imthenachoman

From what I can tell, their images are only for the big three cloud providers.

I am in the process of going through one of their benchmarks right now. They have some good stuff but I'm on page 130 of 431 and so far I haven't come across anything that needed to be changed from a standard Debian install.

Holy crap! I did not see those two on Reddit. I had posted to Reddit and was monitoring those comments but didn't know of these. Thanks! Although, I'm sad both of those threads got more comments then the original one I posted. Not that it really matters in life. Heh.

And yes, I saw that pull request but I didn't know what HN was at that time. After I saw that comment, and before they said HN = Hacker News, I started Googling around to see if I could find where my repo was being mentioned. That is how I found this post in HN.

Thanks!

The goal is to cover as many things as possible, not everything. Security is a very deep and complex topic -- no single document can cover everything. I want to wet the readers appetite to get them interested enough to learn more.

Thanks for that link -- never seen it before.

I was an SA for a Fortune 10 company for 5+ years supporting 150k+ servers but we don't need to get into comparing resumes here. I appreciate your time and don't want to waste more of it. However, if would like to continue the discussion maybe we can do it on GitHub? I don't care for HNs commenting style. Thanks!

Got it. Thank you!

Got it. Thanks!

This is great feedback! Thank you so much.

I simplified things that would be too heavy to get into. The guide is not intended to teach everything about security -- that would be too much. The goal is to cover enough to give the reader a high level understanding. Once they have a basic understanding they can research more if they desire.

Can you tell me some of the "exotic details where defaults would be sane enough"? I can amend the guide.

Are you saying a public key can be used to decrypt data it encrypted? Or are you saying a public key could also be used to decrypt data that the private key encrypted?

You mention "server room". This guide is intended for a person running a simple server in their home. Hopefully SAs securing a large scale environment are not using information from GitHub. :/

I made some other updates to the guides that I hope address your other concerns?

Regarding your distribution agnostic comment, I do not see value in distribution specific guides on hardening. Sans a few edge distributions, most distributions are similar enough that the hardening steps are the same. It is okay to look for distribution specific documentation on how to install the distribution but it hurts the cause having distribution specific hardening guides.

Also, I want more folks to use Linux. Most distributions are so similar there is no value in having so many distribution specific guides -- all it does is create unnecessary confusion and steer potential prospective users away from Linux.

Good idea. I need to figure out how to work that in into the guide. I added to the to-do list. Thanks!

I don't disagree but you gotta start with the basics. SELinux can be rather advanced/complex and probably warrants its own guide. I still have to learn it better before I try to write a guide on it.

It is on my to-do list. :)

Authy's mobile app should work with Google's TOTP PAM module.

When I was researching, literally every article I read mentioned Google'S TOTP PAM module. I can't even find any other ones that have active development. Do you know of any? Would love to use another one if it works with my iOS authenticator app.

You're welcome. Glad it helped someone!

How would you define a production server? Do you mean in the context of a home server or a server used by a large company? The guide is intended for a server for home use. I hope anyone securing a large corporate server is not using information on GitHub. If they are then the company has far bigger problems than security.

I think for home use, ufw is probably good enough. I've been using it for 3+ years and it's worked out okay for me okay.

I have not heard of ferm but I will check it out. Thanks!

A pass phrase on a certificate is two step. Password + TOTP is two factor.

Interesting. I have never read that anywhere. I will research. TY!

LAN IPs or WAN IPs?

If you're using public/private keys you can use the "from" option for the keys. But it's not fool proof.

Thanks for the idea on port knocking. I always forget about it. Will look into it more...

Agreed. The guide is intended for a home server. Anything more and you'd need a more robust network with dedicated firewalls and a DMZ, etc....

Can you use Tripwire for free for home/consumer stuff? And what does RPM verification do? Just make sure all the packages you have installed are legit?

I have a need to be able to SSH to my server from unknown sources, like my friends house or something. And VPN just moves changes the open port so no real benefit there. I agree on the firewall...

I am not familiar with namespaces in this context? Can you please point me in the right direction? I have added AppArmor to my to-do list. I know what chroot and setuid are, not sure what to mention about them in the guide? And I will look into unix sockets.

Can you recommend any good network scanning tools? I've been on the hunt for a good one.

Would you mind pasting the output of `deborphan` showing those two or creating a new issue on my GitHub page? I want to show it to the author of `deborphan` to see if he knows why its happening.

https://github.com/imthenachoman/How-To-Secure-A-Linux-Serve...

I have never had issues with it but now you have me worried. I added a warning to the guide and will do some research.

Always. Google gives me 5 thousand pages of ads before the results I want. I hate to admit that sometimes I still use Google for searching. Like I love their shopping search.

So I use a separate gmail account for my server but forgot to mention in guide. I will add it.

Although I wonder if its necessary if you use an app password. What is the worst a bad-actor can do with the app password?

There is a balance to be had here. In a high volume, sensitive environment you'd run your own mail server. But that is a challenge in-and-of itself. I don't recommend it for a home setup because there are numerous things to worry about like MX forwarding and what happens if your server goes down -- where does the e-mail go? Granted, using Gmail means if your server is compromised the bad-actor would have your gmail password which is why I recommend enabling 2FA/MFA on Gmail and then using an app password. Check http://reddit.com/r/selfhosted if you want to self-host mail.

Hey folks! I am the author of this guide. I did not know this was here or I would have commented sooner.

This is my first time putting a guide like this together. I see a lot of really great feedback and I will be incorporating them into future updates.

I don't have time today but I will reply individually to all the comments that I can.

I appreciate any/all feedback/advice. If possible, could future issues be submitted to GitHub because it is easier for me to manage if everything is in one place. https://github.com/imthenachoman/How-To-Secure-A-Linux-Serve...

But right now I need to find all the other places this guide is linked to with comments so I can address them too. :)