2 ms·

I like to live life dangerously, I use defaults. Seriously though: Lynis when setting things up and then for work CIS. But, that's just checking boxes. I do u

by _8j50 4y ago

I like to live life dangerously, I use defaults. Seriously though: Lynis when setting things up and then for work CIS. But, that's just checking boxes. I do use apparmor to lockdown my browser and VMM but that's as far as I go and I have accepted that security on Linux is a dangerous illusion because there will always that one man page, that one setting everyone appsrently knows, that one permission you are expected to know by implication of having an understanding of some Linux subsystem where that is really all anyone targeting you needs to get in or move laterally. Logging more than you should and forwarding centrally (auditd and security logs) seems about all you can do (detection focused not prevention) that said, checking boxes is much better than defaults. Security is a reponsibility left to the user/admin by default and to be fair, Linux is hardlh alone in that regard,it just so happens to change a lot making it harder to keep up.

z9znz 4y ago
In the past I was following a guide which I probably got from a Digital Ocean blog post (they have a lot of very good instructive guides). It eliminated password ssh logins (cert only), and I think it changed the default port (which I do always, just to cut out the lowest quality script kiddies). As I recall, it also changed some permissions on shared memory via fstab. And it did something regarding sudo or suid... I forget now. I also setup ufw firewall so at least I only allow incoming request to the specific services I intend to offer. All that said, my nginx logs would be full of sh*t from wordpress-related vulnerability scanners and whatnot, and it just personally offended me. I think I did try to setup fail2ban, but I don't recall the success of that. At this point it seems like there should be a "wizard" (not so unlike a linux console installation process) which asks you questions and adjusts configuration accordingly.
- _8j50 4y ago
  Or all that stuff would be the default and the setup process of whatever you are doing would loosen restrictions. If you have pubke only for ssh, no need to log password attempts.

by _8j50 4y ago

z9znz 4y ago

In the past I was following a guide which I probably got from a Digital Ocean blog post (they have a lot of very good instructive guides). It eliminated password ssh logins (cert only), and I think it changed the default port (which I do always, just to cut out the lowest quality script kiddies). As I recall, it also changed some permissions on shared memory via fstab. And it did something regarding sudo or suid... I forget now. I also setup ufw firewall so at least I only allow incoming request to the specific services I intend to offer. All that said, my nginx logs would be full of sh*t from wordpress-related vulnerability scanners and whatnot, and it just personally offended me. I think I did try to setup fail2ban, but I don't recall the success of that. At this point it seems like there should be a "wizard" (not so unlike a linux console installation process) which asks you questions and adjusts configuration accordingly.

_8j50 4y ago
Or all that stuff would be the default and the setup process of whatever you are doing would loosen restrictions. If you have pubke only for ssh, no need to log password attempts.