Locking down a neglected box

bsmntbombdood · 02-10-2006, 05:31 PM

I have been running a Linux box for about half a year, and in thinking that it would always be just me using it, I've done some stupid security stuff with it. Yes, changing permissions of some files in /etc to 777. Now I need to give untrusted users access. Should I chown -R root /,chmod 700, then change what I need back to my user?

Also, are there any other steps that should be taken to prevent attacks from users?

win32sux · 02-10-2006, 06:31 PM

what distro?? what kernel??

what kinda access will the untrusted users have??

i'd say reinstall everything if possible, and then start the hardening process... you might wanna think about something like grsecurity, or selinux... you also might wanna install some kinda file integrity checker, like tripwire or whatever... set it to email you reports at least once a day, etc...

bsmntbombdood · 02-10-2006, 06:37 PM

Sorry I didn't include this, it's Debian testing/unstable with linux kernel 2.6.12

win32sux · 02-10-2006, 06:46 PM

Quote:

Originally Posted by bsmntbombdood

Sorry I didn't include this, it's Debian testing/unstable with linux kernel 2.6.12

well, the first thing i'd do if i was you is downgrade to STABLE...

a tripwire package is available... as for stable's kernel, i don't know if it is built with selinux support or not...

you might also wanna look into bastille, as it's a hardening tool which is also educational and stuff...

BTW, a nice tool for log file monitoring is logwatch...

unSpawn · 02-11-2006, 03:09 AM

Since you run an ancient & vulnerable kernel and have fscked up the system I'd vote for reinstalling Debian STABLE from scratch. This way you have a more solid basis to start hardening from. Next to Win32sux' other advice please check out the LQ FAQ: Security references.