5 Basic Principles of Linux System Security

5 Basic Principles of Linux System Security It is still common that people do not know where to start when it comes to information security. With 5 basic principles we can improve the Linux system security and question ourselves if we have done enough.   1. Know your system(s) The first principle is about knowing what your system is supposed to do. What is its primary role, what software packages does it need and who needs access? By knowing the […]

Read more

Why Linux Security Hardening Scripts Might Backfire

Why Linux Security Hardening Scripts Might Backfire System administrators and engineers love to automate things. In the quest to get everything replaced by a script, automated hardening of systems is often requested. Unfortunately this automation might later backfire, resulting in a damaged trust in system hardening. Why System Hardening? The act of increasing system defenses is a good practice. It helps protecting your valuable data, so it can only be used by authorized people. System hardening itself consists of minimizing […]

Read more

Using Open Source Auditing Tools as Alternative for CIS Benchmarks

Using Open Source Auditing Tools An alternative to CIS Benchmarks and hardening guides Hardening guides, and the CIS benchmarks in particular, are a great resource to check your system for possible weaknesses and conduct system hardening. But who has the time to read it cover to cover, and apply every single step? In this article we have a look at the alternative: open source auditing tools. Time.. Hardening is a time consuming task. As security specialists, we know that. It […]

Read more

Disable SSLv3 in Lighttpd to protect against POODLE attack

Disable SSLv3 in Lighttpd Protecting against the POODLE attack The POODLE attack has entered the news a few times now. The issue behind the POODLE attack is serious, as it abuses a weakness in the protocol, not the implementation. This means the only proper fix is abandoning the SSLv3 protocol and use the newer TLS protocols. Disable SSLv2 and SSLv3 Lighttpd commonly has its configuration settings stored in /etc/lighttpd/lighttpd.conf. Open this file and add the following two statements, to disable […]

Read more

Finding setuid binaries on Linux and BSD

Finding setuid binaries for Linux and BSD systems Why setuid? Binaries with the setuid bit enabled, are being executed as if they were running under the context of the root user. This enables normal (non-privileged) users to use special privileges, like opening sockets. While this seems unnecessary for a normal user, it is actually needed for simple commands like ping. Finding files with setuid bit To discover all files with the setuid bit, we can use the find command. Depending […]

Read more

Linux Capabilities 101

Linux Capabilities 101 Tutorial about how capabilities work in Linux Even seasoned Linux administrators may not see capabilities a lot in their daily duties, but they are still used all the time. This features was added to Linux 2.2 and gave us new possibilities regarding security. In this guide we have an in-depth look on how can leverage them to increase security. The problem It is good to know why capabilities were implemented at the first place. Let’s assume we […]

Read more

Protect against ptrace of processes: kernel.yama.ptrace_scope

Protect against the usage of Ptrace Hardening the kernel with kernel.yama.ptrace_scope Ptrace is a great troubleshooting tool for developers to determine how a process functions. It can be used to find programming flaws, like memory leakage. On the other hand, the tool also be used by people with malicious intent. For example to debug a process as a non-privileged user and find the contents of application memory. Yama Linux has the ability to include Linux Security Modules, to provide additional […]

Read more

Filtering ARP traffic with Linux arptables

Filtering ARP traffic with Linux arptables Most Linux system administrators will be familiar with iptables on Linux. Less known is the arptables utility, which controls filtering arp packets. Installation The arptables utility is easy to set-up, as the main functionality is already implemented in the Linux kernel. Just install the arptables package on your favorite Linux distribution. Red Hat / CentOS / Fedora yum install arptables Debian / Ubuntu apt-get install arptables Configuration example To show the effect of filtering […]

Read more
1234