CyberPatriot Linux Security Checklist
Uploaded by
Zayd YaeeshCyberPatriot Linux Security Checklist
Uploaded by
Zayd YaeeshCommon questions
Powered by AISetting group policies in the /etc/group file ensures that only authorized administrators have elevated privileges, thereby minimizing unauthorized access. Similarly, modifying sudoers configuration to require password authentication and avoid NOPASSWD entries reduces the risk of privilege escalation. These measures collectively safeguard the system by strictly controlling user permissions and authentication .
Restricting SSH configurations enhances security by minimizing risk factors such as unauthorized root access and potential credential exposure. Recommended settings include 'PermitRootLogin no', which prevents remote root logins, and 'PasswordAuthentication yes', which assures that only users with valid credentials can log in. Additionally, 'Protocol 2' ensures the use of a more secure protocol version .
Automatic updates ensure that the system receives and applies security patches and updates regularly, reducing vulnerabilities and protecting against threats. The key steps to configure it include accessing System Settings, navigating to 'Software & Updates,' and then setting the system to automatically check for and apply important security updates .
MySQL configurations such as restricting remote access ('bind-address=127.0.0.1'), disallowing unsafe file operations ('local-infile=0'), and removing anonymous users enhance security by limiting who can access the database and what they can do. These measures prevent unauthorized entries and potential data breaches by ensuring only known users with proper credentials can interact with the database .
Disabling IPV6 can enhance security by preventing certain IPV6-specific vulnerabilities and reducing attack vectors on a system not configured to use or monitor IPV6 traffic. The necessary steps include editing the sysctl.conf file to include 'net.ipv6.conf.all.disable_ipv6 = 1' and similar lines for default and local options, thus fully disabling the protocol and protecting the system .
Disabling dangerous PHP functions such as 'exec', 'shell_exec', and 'system' mitigates the risk of remote code execution vulnerabilities. The recommended configuration, added in /etc/php5/apache2/php.ini, sets 'disable_functions=exec,shell_exec,passthru,system,popen,etc.' to prevent these functions from being exploited by malicious users, thus enhancing the security of web applications running on the server .
Critical components include setting 'ServerSignature Off' and 'ServerTokens Prod' in the apache2.conf file, which hide server version details from error pages and HTTP headers. This obfuscation prevents attackers from gaining information about the server software, thereby reducing the likelihood of targeted attacks based on known vulnerabilities of specific server versions .
The sysctl.conf file allows setting kernel parameters to prevent network-level attacks. Configurations like 'net.ipv4.conf.all.rp_filter=1' enforce reverse path filtering, mitigating IP spoofing. 'net.ipv4.tcp_syncookies=1' helps protect against SYN flood attacks by using SYN cookies. Enforcing these settings strengthens the system's defense against common networking threats like IP spoofing and denial-of-service attacks .
Editing the lightdm.conf file enhances security by disabling guest login and hiding user lists from the greeter screen, reducing the surface for unauthorized access. Configurations such as 'allow-guest=false' and 'greeter-show-manual-login=true' enforce these security measures by ensuring only authenticated users can attempt login .
Regularly reviewing and managing cron jobs is crucial as they can be exploited to run unauthorized scripts or malware if misconfigured. Checking directories like /etc/cron.* and individual user crontabs ensures only authorized jobs are scheduled, thereby preventing attack vectors like persistent backdoors or unauthorized data exfiltration, which can compromise system integrity .