Re: Linux hardening

AragonX wrote:

>I had an intrusion on one of my servers and am in the process of hardening
>it (after a reinstall).  I'm using Fedora Core 4.  I've taken all the
>basic steps (shutting down unused services etc) and have done the
>following:
><snip>
>The server performs the following tasks:
>
>   Web (Squirrelmail, eGroupWare, myPhpAdmin and others) and email serving
>to the internet.
><snip>
>I'm looking for more preventative measures.  It appears that LIDS and
>mod_security are the only ones in that role now.  Should I jail apache?
>Would that give me any benefits over what LIDS provides?
>
I would recommend also securing /tmp (and /var/tmp). Mounting it noexec 
and nosuid is a good step to take. As well, I modified my local wget and 
curl programs to *not* download to /tmp or /var/tmp, as no legitimate 
use for the program (on my servers) will be downloading files to these 
locations. As well, these two programs are commonly used in web script 
attacks to retrieve a remote file and execute it.

As well, install and run regularly (via cron) chkrootkit and rootkit 
hunter. You should not rely solely on these programs, but they provide a 
nice check that can assist you in finding some of the more common and 
known intrusions/rootkits.

-Sean Finkel
Owner
Protollix, LLC
http://www.protollix.com