Difference between revisions of "Security"
Threesixes (talk | contribs) (initial commit) |
Threesixes (talk | contribs) m (more details) |
||
| Line 1: | Line 1: | ||
Security is a complex topic, here we will try to make things easier to decipher and understand. This page will go from zero to tin foil hat. | {{PageNeedsUpdates}} | ||
Security is a complex topic, here we will try to make things easier to decipher, and understand. This page will go from zero to tin foil hat. | |||
Understanding the concept of nesting is essential when drawing up your security plan. Disable all unnecessary services, uninstall all unnecessary software, disable all unnecessary kernel options, set useflags to -useflag to cut cruft down in sources, pass data through other servers performing specific functions like firewalling, or caching that will obfuscate the source of data. Data integrity requires off site backups so floods, power outages, wars, etc do not compromise your datas existence. Encrypt your drives so if they are physically taken your data is safe. Sign messages with gpg, use ssh instead of telnet, create ssl certificates | Understanding the concept of nesting is essential when drawing up your security plan. Disable all unnecessary services, uninstall all unnecessary software, disable all unnecessary kernel options, set useflags to -useflag to cut cruft down in sources, pass data through other servers performing specific functions like firewalling, or caching that will obfuscate the source of data. Data integrity requires off site backups so floods, power outages, wars, etc do not compromise your datas existence. Encrypt your drives so if they are physically taken your data is safe. Sign messages with gpg, use ssh instead of telnet, create ssl certificates. Monitor logs for malicious activity. If possible the last layer of security should be once all systems are broken and compromised, do not have anything of value or important going on with the system. separating computing tasks in the network over several computers helps to this end. corporations have email servers, web servers, routers, so on so forth. | ||
=== Physical Security === | === Physical Security === | ||
If someone can take your system, your going to have a bad day. anchor your system to | If someone can take your system, your going to have a bad day. anchor your system to permanent structures, such as rack mounting. have security cameras, and locked doors. | ||
=== Software Security === | === Software Security === | ||
install sudo, make a wheel fake root user with an arbitrary name, and disable the root account with passwd -e -l | *install sudo, make a wheel fake root user with an arbitrary name, and disable the root account with 'passwd -e -l'. Use {{c|sudo -i}} to access root, or even setup terminals to run sudo -i when they start, add the fake root user to the root group. Attackers now have to guess the fake root user name also, not just the password. | ||
install a syslog | *install a syslog | ||
install nftables | *install nftables | ||
install sshguard and have it watch logs for multiple failed login attempts, and block attackers. | *install sshguard and have it watch logs for multiple failed login attempts, and block attackers. | ||
apparmor, tomoyo, and selinux are mandatory access control systems. | apparmor, tomoyo, and selinux are mandatory access control systems. | ||
https://en.wikipedia.org/wiki/PaX | === Random Number Generation === | ||
https://grsecurity.net/ | Random numbers are used for generating ssl keys, gpg keys, ssh keys etc. Predictable numbers, even slightly predictable compromise security. Do not use via or intel hwrngs as /dev/random entropy sources. | ||
*https://en.wikipedia.org/wiki/PaX | |||
*https://grsecurity.net/ | |||
Revision as of 05:53, May 30, 2015
Security is a complex topic, here we will try to make things easier to decipher, and understand. This page will go from zero to tin foil hat.
Understanding the concept of nesting is essential when drawing up your security plan. Disable all unnecessary services, uninstall all unnecessary software, disable all unnecessary kernel options, set useflags to -useflag to cut cruft down in sources, pass data through other servers performing specific functions like firewalling, or caching that will obfuscate the source of data. Data integrity requires off site backups so floods, power outages, wars, etc do not compromise your datas existence. Encrypt your drives so if they are physically taken your data is safe. Sign messages with gpg, use ssh instead of telnet, create ssl certificates. Monitor logs for malicious activity. If possible the last layer of security should be once all systems are broken and compromised, do not have anything of value or important going on with the system. separating computing tasks in the network over several computers helps to this end. corporations have email servers, web servers, routers, so on so forth.
Physical Security
If someone can take your system, your going to have a bad day. anchor your system to permanent structures, such as rack mounting. have security cameras, and locked doors.
Software Security
- install sudo, make a wheel fake root user with an arbitrary name, and disable the root account with 'passwd -e -l'. Use
sudo -ito access root, or even setup terminals to run sudo -i when they start, add the fake root user to the root group. Attackers now have to guess the fake root user name also, not just the password. - install a syslog
- install nftables
- install sshguard and have it watch logs for multiple failed login attempts, and block attackers.
apparmor, tomoyo, and selinux are mandatory access control systems.
Random Number Generation
Random numbers are used for generating ssl keys, gpg keys, ssh keys etc. Predictable numbers, even slightly predictable compromise security. Do not use via or intel hwrngs as /dev/random entropy sources.