TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Secure your Linux server - HowTo by the NSA

396 点作者 hyyypr将近 14 年前

17 条评论

hvs将近 14 年前
Looks like they have guides for multiple operating systems:<p><a href="http://www.nsa.gov/ia/guidance/security_configuration_guides/operating_systems.shtml" rel="nofollow">http://www.nsa.gov/ia/guidance/security_configuration_guides...</a>
评论 #2564047 未加载
评论 #2564651 未加载
评论 #2564000 未加载
vanni将近 14 年前
They could have done better for OpenSSH securing: they forgot forcing key-based authentication only and changing default port number.
评论 #2564263 未加载
评论 #2564271 未加载
vegasbrianc将近 14 年前
Quite a detailed document. Glad to see the US taxes paying for something decent for once.
评论 #2564063 未加载
评论 #2563997 未加载
eck将近 14 年前
Section 1.1.1: "Data transmitted over a network, whether wired or wireless, is susceptible to passive monitoring."<p>Translation: We don't like those creeps on the other side of the building either.
评论 #2565902 未加载
recampbell将近 14 年前
Is there an OSS package for automating checks for such practices? Ie, security lint checker?
评论 #2564625 未加载
pgroves将近 14 年前
In all seriousness, is there a shorter "cheat sheet" of this document or something similar? I'm sure I'm not the only one here working on building a server side app but has little security experience. "Security" is tough to give top priority to at a startup and implementing a 200+ page security protocol isn't realistically going to happen anytime soon.
评论 #2564507 未加载
thibaut_barrere将近 14 年前
Is there a tool I could run to check what's described in the document (or similar) automatically ?
评论 #2564570 未加载
conradev将近 14 年前
3.21 - Install the NSA Security Suite to ensure your computer's safety
olalonde将近 14 年前
Could anyone quickly explain how partitioning helps with security?
评论 #2565417 未加载
评论 #2565311 未加载
评论 #2568498 未加载
malkia将近 14 年前
If Only Sony.... ah... too late for that!
tzury将近 14 年前
This is a bit out of date (2009) yet contain many Security goodies for Ubuntu [pdf]<p><a href="http://www.securenetwork.it/ricerca/whitepaper/download/Debian-Ubuntu_hardening_guide.pdf" rel="nofollow">http://www.securenetwork.it/ricerca/whitepaper/download/Debi...</a>
评论 #2566006 未加载
gks将近 14 年前
Does anyone have any other guides like this? I'm using Arch Linux and want to run nginx on it. I'd like to make sure it's as secure as I can make it before deploying the website.
评论 #2565641 未加载
评论 #2564899 未加载
评论 #2566956 未加载
tintin将近 14 年前
<i>"Use a bios password"</i> ... and don't reboot your server when running in a remote server room?
评论 #2564087 未加载
评论 #2564974 未加载
评论 #2565051 未加载
peterbotond将近 14 年前
Interesting, FreeBSD/PcBSD is not on the list. is it due to lesser popularity?
评论 #2565380 未加载
评论 #2567667 未加载
peterwwillis将近 14 年前
I'll just skip to the juicy bits:<p>1.1.2 Minimize Software to Minimize Vulnerability<p>Really, NSA? So you enjoy tracking down broken package dependencies, installing software 5x a week as developers need it (thus slowing down their development time), and not having the tools to troubleshoot downed systems when they're down (and potentially without access to Yum)? Not to mention having to USE YUM, which is in itself not a fate i'd wish on anyone. If you actually audit and secure stupid stuff like excess running network services and setuid-root binaries you are left with one thing: usermode applications which cannot be used for any attacks. Thus it's not only annoying to not have software already on the box, it's stupid too.<p>2.1.1.1 Disk Partitioning<p>Are you people really stuck in 1998? Are we really still making a separate partition for /boot? Look, guys. BIOSes could access disks past the 1024th sector like 10 years ago. And for christ's sake, nobody has ever been saved from having a 4GB /var/log partition and a 20GB / partition. The disk space is finite. If you run out, YOU'VE RUN OUT. Just make one bigass partition and <i>IMPLEMENT DISK SPACE MONITORING</i> and clean up your crappy logs before the disk runs out. If /var fills up you're fucked anyway, so might as well give it as much space as possible.<p>2.1.1.2 Boot Loader Configuration<p>Oh my god, HOW could we possibly be secure without a password to BOOT OUR MACHINE. The damn disks and boot partition aren't even encrypted, guys! This is useless! If i'm at the machine trying to change the boot configuration i'm just gonna remove the hard drive or use a jump drive and get at the data myself!<p>2.2.1 Restrict Partition Mount Options<p>OK, they redeem themselves here on the partition shit. I still think /tmp should be tmpfs or a swap partition, but whatever. Mounting user-writeable partitions with nodev,nosuid,noexec is actually a really effective and easy way to prevent payloads from being dropped and executed. Of course you can still just buffer overflow and have at whatever service you want, but it makes it much more annoying for attackers as they can't just download a payload to disk and run it. Of course this also means you can't scp scripts as a normal user and run them; you'd need to make a special account that can write to / or some other directory which can execute scripts, so you can copy admin tools/scripts there on the fly for maintenance etc.<p>2.3.5 Protect Physical Console Access<p>Again, this is stupid. BIOS password? I'll just remove the CMOS battery. Boot loader password? I'll use a jump drive or remove the hard drive (or put in my own and boot to it, then access your disk).<p>2.5.3.1 Disable Support for IPv6 unless Needed<p>Too lazy to use ip6tables, huh? Yeah you're right, we'll never need IPv6.<p>2.5.4.1 How TCP Wrapper Protects Services<p>REALLY, NSA? Allow only specific IPs or hosts? Are we really talking about fucking TCP wrappers? If you rely on TCP wrappers you should probably be fired.<p>3.5.1 Disable OpenSSH Server if Possible<p>....how the hell am I supposed to maintain the system then? Use Rsh? Just hope that nothing ever goes wrong so I never have to log in to troubleshoot?<p>Clearly somebody just decided to list every single commonly-available-at-install "security feature" found in modern Linux distros instead of showing how to implement security best practices and a structure of limited access control on available services (combined with robust configuration management). Yes this is all very nice for beginners, but if you're really trying to secure a machine you shouldn't be giving the task to a beginner.
评论 #2564114 未加载
评论 #2564094 未加载
评论 #2565258 未加载
squamigera将近 14 年前
Anyone find an attempt to install any backdoor? :D
nuclearsandwich将近 14 年前
tl;dr: Don't take security advice from organizations whose job is spying on you.<p>I don't know about anyone else. But the NSA is one of the last organizations I'd let give me security advice. I wouldn't put it past them to purposefully omit a pointer or two in the hope that those who follow the guide to the letter not knowing any better will leave a way in. Based on the other comments the advice is banal rubbish. Perhaps this is purposeful.
评论 #2564123 未加载