Dedicated Function Server Hardening
|
|
Server Hardening
|
|
| DNS Servers |
|
| LogHost Servers |
- Use a more secure linux distro
- No user accounts
- Mirror log files to a secure loghost
|
| FireWalls |
- Use a more secure linux distro
linux-2.0.x - ipfwadm
linux-2.2.x - ipchains
linux-2.4.x - ipfilter/netfilter
- Firewall
Configuration, Howto, Examples, etc
|
| Mail Servers |
|
| Web Servers |
- If you receive credit card info and other confidential info at your secure webserver
Do NOT, do NOT send those confidential date back to the user via email
- WebServer Load Testing
- while ( 1 ) do
date
cd /tmp/http_load_test ; lynx -dump http://www.Target.com
done
-- or --
- for (x=0; x<15; x++)
do
date
wget -r -l0 -O /dev/null -q http://www.Target.com
done
- Load Testing
httpperf
http_load
ezhttpbench.php
- Secure WebServer
- Commercial Secure WebServer
- No user login accounts
- Apache.org
Security Tips
- Apache.org
FAQ
- Web contents should be updated automatically by a script from the staging server
- Download and Install the latest apache
- Download and Install the latest security patches
- Configure RobotsTxt.org
- Install CGI Scan Detector
- Install Whisker CGI scanner
- Use a script to transfer tested website changes from the staging webserver to the real website
- Hogwash
Trechaery.net EarlyBird - handling of *.exe
- http_filter, mod-proxy
|
| FTP Servers |
- LinuxMafia.com
List of FTP daemons
Cert.org Anonymous FTP Considerations
- cr.yp.to
FAQS.org FTP Security Considerations
FreeFire.org FTP Tutorial
SlackSite.com Active vs Passive FTP
WBGlinks.net Secure Linux RedHat 7 FTP Anonymous Upload Server
CCP14.ac.uk Secure FTP w/ Tunnelling
- Turn off real user logins
- Use scp allowing users to transfer files
- Disallow anonymous uploading of files
- If you do allow anonymous uploading of files, make it non-executable
- For real user ( not anonymous/guest ) to transfer files between machines:
- Use sftp or scp ( from SSH packages )
- FTP Checking script
|
| NIS/YP and Authentication Servers |
- Build/create at least 2 or 3 secondary YP servers on each LAN
|
| PPP Servers |
- Disallow users from coming into your LAN if the ppp server is outside your firewall
- You should have the PPP server inside your firewall on it's own private PPP Lan
- Use VPN or ssh to a local secure gateway ( 2-NICs ) before getting into the main corp lan
|
| Virtual Hosting Servers |
- Virtual Hosting -- do we wanna start this stuff ??? hummm...
|