Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Focus-Linux
[Top] [All Lists]

Re: Linux hardening

Subject: Re: Linux hardening
Date: Wed, 24 Aug 2005 01:11:58 -0400
On Sunday 21 August 2005 08:13, AragonX wrote:
I'm looking for more preventative measures.  It appears that LIDS and
mod_security are the only ones in that role now.
I recommend tuning php and disabling commands like system and passthru that 
may be used by an attacker but are probably not going to be used by you. I 
like to think that no webpage or script can be trusted even when I am the 
only person with access to a machine. 

Many people have recommended mounting /tmp and /var/tmp noexec. This is a good 
idea but keep in mind that it is easy to execute commands even on a noexec 
filesystem (using the ld-linux library). So don't be surprised if some 
slighly clever attacker is running a binary from that location.

Oh yea, and use strong passwords! I have a couple of production machines that 
get hit by (sometimes) thousands of password guessing attempts per day.

Craig

-- 
KMail: 1.7.2
Linux Weltall 2.6.11.3 #4 Sun Mar 27 11:04:56 EST 2005 i686 AMD Athlon(TM) XP 
1700+ AuthenticAMD GNU/Linux

<Prev in Thread] Current Thread [Next in Thread>