Ask HN: Best Server Hardening Guide?

30 points·Kinnard··10 comments

What are the best server hardening guides?

One quick note - You probably shouldn't be performing your server hardening manually on each server. It's easy to miss things.

I'd suggest using an ansible/chef/puppet/whatever script, that you customize to meet the needs of your particular application.

Some simple ones you could start with are available at http://tinyurl.com/AnsibleFirst5 and/or http://hardening.io/

Expand to add additional configuration and hardening for your particular infrastructure.

(1) sudo netstat -tanp | grep LISTEN

(2) For anything not listening to 127.0.0.1: what is it and do you need it?

(3) If answer to #2 is "dunno" or "no," turn it off.

Nice.

They call them 'benchmarks', but they are really just checklists of things to do (disable X, lock down Y, etc.)

Co-incidentally I got this in E-Mail as newsletter

The Hardened Gentoo project page has a lot of useful information, guides on using Pax, grsecurity and so on...

I used this for my iptables settings.

Red Hat have a very good guide for RHEL / CentOS:

NSA have also put out some good hardening guides

stay away from ufw and stick with iptables. I had some ufw stuff fail on me and I discovered when I logged in that everything was open again.

Surprised HN doesn't have more advice on this.