Linux - SecurityThis forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
I have a server that's only function is to run a vsftp server for people to send us files on. Below is an rpm -qa that's sorted alphabetically, are there any things in this list that should probably be removed for security purposes, that wouldn't affect the ftp servers functionality? We only access it from the CLI, if that helps. I dont know what 99% of the items in this list are so i'm not sure even where to start.
I have a server that's only function is to run a vsftp server for people to send us files on. Below is an rpm -qa that's sorted alphabetically, are there any things in this list that should probably be removed for security purposes, that wouldn't affect the ftp servers functionality? We only access it from the CLI, if that helps. I dont know what 99% of the items in this list are so i'm not sure even where to start.
I honestly think that this is an opportunity for you to learn what all of these components do and make up your own mind about whether each one is necessary. You are asking someone here to do a lot of work. That's a lot to ask.
A lot of system administration work involves long complicated steps. I think that you should simply look up each of the components and find out what they are and what they do. Then if you decide to remove any of them you will learn whether that component was critical or not when you restart the computer.
My initial impression is that there is very little fat to trim in that list. I probably wouldn't remove any of them.
You absolutely SHOULD look at the user account list and remove unnecessary ones. However that is another research project. You might be surprised if you remove the nobody account, or example, and find that something stops working, like updatedb for example.
Thanks for the tip. I wasn't really looking for someone to go through one by one, i was more hoping for a general response like you gave. I am starting to research them all.
Distribution: Fedora 18, Slackware64 13.37, Windows 7/8
Posts: 386
Rep:
My company uses dozens of S/FTP/SCP servers and if there's one recommendation I can make it's this: Go download a server only OS without a desktop/window manager. We're currently running Ubuntu 9.10 minimal server edition which comes with literally nothing but the kernel and base packages. The only thing we install on it is vsftpd, ssh, acl, and some pam modules. Going that route eliminates all those extra threats that come with running a multi-purpose machine.
RHEL - and its derivative distros - is a fantastic OS, but even a minimal package install throws in some cruft that is not necessary for a single-service server. I recommend firing up an installation in a VM, and using it as a test bed for learning about packages (manpages will be helpful to read as you go along) and dependencies.
Alternatively, there are other OSes that simply don't install everything and the kitchen sink by default. One (non-Linux) example is FreeBSD.
Thanks. From what I'm told all the servers I've inherited were mostly installed with whatever was the default, so i'm guessing some of them have fluff on them that isn't needed.
Distribution: Debian /Jessie/Stretch/Sid, Linux Mint DE
Posts: 5,195
Rep:
Quote:
Originally Posted by rjo98
Thanks. From what I'm told all the servers I've inherited were mostly installed with whatever was the default, so i'm guessing some of them have fluff on them that isn't needed.
You should not care too much about that. Make sure X doesn't start, and you almost have a lean system. You shouldn't care about whether foo or bar is installed or not. All those packages take up little space, and no CPU time. Even a full GUI installation with OpenOffice and all is about 4 GB, that is not something to worry about in 2011.
My personal recommendation is Debian, and don't install any 'typical' systems if you are offered the choice. Bare Debian is very lean, doesn't even include less or ssh. If you are a serious RedHat person, stick with RedHat. Altough Debian is much better than RH (hehe just kidding) it won't pay back the additional time you have to spend to unlearn RH and learn Debian policy.
Yes you should. Generally speaking the less "moving parts" are installed the smaller the attack surface (ranging from deemed-unsafe-for-use applications like any r.* services and use to misconfiguration to current vulnerabilities and ones yet to discover) and easier auditing, hardening and maintenance will be.
Quote:
Originally Posted by jlinkels
Make sure X doesn't start, and you almost have a lean system.
A headless, single purpose FTP server does not require development tools and X11 / Xorg to be installed.
Quote:
Originally Posted by jlinkels
You shouldn't care about whether foo or bar is installed or not. All those packages take up little space, and no CPU time. Even a full GUI installation with OpenOffice and all is about 4 GB, that is not something to worry about in 2011.
The "don't care" / "don't worry" reply is something we should guard against in almost all (security-related) issues as it avoids addressing facts or situations as presented and ultimately leaves the OP with no method to determine if it is an issue or non-issue for himself. Unnecessarily so as, unlike fuzzy human communication and behaviour, computing is binary in that it does not require interpretation: something either is or it is not. I hope you understand and agree.
Distribution: Fedora 18, Slackware64 13.37, Windows 7/8
Posts: 386
Rep:
Quote:
Originally Posted by rjo98
I was looking more to eliminate any unnecessary things as to lessen the areas that a possible attacker could get in.
That's the point @unspawn is making. Disabling services and preventing X from starting only marginally reduces your attack surface. If they exist on the machine then they can be enabled or turned on and exploited. Better to start out with essentially a single attack vector and try to secure it: the kernel, the tcpd, and the ftp server. That's a lot easier to monitor than 100 other services all with their own unique (potential) vulnerabilities.
I've got a few FreeNAS servers running actually, but I'd have to recommend installing it to hdd or flash drive because when its running off CD the admin web page takes EONs to process GET/POST requests (well at least it does on my PII 450 MHZ server)
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
