Linux Security Hardening: Difference between revisions

From NovaOrdis Knowledge Base
Jump to navigation Jump to search
Line 36: Line 36:
  useradd -g 1200 -m -u 1200 m3rt50acc
  useradd -g 1200 -m -u 1200 m3rt50acc


Then [[Sshd_Configuration#Disallow_root_to_Connect|Disallow root to log in at all]]. Possibly add m3rt50acc's public key to authorized_keys.
then [[Sshd_Configuration#Disallow_root_to_Connect|Disallow root to log in at all]]. Possibly add m3rt50acc's public key to authorized_keys.


=TODO=
=TODO=

Revision as of 04:50, 22 April 2018

Internal

Overview

Steps

Minimal Footprint

Install a minimal image and add utilities as needed.

Eliminate Users

Remove all unneeded users.

root

Change the root's password to a long, random one.

Scan for Services Listening on Ports

 netstat -tupln

Eliminate:

sshd

Configure sshd to only allow root access only based on public/private key identification.

Alternatively, create a special login user with a random name and a long, random password:

groupadd -g 1200 m3rt50acc
useradd -g 1200 -m -u 1200 m3rt50acc

then Disallow root to log in at all. Possibly add m3rt50acc's public key to authorized_keys.

TODO

  • Penetration detection.