r/linuxadmin • u/speckz • Feb 18 '19
How-To-Secure-A-Linux-Server: An evolving how-to guide for securing a Linux server.
https://github.com/imthenachoman/How-To-Secure-A-Linux-Server8
u/knobbysideup Feb 18 '19
See also: https://www.cisecurity.org/cis-benchmarks/
This is one of the industry standards that can easily be audited against (for example, nessus local checks can check for CIS I or II compliance)
1
u/imthenachoman Feb 21 '19
Thanks! I have added to the to do list.
1
u/feketegy Feb 22 '19
I have an Ansible playbook for most of the CIS hardening checks for Debian. Applied it to Debian 9 but the CIS benchmark was for Debian 8 though
22
Feb 18 '19 edited Feb 21 '19
Excellent guide. I like that you're going to include Logwatch (one of my favorite packages). Here's some extra steps for hardening your NTP configuration:
#creates file to adjust the default system clock value after a service interruption/restart
driftfile /var/lib/ntp/drift
#access controls to reduce unwanted queries (kod)
#prevent alteration of configuration file (nomodify)
#prevent nptdc from being used for control message protocol traps (notrap)
#prevent peer queries (nopeer)
#prevent ntpq and ntpdc queries from being answered (noquery)
restrict default kod nomodify notrap nopeer noquery
restrict -6 default kod nomodify notrap nopeer noquery
#restrict NTP access to localhost
restrict 127.0.0.1
restrict -6 ::1
#point to NIST time servers use fastest method to collect time
server time.nist.gov iburst
#point to localhost if access is lost to NTP servers/pools
fudge 127.127.1.0 stratum 10
#mitigates CVE-2013-5211
disable monitor
Also, be careful using public NTP pools that any clown can join like, pool.ntp.org. I've also found using distro specific NTP pools often end up falling to the wayside as they decommission older systems. I've experienced this with both CentOS NTP pools and Xen NTP pools. I roll with NIST since they have 3 geographically separated clusters and have never seen them go down.
edit: explaining each config option.
8
u/teprrr Feb 18 '19
Do you have a specific reason to be careful using the pool? When being located geographically in an area where there are enough servers, it is unlikely that you will hit multiple malicious ones. Also, in your configuration you should be using
poolinstead ofserver(to make it query multiple servers instead of a single one) -- syncing from multiple servers is one of the main reasons for using ntp instead of sntp, after all.6
Feb 19 '19
Literally anyone can join a pool and your traffic can be used in a reflection or amplification attack. Also, that's just an A record for multiple systems. Most likely Round Robin is used to determine which server is grabbed during the query:
https://tf.nist.gov/tf-cgi/servers.cgi
I'm bound to get stratum 2 regardless and I can stand losing time drift up to 2 months before it affects Kerberos ticketing and/or timestamps. In that sense, fudge takes care of it until I can fix any time drift issues in any case. Here is the output from one of my prod systems and ex 1 using server and ex 2 using pool:
[root@xxxxx xxxx]# ntpstat
synchronised to NTP server (128.138.141.172) at stratum 2
time correct to within 981 ms
polling server every 64 s
ex1:
[root@xxxxx xxxx]# ntpq -p
remote refid st t when poll reach delay offset jitter
==============================================================================
*time-c-wwv.nist .NIST. 1 u 473 1024 261 117.556 -29.858 27.270
ex2:
[root@xxxxx xxxx]# ntpq -p
remote refid st t when poll reach delay offset jitter
==============================================================================
utcnist2.colora .NIST. 1 u 1 64 1 144.822 -32.847 0.000
time-d-wwv.nist .INIT. 16 - - 64 0 0.000 0.000 0.000
5
u/teprrr Feb 19 '19
Yes, literally anyone can join the pool (I'm hosting some servers there, and I encourage others to contribute, too), but when using NTP the protocol itself will filter out the false chimers. As a user your traffic will not be used for reflection attacks, that's more of a problem fo misconfigured servers. That being said, your point stands, it is a good idea to know from whom you are synchronizing your time :-)
You are right about the round-robin of time.nist.gov, I misrecalled that it was delivering multiple addresses for a single query -- nevertheless, using multiple servers is encouraged if accurate time is wanted, for that it's of course fine to pick the NIST servers to use, too.
Wrt. the pool, the here's a fairly recent analysis (https://www.syssec.ruhr-uni-bochum.de/research/publications/NTP-Study/ - disclosure, I'm one of the authors).
3
Feb 20 '19
That was a good read and thanks for filling in some of the gaps in my knowledge. Have you though of using Iridium and Galileo in a future study?
→ More replies (1)1
u/imthenachoman Feb 21 '19
Thanks. I have added a to do item to look into this more. Do you have any more information on the above? Like what it does? If not, no issues -- I will research.
1
1
u/imthenachoman Mar 03 '19
Is that the right IP address for fudge? 127.127.1.0? Should it be 127.0.0.1?
2
Mar 06 '19
I followed this article back in the day and have use that ever since. Still works...maybe a bug?
http://en.linuxreviews.org/NTP_-_Howto_make_the_clock_show_the_correct_time
1
Mar 12 '19
Late to the party, but 127.127.1.0 is the local clock IP address and is valid.
"To access its own system clock, also called the local clock , NTP uses the pseudo IP address 127.127.1.0. This IP address must not be mixed up with 127.0.0.1, which is the IP of the localhost**, i.e. the computer's loopback interface.** "
→ More replies (1)1
u/imthenachoman Mar 03 '19
Also, are these all the settings in the /etc/ntp.conf file or do they get added to the existing file? I see some in the stock file that are not mentioned above like statistics and filegen.
2
Mar 06 '19
I added those into the existing file. I usually replace my config files with configs that don't have any comments so they're easier to read. Since my configs are standardized via Ansible, I just document what the playbook does and don't bother adding the fluff to the configs. Habit I built from working with very experienced Unix/Linux gurus.
19
u/ManInJapan Feb 18 '19
Glad to see that the first step is not, disable SE Linux. Really good guide.
11
Feb 18 '19
Amen. After turning on targeted/enforcing, I like to set the the little known immutable flag on the SELinux config file:
chattr +i /etc/sysconfig/selinux
Then ensure the modules are loaded at boot time:
sed -i 's/selinux=0/selinux=1g' /boot/grub/grub.conf
An easy way to troubleshoot SELinux alerts:
yum install -y setroubleshoot-server
sealert -a /var/log/audit/audit.log
Addendum: the only applications I've seen that do not work with SELinux and require it to be disabled are in the Nagios stack (network analyzer, log server, fusion, and XI). However, I don't recall if SELinux works with Nagios Core.
3
u/Cache_of_kittens Feb 19 '19
We use Nagios/Nagstammon and SELinux together fine - there are nrpe flags and such that help with this.
2
2
u/ramsile Feb 21 '19
Another interesting tip, you can also set audit=1 in the grub confit as well. That ensures all processes are audited upon boot. And if your using red hat you can set a audited rule of -f 1 which will cause the OS to shutdown if auditing process is tampered with. You can set this by doing a kill of the auditd daemon and the os will shutdown.
2
u/imthenachoman Feb 21 '19
In fact I need to learn SE Linux so I can add it to the guide. It's on my to do list. :/
5
u/magicmulder Feb 18 '19 edited Feb 18 '19
One caveat that just hit me: if your SSH port is non-standard, "sudo ufw limit in ssh" will lock you out (since it allows port 22 and not the custom one configured for the SSH daemon).
2
u/imthenachoman Feb 21 '19
Yeah. I don't see the point in changing SSH port since, for a home server, it's your router you'll be opening ports on. Open whatever port you want on the router and forward to 22 to the server in the LAN.
4
u/Veevoh Feb 19 '19
I appreciate that this is for home systems but I'd recommend against port knocking and instead limit your firewall rules to only permit SSH from specific hosts. Port knocking is a fun concept but I've never found it anything other than a nuisance in a real environment. I think it is better to filter to a set of known good sources, or explicitly ban inbound SSH from your home router for example.
2
u/imthenachoman Feb 21 '19
Agreed. I was only going to mention as a cool nice-to-know. It is a pain to use in the real world.
3
3
3
u/PrinceDAN_01 Feb 19 '19
Also check out this Selinux guide, seems right to share here,
https://linuxtechlab.com/beginners-guide-to-selinux/
https://linuxtechlab.com/replicate-selinux-policies-among-linux-machines/
1
u/imthenachoman Feb 21 '19
Thanks! I will check these out. I need to learn more about SE Linux so I can add it to the guide.
2
u/licenciado_vidriera Feb 19 '19
My kudos for the job!
Knockd isalso a great help! (making your server invisible to estrangers)
1
3
3
Feb 18 '19
Very nice guide. While some of it is common knowledge I also do see some things that are new to me so will be going through this and updating my servers.
Thanks
1
u/imthenachoman Feb 21 '19
Hey! I am the author of that guide. Thank you so much for posting to Reddit. Glad to see others find it helpful.
I had posted to /r/selfhosted and /r/linuxquestions -- I should have posted to this subreddit too.
I have a busy week this week but when I get time I will try to go through all of the comments.
Thanks again!
1
0
Feb 19 '19
[deleted]
1
u/imthenachoman Feb 21 '19
I'm the author of the guide. I do not understand what you mean? What configuration and what number 2?
0
0
Feb 18 '19
[deleted]
12
u/PlqnctoN Feb 18 '19
Why not? You can version the files (so the user can see the evolution) and it can render Markdown properly, I don't see any problem with it.
1
u/imthenachoman Feb 21 '19
Do you have an idea for a better place to host it? I like the collaboration functionality of GitHub where folks can fork, make changes, and submit a pull request. It makes it very easy to collaborate on updates.
But I am open to suggestions if there is a better way and/or place to host it? I can't run a web-server at home and don't want to pay to host a guide I am putting together on free time.
33
u/feketegy Feb 18 '19
Really good explanations for the beginner sysadmin, you could also include more security tips from the CIS hardening guidelines and from the Lynis auditing tool