Re: Linux hardening
Craig Holmes <[email protected]>
| Newsgroups | gmane.comp.security.linux |
|---|---|
| Message-ID | <[email protected]> |
On Sunday 21 August 2005 08:13, AragonX wrote: > I'm looking for more preventative measures. It appears that LIDS and > mod_security are the only ones in that role now. I recommend tuning php and disabling commands like system and passthru that may be used by an attacker but are probably not going to be used by you. I like to think that no webpage or script can be trusted even when I am the only person with access to a machine. Many people have recommended mounting /tmp and /var/tmp noexec. This is a good idea but keep in mind that it is easy to execute commands even on a noexec filesystem (using the ld-linux library). So don't be surprised if some slighly clever attacker is running a binary from that location. Oh yea, and use strong passwords! I have a couple of production machines that get hit by (sometimes) thousands of password guessing attempts per day. Craig -- KMail: 1.7.2 Linux Weltall 2.6.11.3 #4 Sun Mar 27 11:04:56 EST 2005 i686 AMD Athlon(TM) XP 1700+ AuthenticAMD GNU/Linux