I spent some time trying to secure my new Debian 3.0 (Woody) server.... here are some notes.
Show Rest of Post
Done:
- Install everything from Debian packages1
- Disabled all non-essential ports
- inet had a bunch of ports open
- portmap had port 111 (SunRPC) open
- lpr was enabled
- Disabled SSH from root
- Installed AIDE2
Todo:
- Setup iptables
- Any suggestions?
1: I did this so that I can keep everything patched with a simple apt-get update; apt-get upgrade command. The one downside is that I am now at the mercy of package maintainers, and I won't get patches as quickly as I would if I did everything from source. But the reality of it is, I didn't have time to keep track of security updates before when I had everything built from source, so the net result should be a vast improvement.
2: Advanced Intrusion Detection Environment. I was thinking of using the more famous Tripwire, but it's not available in APT in Woody, and AIDE seemed like it would do the job. Also a comparison between AIDE and TripWire.
Posted Fri, May 26, 2006 16:59 by flower garden@195.225.176.158
From: http://flower-garden.i-find56.be/
[moderate]