Server Security

Learning outcomes:

  • Able to Monitor users, apps, ports, traffic settings and logs
  • Describe server hardening steps and best practices
  • Able to create and edit scripts for common security concerns

Would you like to download my PowerPoint to follow along?

  • Server Health Monitoring
  • System Hardening
    • Lock down your hardware (USB booting) and BIOS password lock
    • Check your file system for anomalies (Missing partitions/cmds)
    • Check your repos/PPA, do you still need them all?
    • Check your installed programs/services, are they up to date? Patches? Stil required?
    • Check ports and protocols (SSH access)
    • Root login check (Do you need it enabled?)
    • Is your system up to date and patched?
    • If your system as SELinux, enable it if possible
    • User password rules
    • Log monitoring and auditing
    • Backups
    • Check for Rootkits
    • Now with Handy Checklist!
  • Least Privilege
    • Policy of least privilege
      • What can we do to limit user access?
      • What should/shouldn't we do as server admins to limit access
    • Security policies in general
      • Patching, user education, audits, password policies
    • Security implementation
      • How are we enforcing our policy?
  • IDS vs IPS
    • IDS
    • IPS
      • Intrusion Protection System
      • Accepts or rejection of packets based on rule sets, active traffic control
      • Needs updates based on new threat data
      • NO humans required to run once it's setup as long as it's updated regularly
      • Can do an alarm, but can also take down intruders
  • Vulnerability Scanning
    • Find your attack surface
    • Automate security audits
    • Help create a prioritized list of vulnerabilities
    • Easier to keep up to date and run quickly
  • End Point Protections
    • Goal is to protect enterprise data even in the case of BYOD
    • Endpoint refers to the endpoint of the network, such as things outside the firewall
    • Client-Server model,Can be centrally managed server, or a SaaS (Software-as-a-Service) type solution
  • Scan types in general beyond server vulnerability scanning
    • Realtime vs preset time scans
    • Signature vs behavioral/heuristic
    • Scan inbound/outbound traffic or both
    • Support and uptime requirements must also be taken into consideration when scanning
  • Logs
    • We track things like Application, event, service and system logs
    • How long are the logs kept? And how do we do log rotation
    • How and when do we review the logs?
    • Log Analysis scripts vs 3rd party tools
    • Log audits and backups
    • Save on write only media (such CD) or mount to different network (So they'd have to hack 2 networks)
    • Hash log files to check for changes
    • How to check Linux logs
    • Some examples of Linux Specific logs:
      • /var/log/messages - generic system activity logs
      • /var/log/auth.log - authentication related logs
      • /var/log/boot.log - system initialization and boot related info
      • /var/log/dmesg - Hardware and driver logs
      • /var/log/kern/log - kernel related logs
      • /var/log/faillog - failed logins
      • /var/log/cron - cron job logging
      • /var/log/yum.log - log of installs
      • There are also logs for mail services, Apache, MySQL and more.
  • Dashboards
    • But what happens if we have too much information? That's where Dashboards come in.
    • Know what's happening in real time
    • Get alerts for things you specify
    • Get real time data visualized
    • Collect multiple forms of data
      • Pcap
      • Text
      • Logs
    • Files, directories and more
    • Business analytics
    • Troubleshooting
    • Overall view of your server
  • Best Practices and Checklists

Suggested Activities and Discussion Topics:

Would you like to see some more classes? Click here