{"id":8113,"date":"2019-01-13T18:25:50","date_gmt":"2019-01-13T18:25:50","guid":{"rendered":"https:\/\/www.appservgrid.com\/paw92\/?p=8113"},"modified":"2019-01-24T02:11:39","modified_gmt":"2019-01-24T02:11:39","slug":"introduction-to-linux-server-security-hardening","status":"publish","type":"post","link":"https:\/\/www.appservgrid.com\/paw92\/index.php\/2019\/01\/13\/introduction-to-linux-server-security-hardening\/","title":{"rendered":"Introduction to Linux Server Security Hardening"},"content":{"rendered":"

Securing your Linux server(s) is a difficult and time consuming task for System Administrators but its necessary to harden the server\u2019s security to keep it safe from Attackers and Black Hat Hackers. You can secure your server by configuring the system properly and installing as minimum softwares as possible. There are some tips which can help you secure your server from network and privilege escalation attacks.<\/p>\n

Upgrade your Kernel<\/strong><\/h3>\n

Outdated kernel is always prone to several network and privilege escalation attacks. So you can update your kernel using\u00a0apt<\/strong>\u00a0in Debian or\u00a0yum<\/strong>\u00a0in Fedora.<\/p>\n

<\/div>\n
\n
$\u00a0sudo<\/span>\u00a0apt-get update<\/span>
\n$\u00a0sudo<\/span>\u00a0apt-get dist-upgrade<\/span><\/div>\n<\/div>\n

Disabling Root Cron Jobs<\/strong><\/h3>\n

Cron jobs running by root or high privilege account can be used as a way to gain high privileges by attackers. You can see running cron jobs by<\/p>\n

<\/div>\n
\n
$\u00a0<\/span>ls<\/span>\u00a0\/<\/span>etc\/<\/span>cron*<\/span><\/div>\n<\/div>\n

Strict Firewall Rules<\/strong><\/h3>\n

You should block any unnecessary inbound or outbound connection on uncommon ports. You can update your firewalls rules by using\u00a0iptables<\/strong>. Iptables is a very flexible and easy to use utility used to block or allow incoming or outgoing traffic. To install, write<\/p>\n

\n
$\u00a0<\/span>sudo<\/span>\u00a0apt-get install<\/span>\u00a0iptables<\/div>\n<\/div>\n

Here\u2019s an example to block incoming on FTP port using iptables<\/p>\n

\n
$\u00a0<\/span>iptables\u00a0-A<\/span>\u00a0INPUT\u00a0-p<\/span>\u00a0tcp\u00a0–dport<\/span>\u00a0ftp<\/span>\u00a0-j<\/span>\u00a0DROP<\/div>\n<\/div>\n

Disable unnecessary Services<\/strong><\/h3>\n

Stop any unwanted services and daemons running on your system. You can list running services using following commands.<\/p>\n

\n
ubuntu@ubuntu:~$\u00a0<\/span>service\u00a0–status-all<\/span><\/p>\n

[<\/span>\u00a0+\u00a0]<\/span>\u00a0 acpid
\n[<\/span>\u00a0–\u00a0]<\/span>\u00a0 alsa-utils
\n[<\/span>\u00a0–\u00a0]<\/span>\u00a0 anacron
\n[<\/span>\u00a0+\u00a0]<\/span>\u00a0 apache-htcacheclean
\n[<\/span>\u00a0+\u00a0]<\/span>\u00a0 apache2
\n[<\/span>\u00a0+\u00a0]<\/span>\u00a0 apparmor
\n[<\/span>\u00a0+\u00a0]<\/span>\u00a0 apport
\n[<\/span>\u00a0+\u00a0]<\/span>\u00a0 avahi-daemon
\n[<\/span>\u00a0+\u00a0]<\/span>\u00a0 binfmt-support
\n[<\/span>\u00a0+\u00a0]<\/span>\u00a0 bluetooth
\n[<\/span>\u00a0–\u00a0]<\/span>\u00a0 cgroupfs-mount<\/p>\n

\u2026snip…<\/p><\/div>\n<\/div>\n

OR using the following command<\/p>\n

\n
$\u00a0<\/span>chkconfig\u00a0–list<\/span>\u00a0|<\/span>\u00a0grep<\/span>\u00a0‘3:on’<\/span><\/div>\n<\/div>\n

To stop a service, type<\/p>\n

\n
$\u00a0<\/span>sudo<\/span>\u00a0service\u00a0[<\/span>SERVICE_NAME]<\/span>\u00a0stop<\/div>\n<\/div>\n

OR<\/p>\n

\n
$\u00a0<\/span>sudo<\/span>\u00a0systemctl stop\u00a0[<\/span>SERVICE_NAME]<\/span><\/div>\n<\/div>\n

Check for Backdoors and Rootkits<\/strong><\/h3>\n

Utilities like rkhunter and chkrootkit can be used to detect known and unknown backdoors and rootkits. They verify installed packages and configurations to verify system\u2019s security. To install write,<\/p>\n

\n
ubuntu@ubuntu:~$\u00a0<\/span>sudo<\/span>\u00a0apt-get install<\/span>\u00a0rkhunter\u00a0-y<\/span><\/div>\n<\/div>\n

To scan your system, type<\/p>\n

\n
ubuntu@ubuntu:~$\u00a0<\/span>sudo<\/span>\u00a0rkhunter\u00a0–check<\/span><\/p>\n

[<\/span>\u00a0Rootkit Hunter version 1.4.6\u00a0]<\/span><\/p>\n

Checking system commands…<\/p>\n

Performing\u00a0‘strings’<\/span>\u00a0command<\/span>\u00a0checks
\nChecking\u00a0‘strings’<\/span>\u00a0command<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0[<\/span>\u00a0OK\u00a0]<\/span><\/p>\n

Performing\u00a0‘shared libraries’<\/span>\u00a0checks
\nChecking\u00a0for<\/span>\u00a0preloading variables\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0[<\/span>\u00a0None found\u00a0]<\/span>
\nChecking\u00a0for<\/span>\u00a0preloaded libraries\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0[<\/span>\u00a0None found\u00a0]<\/span>
\nChecking LD_LIBRARY_PATH variable\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0[<\/span>\u00a0Not found\u00a0]<\/span><\/p>\n

Performing\u00a0file<\/span>\u00a0properties checks
\nChecking\u00a0for<\/span>\u00a0prerequisites\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0[<\/span>\u00a0OK\u00a0]<\/span>
\n\/<\/span>usr\/<\/span>sbin\/<\/span>adduser\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0[<\/span>\u00a0OK\u00a0]<\/span>
\n\/<\/span>usr\/<\/span>sbin\/<\/span>chroot<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0[<\/span>\u00a0OK\u00a0]<\/span><\/p>\n

…snip…<\/p><\/div>\n<\/div>\n

Check Listening Ports<\/strong><\/h3>\n

You should check for listening ports that aren\u2019t used and disable them. To check for open ports, write.<\/p>\n

\n
azad@ubuntu:~$\u00a0<\/span>sudo<\/span>\u00a0netstat<\/span>\u00a0-ulpnt<\/span>
\nActive Internet connections\u00a0(<\/span>only servers)<\/span>
\nProto Recv-Q Send-Q Local Address\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Foreign Address\u00a0\u00a0\u00a0State\u00a0\u00a0 \u00a0\u00a0\u00a0PID\/<\/span>Program name<\/p>\n

tcp\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a00<\/span>\u00a0 \u00a0\u00a00<\/span>\u00a0127.0.0.1:6379<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a00.0.0.0:*<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0LISTEN\u00a0 \u00a0\u00a0\u00a02136<\/span>\/<\/span>redis-server\u00a01<\/span><\/p>\n

tcp\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a00<\/span>\u00a0 \u00a0\u00a00<\/span>\u00a00.0.0.0:111<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a00.0.0.0:*<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0LISTEN\u00a0 \u00a0\u00a0\u00a01273<\/span>\/<\/span>rpcbind<\/p>\n

tcp\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a00<\/span>\u00a0 \u00a0\u00a00<\/span>\u00a0127.0.0.1:5939<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a00.0.0.0:*<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0LISTEN\u00a0 \u00a0\u00a0\u00a02989<\/span>\/<\/span>teamviewerd<\/p>\n

tcp\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a00<\/span>\u00a0 \u00a0\u00a00<\/span>\u00a0127.0.0.53:53<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a00.0.0.0:*<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0LISTEN\u00a0 \u00a0\u00a0\u00a01287<\/span>\/<\/span>systemd-resolv<\/p>\n

tcp\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a00<\/span>\u00a0 \u00a0\u00a00<\/span>\u00a00.0.0.0:22<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a00.0.0.0:*<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0LISTEN\u00a0 \u00a0\u00a0\u00a01939<\/span>\/<\/span>sshd<\/p>\n

tcp\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a00<\/span>\u00a0 \u00a0\u00a00<\/span>\u00a0127.0.0.1:631<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a00.0.0.0:*<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0LISTEN\u00a0 \u00a0\u00a0\u00a020042<\/span>\/<\/span>cupsd<\/p>\n

tcp\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a00<\/span>\u00a0 \u00a0\u00a00<\/span>\u00a0127.0.0.1:5432<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a00.0.0.0:*<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0LISTEN\u00a0 \u00a0\u00a0\u00a01887<\/span>\/<\/span>postgres<\/p>\n

tcp\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a00<\/span>\u00a0 \u00a0\u00a00<\/span>\u00a00.0.0.0:25<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a00.0.0.0:*<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0LISTEN\u00a0 \u00a0\u00a0\u00a031259<\/span>\/<\/span>master<\/p>\n

…snip…<\/p><\/div>\n<\/div>\n

Use an IDS (Intrusion Testing System)<\/strong><\/h3>\n

Use an IDS to check network logs and to prevent any malicious activities. There\u2019s an open source IDS Snort available for Linux. You can install it by,<\/p>\n

\n
$\u00a0wget<\/span>\u00a0https:\/\/<\/span>www.snort.org\/<\/span>downloads\/<\/span>snort\/<\/span>daq-2.0.6.tar.gz
\n$\u00a0wget<\/span>\u00a0https:\/\/<\/span>www.snort.org\/<\/span>downloads\/<\/span>snort\/<\/span>snort-2.9.12.tar.gz
\n$\u00a0tar<\/span>\u00a0xvzf daq-2.0.6.tar.gz
\n$\u00a0cd<\/span>\u00a0daq-2.0.6
\n$ .\/<\/span>configure\u00a0&&<\/span>\u00a0make<\/span>\u00a0&&<\/span>\u00a0sudo<\/span>\u00a0make<\/span>\u00a0install<\/span>
\n$\u00a0tar<\/span>\u00a0xvzf snort-2.9.12.tar.gz
\n$\u00a0cd<\/span>\u00a0snort-2.9.12
\n$ .\/<\/span>configure\u00a0–enable-sourcefire<\/span>\u00a0&&<\/span>\u00a0make<\/span>\u00a0&&<\/span>\u00a0sudo<\/span>\u00a0make<\/span>\u00a0install<\/span><\/div>\n<\/div>\n

To monitor network traffic, type<\/span><\/p>\n

\n
ubuntu@ubuntu:~$\u00a0<\/span>sudo<\/span>\u00a0snort<\/p>\n

Running\u00a0in<\/span>\u00a0packet dump mode
\n—<\/span>== Initializing Snort ==–<\/p>\n

Initializing Output Plugins!<\/span>
\npcap DAQ configured to passive.<\/p>\n

Acquiring network traffic from\u00a0“tun0”<\/span>.
\nDecoding Raw IP4<\/p>\n

—<\/span>== Initialization Complete ==–<\/p>\n

…snip…<\/p><\/div>\n<\/div>\n

Disable Logging as Root<\/strong><\/h3>\n

Root acts as a user with full privileges, it has power to do anything with the system. Instead, you should enforce using sudo to run administrative commands.<\/p>\n

Remove no owner Files<\/strong><\/h3>\n

Files owned by no user or group can be security threat. You should search for these files and remove them or assign them a proper user a group. To search for these files, type<\/p>\n

\n
$\u00a0<\/span>find<\/span>\u00a0\/<\/span>dir<\/span>\u00a0-xdev<\/span>\u00a0\\(<\/span>\u00a0-nouser<\/span>\u00a0-o<\/span>\u00a0-nogroup<\/span>\u00a0\\)<\/span>\u00a0-print<\/span><\/div>\n<\/div>\n

Use SSH and sFTP<\/strong><\/h3>\n

For file transferring and remote administration, use SSH and sFTP instead of telnet and other insecure, open and unencrypted protocols. To install, type<\/p>\n

\n
$\u00a0sudo<\/span>\u00a0apt-get install<\/span>\u00a0vsftpd\u00a0-y<\/span>
\n$\u00a0sudo<\/span>\u00a0apt-get install<\/span>\u00a0openssh-server\u00a0-y<\/span><\/div>\n<\/div>\n

Monitor Logs<\/strong><\/h3>\n

Install and setup a log analyzer utility to check system logs and event data regularly to prevent any suspicious activity. Type<\/p>\n

\n
$\u00a0<\/span>sudo<\/span>\u00a0apt-get install<\/span>\u00a0-y<\/span>\u00a0loganalyzer<\/div>\n<\/div>\n

Uninstall unused Softwares<\/strong><\/h3>\n

Install softwares as minimum as possible to maintain small attack surface. The more softwares you have, the more chances of attacks you have. So remove any unneeded software from your system. To see installed packages, write<\/p>\n

\n
$\u00a0dpkg<\/span>\u00a0–list<\/span>
\n$\u00a0dpkg<\/span>\u00a0–info<\/span>
\n$\u00a0apt-get<\/span>\u00a0list\u00a0[<\/span>PACKAGE_NAME]<\/span><\/div>\n<\/div>\n

 <\/p>\n

To remove a package:<\/p>\n

\n
$\u00a0sudo<\/span>\u00a0apt-get remove<\/span>\u00a0[<\/span>PACKAGE_NAME]<\/span>\u00a0-y<\/span>
\n$\u00a0sudo<\/span>\u00a0apt-get clean<\/span><\/div>\n<\/div>\n

Conlusion<\/h3>\n

Linux server security hardening is very important for enterprises and businesses. Its a difficult and tiresome task for System Administrators. Some processes can be automated by some automated utilities like SELinux and other similar softwares. Also, keeping minimus softwares and disabling unused services and ports reduces the attack surface.<\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Securing your Linux server(s) is a difficult and time consuming task for System Administrators but its necessary to harden the server\u2019s security to keep it safe from Attackers and Black Hat Hackers. You can secure your server by configuring the system properly and installing as minimum softwares as possible. There are some tips which can … <\/p>\n

Continue reading “Introduction to Linux Server Security Hardening”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-8113","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/8113","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/comments?post=8113"}],"version-history":[{"count":2,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/8113\/revisions"}],"predecessor-version":[{"id":8584,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/8113\/revisions\/8584"}],"wp:attachment":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/media?parent=8113"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/categories?post=8113"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/tags?post=8113"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}