5 ms·

Automatic server hardening framework

120 points by dewey 12y ago

codezero 12y ago
The audio on the demo video is really choppy, is that just me?
- dewey 12y ago
  The same is happening for me, didn't notice it when I watched it before I posted it though. Maybe Vimeo is having problems.
  - markcampbell 12y ago
    It's not vimeo. Downloading the video and playing it locally with VLC yields the same problems.
allendoerfer 12y ago
Seems like a nice and comfortable way to set sane defaults for nginx, Apache, MySQL, PostgreSQL and some Unix stuff - but they really should have been set by each software in the first place. I like, the private touch the screencast and the developer-designed website gives the project, even if part of a big company. This actually raises its credibility.
- ams6110 12y ago
  they really should have been set by each software Yes, and it seems to me that distros (at least those intended for "enterprise") should be hardened by default also. If I install RHEL or OEL and then have to run a Chef or Puppet config to "harden" it, something is wrong.
  - jlawer 12y ago
    Well, thats been tried and rejected by the user base. If you harden too much it becomes a real PITA to do anything productive (SELinux running in strict mode). RHEL aims to be secure, while also remaining fairly compatible with previous versions. Red Hat do have documentation on how to harden, but most users don't use it and instead turn SELinux completely off as one of the first configuration steps.
crymer11 12y ago
Ansible support would be spiffy.
- kieranajp 12y ago
  I was looking for the same thing; however I can't find any acknowledgement of Ansible's existence anywhere on the site or in the docs :(
- dsl 12y ago
  or Salt for the cool kids.
Alupis 12y ago
It this an arm of T-Mobile (the US carrier)? Their logos are strikingly similar, but their websites make no reference to each other. Telekom Labs logo: http://www.laboratories.telekom.com/public/Deutsch/Pages/default.aspx http://www.laboratories.telekom.com/public/Deutsch/Pages/def... T-Mobile logo: http://www.t-mobile.com/ http://www.t-mobile.com/
- Fastidious 12y ago
  T-Mobile is German. And yes, same company (http://en.wikipedia.org/wiki/T-Mobile http://en.wikipedia.org/wiki/T-Mobile).
- dsl 12y ago
  T-Mobile is the US subsidiary of Deutsche Telekom.
  - pluma 12y ago
    Nitpicking: T-Mobile is the international mobile branch of Deutsche Telekom, not just in the US (though there is a US subsidiary). Other branches include T-Online (private ISP, actually a former subsidiary), T-Systems (subsidiary proving services to the public sector and larger corporations) and T-Home (which I have trouble telling apart from T-Online). There may be other branches too, but in practice most people in Germany just lump them all together anyway.
virtuallynathan 12y ago
Seems bad that it disables IPv6 "for security".
- eropple 12y ago
  I don't really have a problem with that, to be honest--I certainly don't run an IPv6 network internally (and neither does anyone else on AWS) and IPv6 translation can happen at the edges.
- ownagefool 12y ago
  Disable anything you don't use. I wish it weren't so but IPv6 is probably a safe assumption there.
iand675 12y ago
Very cool, but seems like it would be nice to have the hardening steps documented outside of code too (for those of us with more exotic provisioning tastes).
- mikegioia 12y ago
  I completely agree. I was looking for the SSH settings but I don't use Puppet or Chef. This is why I prefer shell scripts so I can see what's going on and run parts of it on my own.
  - metatron31 12y ago
    You can check the references here in the lifecycle section: http://telekomlabs.github.io/docs/ http://telekomlabs.github.io/docs/
zobzu 12y ago
tldr its a set of open source puppet/chef/others modules to harden the default configuration of common daemons.

120 points by dewey 12y ago

codezero 12y ago

The audio on the demo video is really choppy, is that just me?

dewey 12y ago
The same is happening for me, didn't notice it when I watched it before I posted it though. Maybe Vimeo is having problems.
- markcampbell 12y ago
  It's not vimeo. Downloading the video and playing it locally with VLC yields the same problems.

allendoerfer 12y ago

Seems like a nice and comfortable way to set sane defaults for nginx, Apache, MySQL, PostgreSQL and some Unix stuff - but they really should have been set by each software in the first place. I like, the private touch the screencast and the developer-designed website gives the project, even if part of a big company. This actually raises its credibility.

ams6110 12y ago
they really should have been set by each software Yes, and it seems to me that distros (at least those intended for "enterprise") should be hardened by default also. If I install RHEL or OEL and then have to run a Chef or Puppet config to "harden" it, something is wrong.
- jlawer 12y ago
  Well, thats been tried and rejected by the user base. If you harden too much it becomes a real PITA to do anything productive (SELinux running in strict mode). RHEL aims to be secure, while also remaining fairly compatible with previous versions. Red Hat do have documentation on how to harden, but most users don't use it and instead turn SELinux completely off as one of the first configuration steps.

crymer11 12y ago

Ansible support would be spiffy.

kieranajp 12y ago
I was looking for the same thing; however I can't find any acknowledgement of Ansible's existence anywhere on the site or in the docs :(
dsl 12y ago
or Salt for the cool kids.

Alupis 12y ago

It this an arm of T-Mobile (the US carrier)? Their logos are strikingly similar, but their websites make no reference to each other. Telekom Labs logo: http://www.laboratories.telekom.com/public/Deutsch/Pages/default.aspx http://www.laboratories.telekom.com/public/Deutsch/Pages/def... T-Mobile logo: http://www.t-mobile.com/ http://www.t-mobile.com/

Fastidious 12y ago
T-Mobile is German. And yes, same company (http://en.wikipedia.org/wiki/T-Mobile http://en.wikipedia.org/wiki/T-Mobile).
dsl 12y ago
T-Mobile is the US subsidiary of Deutsche Telekom.
- pluma 12y ago
  Nitpicking: T-Mobile is the international mobile branch of Deutsche Telekom, not just in the US (though there is a US subsidiary). Other branches include T-Online (private ISP, actually a former subsidiary), T-Systems (subsidiary proving services to the public sector and larger corporations) and T-Home (which I have trouble telling apart from T-Online). There may be other branches too, but in practice most people in Germany just lump them all together anyway.

virtuallynathan 12y ago

Seems bad that it disables IPv6 "for security".

eropple 12y ago
I don't really have a problem with that, to be honest--I certainly don't run an IPv6 network internally (and neither does anyone else on AWS) and IPv6 translation can happen at the edges.
ownagefool 12y ago
Disable anything you don't use. I wish it weren't so but IPv6 is probably a safe assumption there.

iand675 12y ago

Very cool, but seems like it would be nice to have the hardening steps documented outside of code too (for those of us with more exotic provisioning tastes).

mikegioia 12y ago
I completely agree. I was looking for the SSH settings but I don't use Puppet or Chef. This is why I prefer shell scripts so I can see what's going on and run parts of it on my own.
- metatron31 12y ago
  You can check the references here in the lifecycle section: http://telekomlabs.github.io/docs/ http://telekomlabs.github.io/docs/

zobzu 12y ago

tldr its a set of open source puppet/chef/others modules to harden the default configuration of common daemons.