4 ms·

Ask HN: Best Server Hardening Guide?

30 points by Kinnard 11y ago

What are the best server hardening guides?

api 11y ago
(1) sudo netstat -tanp | grep LISTEN (2) For anything not listening to 127.0.0.1: what is it and do you need it? (3) If answer to #2 is "dunno" or "no," turn it off. :)
- Kinnard 11y ago
  Nice.
leni536 11y ago
I used this for my iptables settings. https://wiki.archlinux.org/index.php/Simple_stateful_firewall https://wiki.archlinux.org/index.php/Simple_stateful_firewal...
Kinnard 11y ago
Surprised HN doesn't have more advice on this.
VarunAgw 11y ago
Co-incidentally I got this in E-Mail as newsletter https://www.digitalocean.com/community/tutorials/7-security-measures-to-protect-your-servers https://www.digitalocean.com/community/tutorials/7-security-...
tmaly 11y ago
stay away from ufw and stick with iptables. I had some ufw stuff fail on me and I discovered when I logged in that everything was open again.
richardthered 11y ago
Check out : https://benchmarks.cisecurity.org/downloads/multiform/ https://benchmarks.cisecurity.org/downloads/multiform/ They call them 'benchmarks', but they are really just checklists of things to do (disable X, lock down Y, etc.)
e1ven 11y ago
One quick note - You probably shouldn't be performing your server hardening manually on each server. It's easy to miss things. I'd suggest using an ansible/chef/puppet/whatever script, that you customize to meet the needs of your particular application. Some simple ones you could start with are available at http://tinyurl.com/AnsibleFirst5 http://tinyurl.com/AnsibleFirst5 and/or http://hardening.io/ http://hardening.io/ Expand to add additional configuration and hardening for your particular infrastructure.
ch215 11y ago
The Hardened Gentoo project page has a lot of useful information, guides on using Pax, grsecurity and so on... https://wiki.gentoo.org/wiki/Project:Hardened https://wiki.gentoo.org/wiki/Project:Hardened
jlawer 11y ago
Red Hat have a very good guide for RHEL / CentOS: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/pdf/Security_Guide/Red_Hat_Enterprise_Linux-6-Security_Guide-en-US.pdf https://access.redhat.com/documentation/en-US/Red_Hat_Enterp... NSA have also put out some good hardening guides

30 points by Kinnard 11y ago

What are the best server hardening guides?

api 11y ago

(1) sudo netstat -tanp | grep LISTEN (2) For anything not listening to 127.0.0.1: what is it and do you need it? (3) If answer to #2 is "dunno" or "no," turn it off. :)

Kinnard 11y ago
Nice.

leni536 11y ago

I used this for my iptables settings. https://wiki.archlinux.org/index.php/Simple_stateful_firewall https://wiki.archlinux.org/index.php/Simple_stateful_firewal...

Kinnard 11y ago

Surprised HN doesn't have more advice on this.

VarunAgw 11y ago

Co-incidentally I got this in E-Mail as newsletter https://www.digitalocean.com/community/tutorials/7-security-measures-to-protect-your-servers https://www.digitalocean.com/community/tutorials/7-security-...

tmaly 11y ago

stay away from ufw and stick with iptables. I had some ufw stuff fail on me and I discovered when I logged in that everything was open again.

richardthered 11y ago

Check out : https://benchmarks.cisecurity.org/downloads/multiform/ https://benchmarks.cisecurity.org/downloads/multiform/ They call them 'benchmarks', but they are really just checklists of things to do (disable X, lock down Y, etc.)

e1ven 11y ago

One quick note - You probably shouldn't be performing your server hardening manually on each server. It's easy to miss things. I'd suggest using an ansible/chef/puppet/whatever script, that you customize to meet the needs of your particular application. Some simple ones you could start with are available at http://tinyurl.com/AnsibleFirst5 http://tinyurl.com/AnsibleFirst5 and/or http://hardening.io/ http://hardening.io/ Expand to add additional configuration and hardening for your particular infrastructure.

ch215 11y ago

The Hardened Gentoo project page has a lot of useful information, guides on using Pax, grsecurity and so on... https://wiki.gentoo.org/wiki/Project:Hardened https://wiki.gentoo.org/wiki/Project:Hardened

jlawer 11y ago

Red Hat have a very good guide for RHEL / CentOS: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/pdf/Security_Guide/Red_Hat_Enterprise_Linux-6-Security_Guide-en-US.pdf https://access.redhat.com/documentation/en-US/Red_Hat_Enterp... NSA have also put out some good hardening guides