yes
# Prevent the use of insecure home directory and key file permissions
StrictModes yes
# Turn on \u00a0reverse name checking
VerifyReverseMapping yes
# Do you need port forwarding?
AllowTcpForwarding no
X11Forwarding no
# \u00a0Specifies whether password authentication is allowed. \u00a0The default is yes.
PasswordAuthentication no<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"