cybersecurity

4038 readers

72 users here now

An umbrella community for all things cybersecurity / infosec. News, research, questions, are all welcome!

Community Rules

Be kind
Limit promotional activities
Non-cybersecurity posts should be redirected to other communities within infosec.pub.

Enjoy!

founded 2 years ago

MODERATORS

shellsharks@infosec.pub

tweedge@infosec.pub

What are your methods to harden *nix servers? (infosec.pub)

submitted 5 days ago by fishynoob@infosec.pub to c/cybersecurity@infosec.pub

7 comments fedilink hide all child comments

I have been looking at hardening *nix servers for my lab and maybe carry some of that over to work. CIS benchmarks are something I like doing but that's barely scratching the surface. What do you do for your servers?

I have Lynis, systemd-analyze, Kernel self protection in mind but I'd love to hear your thoughts. Bonus points for the most paranoid setups!

you are viewing a single comment's thread
view the rest of the comments

[–] iii@mander.xyz 3 points 4 days ago* (last edited 4 days ago) (1 children)

With knockd you can execute arbitrary commands upon a port knocking sequence. So any application that is configurable via terminal is eligible. Here's a tutorial of knockd+iptables (1). Alternativly there's (2) that achieves the same effect in a different way.

You can use it wherever, as part of security in depth. It's essentially a pre-shared secret.

It'll have it's largest effect on publicly facing interfaces. It does not replace having a proper ssh setup (disabling root, disabling password login, etc).

[–] Cyber@feddit.uk 2 points 4 days ago

Thanks for the links, I'll take a look as I've never actually played with port knocking.