4 ms·

Not a fan of this guide: No explanations, no context and worse: missing critical stuff for your typical hosted $webapp server usecase: run services as normal u

by nisa 8y ago

Not a fan of this guide: No explanations, no context and worse: missing critical stuff for your typical hosted $webapp server usecase: run services as normal user and confine them using apparmor (or selinux if you are masochichst) the NSA will probably hack you anyway, that drive by script-kiddie that kills your company JIRA instance by DDoSing some gameserver while exploiting some old Wordpress plugin can be stopped by apparmor! What's missing is some kind of kernel live patching - if someone is not a script-kiddie on your machine that Wordpress shell is a nice tool to elevate to root - your kernel is rotting and exploits are plenty... so consider some kind of live-patching if your are paranoid. Also no discussion about updates, the need to restart services for reloading updated .so files (like openssl)... You can obey that guide and be busy with life and some skiddy root exploits your box anyway... so /rant - there must be some better guides? found those cis benchmarks (https://www.cisecurity.org https://www.cisecurity.org) a mixed bag - is there anything better out there?

abrookewood 8y ago
I think the CIS benchmarks are a good option, but they are very detailed. They do provide pre-rolled images though, which may be a quick solution.
- stewartm 8y ago
  I have recently completed a project applying CIS to a clients estate. Whilst CIS is great, particularly if you are a large Org having to deal with auditors and the like, it can only be regarded as the bare minimum.
viraptor 8y ago
> missing critical stuff for your typical hosted $webapp server usecase: It looks like work in progress. Selinux, updates, deployment and many other topics are on the table of contents, but not present in the document. (Yet?) It's got some context which is better than almost any other guide. Ideally they'd include some threat models applicable to each point, but that could come in the future (also you can send prs)
windowsworkstoo 8y ago
CIS and the various NSA STIGs are about the best actual prescriptive guides. But threats occcur on a continuum - at a point (which is focused organised crime/nation state actors) you will lose...but there is still a lot of low hanging fruit you can win on.
StreamBright 8y ago
I second that, encrypted /boot? Who is the adversary this is protecting you against? Many of these things looks like snake oil to me.
- tinco 8y ago
  Encrypted boot really bit me in the ass one time, that's one afternoon spent in the dust underneath the stairs in my student housing that I won't get back. Would've been so much easier to repair that machine if the boot partition wasn't so weird.
ryanlol 8y ago
Yeah, getting strong 90s vibes from this doc, perhaps because most hardening manuals like this are just collections of advice from other (bad and old) hardening manuals.
- DCKing 8y ago
  That's exactly it. Lists like this exist to give administrators and their managers (1) a false sense of security when implementing it and (2) a subconscious excuse not to actually have to think about what you actually have to defend against. The list of topics is almost entirely useless if you are running any sort of containers on top of your Linux install, just as one example. I'm sorry to be sounding so harsh, but I sincerely detest the security-by-checklist approach. It barely protects against any real-world threats, needlessly complicates matters, and gives credence to the perception that "security slow things down" through over-engineered solutions to non-existing problems. Moreover, it's a subconscious excuse to actually stop thinking about one's actual risks. Reasoning about actual threat models may not be easy but it is what one should be doing. There's nothing "practical" about this at all, in my view.
  - kbenson 8y ago
    > I'm sorry to be sounding so harsh, but I sincerely detest the security-by-checklist approach. Checklists are essential (or becoming so) in all professions that require a level of safety or assurance in their operations. They don't replace careful though and action, but they do supplement it be making sure there's a minimum level of items that were checked and not omitted because someone thought they didn't apply when then did, or someone just plain forgot. A checklist is a good way to start some rational thinking about what's required for your specific case (especially if it's so restrictive that you have to (and are expected to) selectively alter portions of the checklist just so your current use case functions. Checklists are well known and save lives in some professions (such as aviation), and are being applied to others even when there's push-back (Surgeons and emergency room operations[1]) because the benefits are just so large. I think it's fair to dislike how people and organizations adopt a checklist in lieu of careful thought about security, and to dislike poorly defined and reasoned checklists themselves, but I for one would be much happier, and feel much safer, if security checklists were much more common overall. 1: https://www.who.int/bulletin/volumes/86/7/08-010708/en/ https://www.who.int/bulletin/volumes/86/7/08-010708/en/
tarabanga 8y ago
Why not submit tickets or PRs? It looks like it's still actively maintained https://github.com/trimstray/the-practical-linux-hardening-guide/graphs/commit-activity https://github.com/trimstray/the-practical-linux-hardening-g...
ozim 8y ago
Nah it looks like author just made table of contents and counts that there will be bunch of suckers that will collaborate on his repo by submitting pull requests. Really, fire protection and locking racks with configuration of Nginx and Apache in same guide? If I am going to harden Apache, I am going to find Apache only guide.

by nisa 8y ago

abrookewood 8y ago

I think the CIS benchmarks are a good option, but they are very detailed. They do provide pre-rolled images though, which may be a quick solution.

stewartm 8y ago
I have recently completed a project applying CIS to a clients estate. Whilst CIS is great, particularly if you are a large Org having to deal with auditors and the like, it can only be regarded as the bare minimum.

viraptor 8y ago

> missing critical stuff for your typical hosted $webapp server usecase: It looks like work in progress. Selinux, updates, deployment and many other topics are on the table of contents, but not present in the document. (Yet?) It's got some context which is better than almost any other guide. Ideally they'd include some threat models applicable to each point, but that could come in the future (also you can send prs)

windowsworkstoo 8y ago

CIS and the various NSA STIGs are about the best actual prescriptive guides. But threats occcur on a continuum - at a point (which is focused organised crime/nation state actors) you will lose...but there is still a lot of low hanging fruit you can win on.

StreamBright 8y ago

I second that, encrypted /boot? Who is the adversary this is protecting you against? Many of these things looks like snake oil to me.

tinco 8y ago
Encrypted boot really bit me in the ass one time, that's one afternoon spent in the dust underneath the stairs in my student housing that I won't get back. Would've been so much easier to repair that machine if the boot partition wasn't so weird.

ryanlol 8y ago

Yeah, getting strong 90s vibes from this doc, perhaps because most hardening manuals like this are just collections of advice from other (bad and old) hardening manuals.

DCKing 8y ago
That's exactly it. Lists like this exist to give administrators and their managers (1) a false sense of security when implementing it and (2) a subconscious excuse not to actually have to think about what you actually have to defend against. The list of topics is almost entirely useless if you are running any sort of containers on top of your Linux install, just as one example. I'm sorry to be sounding so harsh, but I sincerely detest the security-by-checklist approach. It barely protects against any real-world threats, needlessly complicates matters, and gives credence to the perception that "security slow things down" through over-engineered solutions to non-existing problems. Moreover, it's a subconscious excuse to actually stop thinking about one's actual risks. Reasoning about actual threat models may not be easy but it is what one should be doing. There's nothing "practical" about this at all, in my view.
- kbenson 8y ago
  > I'm sorry to be sounding so harsh, but I sincerely detest the security-by-checklist approach. Checklists are essential (or becoming so) in all professions that require a level of safety or assurance in their operations. They don't replace careful though and action, but they do supplement it be making sure there's a minimum level of items that were checked and not omitted because someone thought they didn't apply when then did, or someone just plain forgot. A checklist is a good way to start some rational thinking about what's required for your specific case (especially if it's so restrictive that you have to (and are expected to) selectively alter portions of the checklist just so your current use case functions. Checklists are well known and save lives in some professions (such as aviation), and are being applied to others even when there's push-back (Surgeons and emergency room operations[1]) because the benefits are just so large. I think it's fair to dislike how people and organizations adopt a checklist in lieu of careful thought about security, and to dislike poorly defined and reasoned checklists themselves, but I for one would be much happier, and feel much safer, if security checklists were much more common overall. 1: https://www.who.int/bulletin/volumes/86/7/08-010708/en/ https://www.who.int/bulletin/volumes/86/7/08-010708/en/

tarabanga 8y ago

Why not submit tickets or PRs? It looks like it's still actively maintained https://github.com/trimstray/the-practical-linux-hardening-guide/graphs/commit-activity https://github.com/trimstray/the-practical-linux-hardening-g...

ozim 8y ago

Nah it looks like author just made table of contents and counts that there will be bunch of suckers that will collaborate on his repo by submitting pull requests. Really, fire protection and locking racks with configuration of Nginx and Apache in same guide? If I am going to harden Apache, I am going to find Apache only guide.