Your Server

Whats steps would you do to secure your linux server?

would anyone recommend to be what you do to secure your server? commercial server in particular.

Public Comments

1. Information on securing your Linux server is readily available on the web. They can be something as simple as changing the root password or disabling suid. More information available here: http://www.linuxdevcenter.com/pub/a/linux/2006/03/23/secure-your-server.html http://tldp.org/LDP/lame/LAME/linux-admin-made-easy/security.html http://www.sitepoint.com/article/secure-linux-server
2. A commercial server? You hire a linux expert to do it. If you want an amateur to do it, check in magazines like "Linux Format or Linux Magazine" (both from Europe) for their various articles on securing linux.
3. Depends on what you mean by 'secure'. Do you mean in terms of the network? Recoverable data on the HD? Console logins? You could go overboard with this stuff, but equally, a few simple steps can make your machine fairly safe. If you're just wanting to make a new machine relatively safe on your network, run 'nmap -O localhost' to see what other machines can see. Disable anything you don't 'need' (could be as simple as chkconfig. Disable anything that doesn't use encrypted sockets (if that's important to you) - e.g. use ssh instead of telnet. Look at hosts.allow and hosts.deny and what you've configured as a gateway. Disable remote root logins. Also, look at your users (by which I mean actually dig around /etc/passwd). Do you have any that don't have a secure password set and a shell specified? Check your nfs shares... Check for .rhosts files in home accounts. Have a dig around xinetd.conf - do you need all of those services? It's endless. There's bound to be a checklist out there somewhere, but if the machine's secure 'enough', then that's fine. For example, in work I have full trust in my company's firewall, and none of my machines have anything worth worrying about on them (and the only people that have access are other code monkeys), so I open them right up - I can log in as root, telnet, etc. That's completely secure for this environment imho.