{"id":6408,"date":"2019-04-16T02:30:08","date_gmt":"2019-04-16T07:30:08","guid":{"rendered":"https:\/\/www.poweradmin.com\/blog\/?p=6408"},"modified":"2019-04-16T14:25:50","modified_gmt":"2019-04-16T19:25:50","slug":"toughening-security-for-linux-servers","status":"publish","type":"post","link":"https:\/\/www.poweradmin.com\/blog\/toughening-security-for-linux-servers\/","title":{"rendered":"Toughening Security for Linux Servers"},"content":{"rendered":"

By Des Nnochiri<\/strong><\/span><\/p>\n

\u00a0<\/p>\n

As with any other operating system, security is a prime concern with Linux network hardware. In this article, we\u2019ll be giving some recommendations on how to toughen the security posture of your Linux servers. Screenshots and example syntax relate to systems running Kali Linux, CentOS, RHEL, Ubuntu, and Debian-based Linux distributions. <\/span><\/p>\n

\u00a0<\/span><\/p>\n

Encrypt Data for Greater Information Security<\/span><\/h2>\n

\u00a0<\/span><\/p>\n

Unencrypted or plaintext data held at rest or in transit across a network is vulnerable to packet-sniffing and extraction. At the very least, data in transit should be scrambled or encrypted, using a strong encryption protocol with keys and\/or digital certificates. <\/span><\/p>\n

\u00a0<\/span><\/p>\n

File transfers should be executed under secure protocols such as scp, ssh, rsync, or sftp. OpenSSH, SFTP, or FTPS (FTP over SSL) add Secure Sockets Layer (SSL)\u2014or Transport Layer Security (TLS) encryption\u2014to the standard file transfer protocol (FTP). Using special sshfs and fuse tools, mounting a remote server file system or your own secure home directory is also possible.<\/span><\/p>\n

\u00a0<\/span><\/p>\n

You can use the following syntax to remove outdated file transfer services such as NIS or rsh from your system:<\/span><\/p>\n

\u00a0<\/span><\/p>\n

# yum erase xinetd ypserv tftp-server telnet-server rsh-server<\/span><\/strong><\/p>\n

\u00a0<\/span><\/p>\n

On Debian- or Ubuntu-based Linux servers, the apt-get or apt commands may be used to eliminate insecure services:<\/span><\/p>\n

\u00a0<\/span><\/p>\n

$ sudo apt-get \u2013purge remove xinetd nis yp-tools tftpd atftpd tftpd-hpa telnetd rsh-server rsh-redone-server<\/span><\/strong><\/p>\n

\u00a0<\/span><\/p>\n

For data at rest, most Linux distributions will allow you to encrypt your hard drives before installation. On Kali Linux, choose the options \u201cGuided-use entire disk\u201d and \u201cset up encrypted LVM\u201d to set up your encrypted logical volume manager.<\/span><\/p>\n

\u00a0<\/p>\n

\"\"<\/a><\/span><\/p>\n

\u00a0<\/p>\n

(Image source: <\/span>Network World<\/span><\/a>)<\/span><\/p>\n

\u00a0<\/span><\/p>\n

Isolate Network Services <\/span><\/h2>\n

\u00a0<\/span><\/p>\n

To limit the number of other services that could be compromised by a security breach, Linux administrators should run different network services on separate servers or virtual machine (VM) instances. Virtualization software such as OpenVZ may be set up as a separate install on RHEL and CentOS Linux distributions.<\/span><\/p>\n

\u00a0<\/span><\/p>\n

To further secure your host network on Kali Linux, you can take the following steps:<\/span><\/p>\n

\u00a0<\/p>\n