Tod Merley wrote:
On Dec 27, 2007 11:10 AM, Daniel B. Thurman <dant@xxxxxxxxx> wrote:
I have finally got my F8 setup and running so now I am reviewing the
security issues that needs to be taken into account.
I have looked into trying many things to protect and harden my systems,
but I thought I'd ask members what they are doing/using to defend their
systems against attacks and unwanted intrusions? Would it be neat
if there was an automatic non-human defender to do it for you while you
sleep? Dream on.
I would like to focus on securing Fedora. I have tried snort w/Base etc.,
Tripwire, Fam, nmap, Iptable techniques, and so on.
Does anyone have any advice, links to great sites focused on security
and how to secure your linux box against intrusions and attacks?
Thanks!
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.5.516 / Virus Database: 269.17.9/1198 - Release Date: 12/26/2007 5:26 PM
--
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Hi Daniel B. Thurman!
It is late so topics only for tonight:
1. Turn off services you do not use.
2. Make your computer "silent" to all but those who use it - e.g. turn
off ping - e.g. use a door knock protocol on a non-standard port for
ssh to access ssh (give no reply to those who knock on the normal port
and respond to only your special "knock" on your non-standard port),
imv turning off ping is highly overrated, and introduces management
problems.
My technique that I've already posted all-but prevents password scans.
3. Have a constant background scan done for virus, root kit, e-mail,
changes in critical files, port scan, log files (logwatch), and
audits for suspicious activity. This can and should be "niced" to not
interfere with normal operations.
One can't really trust a computer to diagnose itself.
4. Google "pen testing". C/o osstmm.
5. Honeypots!
Really! They may be useful for detecting the ungodly, but they do
nothing to add to one's security. Quite the reverse, you must assume
that the ungodly have a nest in your midst.
6. Backup your "used" areas often and in a number of different ways.
I use flash drives, CDs, and other portions of the local or remote
hard drives. I also tend to put an occasional file in an obscure
e-mail account. Be ready to "wipe and re-load" efficiently. I have
played with the idea of using "ghosted" "snapshots" for this purpose
but have only taken that to the idea level. Tar is becoming a friend.
flash drives are too easy to corrupt. I'm fairly careful with such
things, but one of mine lost its partition table. In my case recovery
was easy because I knew that copying the first sector from an identical
other drive would repair it.
7. Do planned "wipe and re-loads" several times a year. For that
matter, if you simply save your used areas and then wipe and load the
new version of your distro when it comes out that is probably enough.
Be ready to restore to where you were if you need to.
That will cause more grief than it is ever likely to save. If you're
running a serious server, you're off the air for some time. A server
that's down isn't earning you money.
You will need to spend time reconfiguring stuff, and I don't know about
you, but I have better things to do. Probably, the reconfiguring will
result in unintended changes that need to be fixed.
Ok, I lied - the one link I will give you has some very good ones at
the end. Note the crazy quotes and the interesting message box near
the end:
http://en.wikipedia.org/wiki/Computer_security
In Wikipedia, read the warnings, and consider the verifiable expertise
of the author(s).
--
Cheers
John
-- spambait
1aaaaaaa@xxxxxxxxxxxxxxxx Z1aaaaaaa@xxxxxxxxxxxxxxxx
-- Advice
http://webfoot.com/advice/email.top.php
http://www.catb.org/~esr/faqs/smart-questions.html
http://support.microsoft.com/kb/555375
You cannot reply off-list:-)
