[HN Gopher] Ask HN: What Linux setup/hardening guide do you use?
___________________________________________________________________
Ask HN: What Linux setup/hardening guide do you use?
When setting up a new publicly accessible Linux server, it is
usually necessary to make some changes from the defaults to improve
security. There are many guides which can be followed, some from
presumably reputable sources. However, the details depend quite a
bit on Linux distro, version, and the current date. Considering
Ubuntu (22.02 LTS), what setup and hardening guide do you follow?
And if not using Ubuntu, or using a different version, please
describe what you use and why (and if being so generous, also what
guide you follow). TIA!
Author : z9znz
Score : 37 points
Date : 2022-09-08 16:52 UTC (6 hours ago)
| marginalia_nu wrote:
| Most server-oriented linux distributions come with fairly
| sensible defaults.
|
| Maybe wouldn't set up a pubnix on them without some tweaking, but
| for most use cases the defaults are sane. Maybe disable password
| login on SSH and if you're worried.
|
| Set up a honeypot if you don't believe me.
| tryauuum wrote:
| I do things like disabling ipv6 (to avoid thinking about ipv6
| firewall), setting various sysctl settings (e.g. to make sure
| ipv4 forwarding is disabled), mounting /proc with hidepid option.
| I think this matters on any distro.
|
| There's no perfect guide. You should collect things that make
| sense to you, put them in git and apply to your servers via
| Ansible/SaltStack
| aprdm wrote:
| What does mounting /proc with hidepid option brings us?
| bediger4000 wrote:
| I use Arch, btw. But I run the linux-hardened kernel, doing
| pacman -Syu once a week.
|
| I also run endlessh on TCP port 22, and a fake HTTP server as a
| community service.
| freeqaz wrote:
| I was running this on my laptop for a while but it doesn't
| support hibernation which sucks :(
| bediger4000 wrote:
| Try linux-zen. I run it on Dell laptops, and it seems to
| support hibernation. Unless I'm not calling it the right
| thing.
| casual-dev wrote:
| Im curious: Why are you running a fake HTTP server? To slow
| down bots for a while or does it serve a higher purpose?
| forgotpwd16 wrote:
| Why aren't linux-hardened's options the default and patches, if
| any, upstreamed?
| badrabbit wrote:
| I like to live life dangerously, I use defaults.
|
| Seriously though: Lynis when setting things up and then for work
| CIS.
|
| But, that's just checking boxes. I do use apparmor to lockdown my
| browser and VMM but that's as far as I go and I have accepted
| that security on Linux is a dangerous illusion because there will
| always that one man page, that one setting everyone appsrently
| knows, that one permission you are expected to know by
| implication of having an understanding of some Linux subsystem
| where that is really all anyone targeting you needs to get in or
| move laterally. Logging more than you should and forwarding
| centrally (auditd and security logs) seems about all you can do
| (detection focused not prevention) that said, checking boxes is
| much better than defaults. Security is a reponsibility left to
| the user/admin by default and to be fair, Linux is hardlh alone
| in that regard,it just so happens to change a lot making it
| harder to keep up.
| z9znz wrote:
| In the past I was following a guide which I probably got from a
| Digital Ocean blog post (they have a lot of very good
| instructive guides).
|
| It eliminated password ssh logins (cert only), and I think it
| changed the default port (which I do always, just to cut out
| the lowest quality script kiddies).
|
| As I recall, it also changed some permissions on shared memory
| via fstab. And it did something regarding sudo or suid... I
| forget now.
|
| I also setup ufw firewall so at least I only allow incoming
| request to the specific services I intend to offer.
|
| All that said, my nginx logs would be full of sh*t from
| wordpress-related vulnerability scanners and whatnot, and it
| just personally offended me. I think I did try to setup
| fail2ban, but I don't recall the success of that.
|
| At this point it seems like there should be a "wizard" (not so
| unlike a linux console installation process) which asks you
| questions and adjusts configuration accordingly.
| egberts1 wrote:
| It depends
|
| Do you want which of the two?
|
| * performance
|
| * security
|
| * older hardware
| Magellanic wrote:
| I like to self-host and wrote a guide on the things I do to
| protect my servers [0], basically, hardening SSH, enabling
| automatic security updates, configuring Failban and installing a
| firewall.
|
| [0] https://www.fuzzygrim.com/posts/secure-vps
| s_ting765 wrote:
| Hardening against vulnerabilities is a zero sum game ultimately.
|
| It is my experience that most guides you will find for Linux
| hardening are either outdated, too opinionated or are written
| with shock value to induce paranoia [0].
|
| I harden ssh (no root login, no passwords), setup fail2ban for it
| and leave it at that.
|
| Only thing I remember to do is not to mess with security
| configurations e.g disabling selinux to make something work.
| Keeping number of software installed to an absolute minimum. And
| last but not least I setup automatic updates via unattended-
| upgrades.
|
| [0] https://madaidans-insecurities.github.io/guides/linux-
| harden...
| zepearl wrote:
| > _I harden ssh (no root login, no passwords), setup fail2ban
| for it and leave it at that._
|
| Similar here (but I allow root login), with the addition of
| setting up an nftables firewall with whitelisted ports and
| logging all the rest, and having fail2ban analyze logs and
| adding/removing to it IPs that become blacklisted because of
| some global limit is exceeded (which happens e.g. if you try
| once to access weird stuff stuff in my webserver VM + try to
| guess a pwd in the mailserver VM + try to login unsuccessfully
| into SSHd)
| marginalia_nu wrote:
| > It is my experience that most guides you will find for Linux
| hardening are either outdated, too opinionated or are written
| with shock value to induce paranoia [0].
|
| A lot of it may be written for career benefits as well. If
| you're trying to sell security services, especially if you
| don't really have too many actual referrals to show, putting
| together a guide or two like this (by borrowing tips you find
| online) makes you not only appear more legit, but it appears
| like you know byzantine security secrets that nobody else does.
| dimensionc132 wrote:
| Most guides only deal with Systemd distros, not distros like
| Devuan etc
| cypherg wrote:
| Use a trusted distro like Ubuntu LTS. Install security updates
| automatically.
|
| Be aware and focus specifically on which ports/services are
| available from the internet.
|
| If you absolutely need SSH, ensure you use something like
| fail2ban and use complex credentials. If possible, use obscurity
| to change from the default port of 22.
|
| If you're running an internet-facing service, like nginx, ensure
| that it's always up to date.
|
| Using SELinux and AppArmour and GRSecurity are usually way
| overkill and cumbersome to manage.
| GOATS- wrote:
| Fail2ban serves no purpose other than bloating your firewall's
| denylist. You can mitigate most blind bruteforce attacks by
| just changing the port number of your SSH server and by using a
| public/private key pair instead of passwords.
| doubled112 wrote:
| While this obscurity doesn't add much security, sure does
| clean up the logs, doesn't it?
| [deleted]
| dimensionc132 wrote:
| https://www.timesys.com/security/securing-your-linux-configu...
|
| You can also do it the easy way, instead of installing Ubuntu,
| which is based on Debian, install and Arch spin such as Arco
| Linux https://arcolinux.com/ and during the installation choose
| the 'hardened kernel' option instead of the default or zen
| kernel.
| hagg3n wrote:
| I've been hosting small and mid-sized web sites and applications
| for years without a hitch using my own script, written from
| reading it up online. It might not work exactly as is for you but
| perhaps can offer some reference:
| https://github.com/corenzan/provision
| norenh wrote:
| My personal preference is to begin with STIG from DoD Cyber
| Exchange: https://public.cyber.mil/stigs/downloads/
|
| They take a while to come for the latest version of a OS and none
| is out for Ubuntu later than 20.04 yet, but it is a very good
| starting point for a checklist even if you do not run a DoD
| system (a lot of the points might be specific for these but
| easily skipped) and depending on changes between versions, some
| parts might still apply. For a recently released OS you usually
| have to rely on the system documentation from the system creator
| (Canonical in this case) but most of my experience is from the
| Red Hat world so not sure how good it is for other distros.
|
| If you start with the best practices for your OS/distro and then
| dig into a hardening guide (like STIG) you should probably have a
| pretty good understanding and base documentation for your
| specific use-case. As always, if you use a specific
| service/software on top of that (a web-server, mail-server, etc)
| you will need to dig into the documentation of that specific
| product and after that check for hardening guides.
|
| The general principle of removing/disabling/blocking everything
| that you do not use is usually a good one. Knowing what you
| actually use and the exceptions is what makes it hard :-)
| fbhabbed wrote:
| I am surprised noone mentioend the Arch Security
| (https://wiki.archlinux.org/title/security) page yet.
|
| It applies to basically every distribution and has useful links
| at the bottom for even more tips.
| type0 wrote:
| SELinux, Rocky is good for servers (successor to CentOS)
| closeparen wrote:
| Is setting up a server by hand and following a checklist even the
| right frame for this question? I would imagine the orgs that are
| sophisticated about this have images, Puppet/Chef modules, etc.
| Might not even permit any manual tweaking.
| viraptor wrote:
| Most is the guides online have the issue of being too specific to
| what the author cares about or just a dump of random "I thought
| it would be good" ideas. I wouldn't follow any specific ones
| really.
|
| Instead, if you'd like to improve your security, I'd recommend 3
| things:
|
| - Learn basics of threat modelling. There are many posts about
| it, but in short it's asking: who can do what and what are the
| options to prevent that.
|
| - Learn what's running in your system. What services you're
| running, what apps. What untrusted data hits any software.
|
| - Go to the higher quality sources for what you actually care
| about. For example, you find out you're running samba - read the
| security sections of their docs
| https://www.samba.org/samba/docs/using_samba/ch09.html and system
| administration guides. Read about firewall configuration for your
| system.
___________________________________________________________________
(page generated 2022-09-08 23:02 UTC)