README
 

Hi,

First I'd like to outline something from my README file:If you understand that you could continue reading. I just don't want complains or anything :-)

If you have a question to something plz quote ONLY the relevant part. This issue will be spread to different threads and maybe even different forums. I'll link those together though!

BTW, you CAN'T copy that 1:1 and use it for your system. Like everything else it needs to be adjusted to your system. Just like network config, e-Mail addresses, etc.

BASE INSTALL + MOVING DATA TO SPECIFIC PARTITIONS
 

I'm using Kernel v2.4 since I have some hardware that requires that and of course I want to use iptables. I'll built a customized kernel anyways but it's good to have some default fall-back kernel which supports my netfilter configuration :-)
Now we have everything split up to different partitions. I install self-coded scripts, etc in /usr/local/sbin. All daemons that will be installed chrooted will be under /usr/local/. For instance bind: /usr/local/bind. Remember this is just a BASE IMAGE for other servers. After securing the base image you can use that to set up new servers quickly ... you have to adjust AIDE, etc configuration for each server of course.

getting rid of not required software
 

A secure system should have as few as possible software on it. Like you don't need a compiler or anything on it (and you shouldn't have). Or would you like to provide an attacker with a full-featured tool set?You might need DHCP and PPP stuff so remove only those you don't really require.

configuring apt & installation of additional software
 

Before we can install the software we need configure APT:You wonder why I moved the temporary directory away from /tmp? Well apt-get relies on execution of scripts and since /tmp is noexec you do not have the chance to execute there, ergo we need to move it to a new path.

Now we can install the software we require:You might not need traceroute, mutt or dump. So install those only if you require those!

what's next ?
 

Next step to take is to install grub!

more additional software (configurtion required though)
 

Well now you have a nice bootloader and next step is of course to install some more software. Replace EXIM with a more performant MTA, etc:Now everything for the bare base system is installed. Configuration is not done yet though (except for the ones that got freshly installed and don't have a lot of configuration lines). Remeber: this needs to be ADJUSTED TO YOUR SYSTEM.

Next things to do:

• adjust syslog configuration
• customize deluser, logrotate, etc
• configuring postfix 2
• configure netfilter firewall
• built grsecurity-patched kernel and implement features
• configure logcheck
• check if mount points are still available
• check free space left on partition base
• backup defined files/dirs to FTP-server
• installing, configuring and adjusting AIDE

It's time to put up some restrictions:Whou should be permitted to use cron? Nobody by default:As you know you should run with the minimum number of services and you should have a minimum of ports open, so disable not required stuff:Inactive users should not be tollerated for a big time. Just think of somebody SSHing remotely to the server, gong outside for a beer and leaving SSH open forever ... this shouldn't be the case but it happens. Kick idle users after 60 seconds:

Now you should set up some kind of policy and have every admin sign it. At the system you could use something like:

Now that the whole system has been properly configured and secured it's time to secure all permissions:Now you need to reinitialize the AIDE databases like described in this thread!

markus,

/var/tmp defaults,nodev,nosuid

Why no noexec? Also, why do you need two temp filesystems, why not /tmp and have /var/tmp symlink?

- timestamps as defined in RFC1323
net/ipv4/tcp_timestamps = 0

- window scaling as defined in RFC1323
net/ipv4/tcp_window_scaling = 0

Is there a specific problem with theses? Did quick search (just looked at the first couple from google,) and didn't see too much, at least not a explaination. Is timestamping expensive, do either lead to a DoS, give out too much info, or is it just plain good form (not using what you don't need)?

Thanks,
chris

Oh, and good show. Nice to see stuff like this.

Thanks again,
chris

noexec because of /tmp attacks. remember tmp is writeable by EVERYBODY. i know that you can circumvent that and it offers no real protections but at least it will keep pretty lame people (= script kiddies) out. they'll play somewhere if their stuff which requires /tmp to be exec doesn't work.

regarding /var/tmp and /tmp:
Well there is not really a problem with this. It's tuning to be honest. But it also defeat's Nmap's uptime detection AFAIK. I can't remember the docs I got that from ... but a google search higlighted it again:

http://linuxperf.nl.linux.org/general/kerneltuning.html
http://ruka12.tripod.com/performance.html


Regarding tcp_window_scaling:
http://www.checkpoint.com/techsuppor...rformance.html

Well, it looks a little bit short and misses a lot of explanations (e.g. that the desktop user should be in group docs).
You probably might want to check this part of your /etc/motd with your lawyer first, too :)

For more in-depth coverage I suggest to read the Securing Debian Manual.

Well I shouldn't call it HOWTO. I should call it "changelog", cause that is what it REALLY is. It focusses on using Debian as a SERVER without any GUI!

Probably :-)