Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Ahead With Linux Security Features
identity management security tactics For years, we secured our Linux infrastructure by building walls: VPCs, security groups, and hardened SSH configurations. We treated the cloud like a virtual data center, assuming that if we kept the "bad guys" out of the network, our workloads were safe. . That model is no longer sufficient. Today, one of the most common paths from an initial compromise to a major cloud breach is the identity assigned to your Linux workload. When an attacker gains code execution on a Linux instance—through a...
Jul 17, 2026
security practices patch management Most of us don't hear about a kernel vulnerability until a CVE lands in our inbox or the vulnerability scanner starts complaining. By then, the patch isn't new anymore. Kernel developers may have been passing it around for review, arguing over the implementation, or revising it for days before anyone outside that community noticed it. None of those discussions are secret. They're sitting in mailing list archives, Git commits, and patch reviews where they've been the whole time. The strange...
Jul 14, 2026
Linux security cyber attacks Every Linux server in your fleet produces thousands of events every minute. From journald logs and auditd records to kernel-level eBPF hooks, your systems are constantly talking. Most of that noise is just the mundane churn of system services, CI/CD runners, or routine administrative automation. But among that noise, an attacker might be establishing a foothold, moving laterally, or setting up persistence. The challenge for any security team is: how do you separate the routine from the...
Jul 13, 2026
open-source infrastructure risk Security scanners flag exposed API keys in public repositories every day. The initial response is usually predictable: delete the commit, revoke the credential, and move on. That’s a mistake. . In a real Linux environment, an API key never stays in one place. By the time it hits a public repo, it’s already everywhere. It’s in the CI/CD pipeline. It’s in your container registry. It’s in the build logs. It’s in the backups. Git makes this worse because the history never dies. Deleting a file in...
Jul 11, 2026
open-source rootkit Most of us think of Linux rootkits as ancient history—the stuff of 90s hacking forums and clunky malware that would crash your system if you looked at it the wrong way. But if you think they’ve gone away, you’re mistaken. They’ve just gotten smarter. . Modern attackers aren't using the noisy tools of the past. Today’s threats are surgical. Many of today’s most advanced Linux rootkits operate at the kernel level or abuse legitimate system features to blend in with normal traffic. They’re...
Jul 09, 2026
Refine features
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security features
We found 6 articles for you...
102
encryptionLinux securityauthenticationMastering SSH for Secure Linux Remote Server Management
Secure remote connections are essential when managing a Linux server, and one of the most widely used and trusted methods for remote server administration is Secure Shell (SSH) . SSH creates a protected channel over an insecure network by encrypting all information shared between the server and client, safeguarding data exchanged between them from potential attackers, eavesdroppers, hijackers, or manipulators of communication streams. . But why is SSH essential for secure Linux remote server connections, and how can we admins maximize its potential? In this article, I'll delve into SSH usage and share best practices for securing SSH. I'll also dispel popular myths regarding security and introduce my top open-source SSH tools, which are available to us all. Are you ready to master SSH for secure Linux remote server connections? Let's get going! Why Is SSH Essential for a Secure Linux Remote Server Connection? SSH (Secure Shell) is a protocol for secure remote management and control of systems. It uses encryption of client/server communication, including user credentials. Regarding security, SSH outperforms older methods like Telnet due to its encryption capabilities, which ensure confidentiality and data integrity over unencrypted communication methods like Telnet. Benefits of SSH for Linux remote server connections include: Encryption: Protects data from eavesdropping. Authentication: Provides robust authentication mechanisms via public key cryptography. Integrity: Data integrity checks prevent alteration during transit. Understanding SSH Key Types: RSA, DSA, ECDSA, and EdDSA SSH keys come in various types, such as RSA, DSA, ECDSA, and EdDSA, each offering its own characteristics and use cases. RSA keys are widely supported and provide excellent security while being relatively slower to implement; however, DSA keys offer comparable levels but tend to have lower adoption rates due to weaknesses. ECDSA keys using Elliptic Curve algorithms offer shorter andfaster options, while EdDSA keys specifically using Ed25519 algorithms are the most modern, secure, and performant of the available key types. Comparing the benefits and drawbacks of different key types, RSA keys balance security and speed but may become slower when more security is necessary. Due to security concerns, DSA keys have limited storage capabilities at 1024 bits and are not recommended. ECDSA keys offer shorter keys with faster operations and increased security, while EdDSA keys, with their superior performance, are considered an ideal solution. EdDSA, specifically its Ed25519 variant, is widely considered to provide an optimal balance of high security, performance, and future-proof cryptographic strength. Best Practices for Securing SSH When using SSH for secure remote access, following certain best practices to maximize security is essential. One such practice involves disabling root login. This prevents attackers from gaining root access and protects the most privileged account from unauthorized use. Furthermore, changing from Port 22 to another port, such as 2222, can obscure SSH access while decreasing automated attacks targeting its default port 22. Strong passwords and cryptographic keys with robust algorithms help protect authentication mechanisms against brute force attacks and other forms of compromise. Disabling password authentication in favor of public key authentication enhances security further. Two-factor authentication (2FA) provides additional layers of protection, combining something you know (password) and something you own (mobile device or hardware tokens for creating one-time passwords). Mobile apps like Google Authenticator , Authy, or hardware tokens can generate one-time passwords in two separate ways. It is crucial to remember that cloud servers require additional SSH security measures. Utilizing security groups to whitelist IP addresses allows control over who can connect via SSH, thus reducing the attack surface by only permitting trustedsources to connect. Automated incident response tools offered by cloud service providers allow real-time monitoring and responding to suspicious activities, thus decreasing the time attackers have to exploit vulnerabilities. Regular key rotation can ensure compromised keys are revoked immediately while protecting access control system integrity. What Are the Top Misunderstandings & Misconceptions about SSH Security? Numerous misconceptions and misapprehensions surrounding SSH security can create vulnerabilities if not adequately addressed. One such belief is the assumption that password authentication alone provides sufficient protection. In reality, public key authentication offers much more robust protection from unauthorized access. Another misperception is assuming SSH default configurations provide adequate security. Instead, it's important to tailor them precisely according to individual needs to maximize system protection against possible attacks. Debunking these misconceptions underscores the significance of adopting more secure practices. Public key authentication provides more robust and practical protection but must be implemented correctly to reap its full benefits. Likewise, using default ports for SSH connections may pose risks as automated attacks target these ports more often. Switching up ports frequently used for computerized attacks to non-standard ports makes it more difficult for attackers to locate and exploit SSH services. Asserting and clarifying misconceptions related to SSH security is paramount for enhancing SSH security while protecting systems against potential threats. Top 4 Open Source SSH Remote Monitoring and Management (RMM) Tools for Enhanced Security SSH Remote Monitoring and Management (RMM) tools are pivotal in maintaining server health and assuring SSH security. They offer visibility into server performance, identify anomalies quickly, and ensure server uptime, all essential aspects of proactive SSH security measures. Among my top open-source RMM tools forSSH security are fail2ban, Zabbix, Icinga, and Checkmk. Fail2Ban is an open-source software tool developed to safeguard Linux systems against brute-force attacks by tracking log files for suspicious patterns that indicate potential security breaches. Suppose it detects too many failed login attempts from a particular IP address or suspicious activities from that IP. In that case, the firewall updates its rules to temporarily or permanently block that IP. This boosts security for services like SSH, FTP, and web servers. Zabbix provides a comprehensive monitoring solution for networks and applications, offering metrics on server health and alert services. Zabbix can efficiently monitor SSH service availability and performance while detecting unusual SSH activities and providing alert services, making it the ideal tool for SSH remote monitoring and management. Icinga is a scalable system that monitors network resources while alerting users of potential issues. It tracks SSH login attempts and user activities to provide insights into possible security breaches, ultimately improving SSH security through informed monitoring. Checkmk is a powerful monitoring tool boasting broad compatibility and extensive features. It enables organizations to closely monitor SSH-related services and performance metrics and address any anomalies quickly—an effective way to manage SSH security. Organizations can significantly expand their capacity for effective surveillance management of their SSH infrastructure by employing such tools. What RMM tools are you using to monitor SSH? Which ones should we add here? Reach out to us on X @lnxsec and let us know! Final Thoughts on Mastering SSH to Improve Linux Server Security SSH is essential for secure server management over remote connections. It provides robust keys and configures servers securely. Employing additional measures like 2FA can enhance its security posture significantly. Utilizing RMM tools like Zabbix, Icinga, or Checkmk helps ensure theSSH service remains secure and operational while offering continuous monitoring and alert capabilities. I highly recommend implementing the above recommendations to protect SSH services and your Linux server. Mastering the principles and best practices I've shared here will prepare you to secure remote server connections while effectively managing your Linux infrastructure. . Explore the significance of SSH for secure remote Linux server connections and best practices for maximizing its security.. secure, remote, connections, essential, managing, linux, server, widely. . Brittany Day
Apr 11, 2025
•
102
data securitybackup solutionsbackup strategiesProtecting Linux Users Against Ransomware: Essential Backup Strategies
Data security in a modern business environment is considered one of the most critical factors for any company. The digitalization of the world has led to more and more data being generated daily, including very sensitive data, such as internal business plans, customer payment data, etc. . The number of data breaches worldwide has been growing at an alarming pace for over a decade now, and it shows no signs of stopping any time soon. New and improved versions of malware and ransomware are being developed regularly, finding all kinds of loopholes in virtual security perimeters for malicious purposes. In this context, it should not be surprising to see cybersecurity becoming the forefront of a company’s development strategy since everyone now understands the cost of a single data breach and what it could do to an unprepared business. The Rise in Linux Ransomware & Its Implications Ransomware has also been one of the most significant cybersecurity issues and a massive headache for practically every IT professional. The primary purpose of ransomware is to find sensitive data to render it inaccessible via encryption – while demanding ransom from the data owner for the decryption key. Since ransomware was not designed to steal data in the first place, it became a massive issue for most traditional security systems not designed with ransomware in mind. Add that to the fact that ransomware has been developing and evolving for over a decade, and it becomes clear why cybersecurity is so important for companies of all sizes. A single unfortunate data breach or ransomware attack can completely paralyze any business. This same average attack can cause days, if not weeks, of issues for large-scale companies, usually resulting in millions of dollars of lost revenue. As if that was not problematic enough, newer versions of ransomware have also started to look for safety precautions such as backups. Suppose there is just one copy of a company’s data that has been made, and it wasencrypted by the same ransomware that affected the original data. In that case, the entire company has a high chance of crumbling instead of recovering. Why Are Data Security & Secure Data Backup Crucial in Protecting Against Ransomware? This is how we arrive at the topic of data security. Data protection is an intense and complex topic, and not all of them are about ransomware protection. However, since it is one of the most prominent threats to an average business, we should start with the basics of protection against ransomware. As mentioned, backups are usually treated as one of the easiest ways to protect sensitive data for companies and individuals. The act of copying information is simple, does not take much time, and can be an excellent safeguard in case anything goes wrong. Unfortunately, the description above is only suitable for about a decade ago. Modern backup solutions are far more complex and sophisticated than ever, and the same could be said for the average business infrastructure. Not only can businesses store their data on traditional storage mediums such as disks, but storage possibilities can also be found in tape storage, cloud storage, virtualization, databases, and clusters. The drastic increase in complexity for business infrastructures led to an identical rise in backup complexity. In the modern world, a secure data backup represents multiple copies of data stored on different storage mediums. This is what the industry refers to as “the 3-2-1 rule”. Diversification is also a key consideration when it comes to creating and implementing a successful data backup strategy. Admins and organizations are quickly learning the importance of defense-in-depth in any type of security. Configure data backups and perform them regularly, following the 3 2 1 backup rule : keep at least three copies of your data, store them on two different types of media, and keep one copy offsite. This strategy makes it highly difficult for a malicious actor to encrypt and lock up every copyof their target’s data. This rule is not particularly difficult by itself – three copies of data, stored using two different storage mediums, and one copy held in long-term storage in a different geographical location from the rest. This rule is also somewhat outdated, with some professionals pushing for “the 3-2-1-1” rule instead – adding one more copy of data that is held using immutable storage. Storage immutability is not a new invention by far – the concept of data that cannot be modified in any way once it has been written has been around for many years now. And yet, the rise of cybersecurity brought much attention to finding alternative data protection methods, including data immutability. The topic of “locked” immutable data backups was also one of the first solutions to the issue of ransomware learning how to target backups. Of course, only some things in this topic revolve around data backups. Many other methods and tactics are used to lower the chances of a ransomware attack. Data retention is one such example – a combination of best practices and policies created to mitigate the potential damage from a ransomware attack in the future. Multiple best practices can be implemented to mitigate risk, including: Putting more emphasis on complex passwords and password rotation systems. Use separate accounts for backup-oriented tasks while restricting these accounts’ capabilities in terms of everything unrelated to backup jobs. Ensure backup account passwords are appropriately secured or stored in a password vault. Implement a password-changing policy to ensure no past employees can access backups after leaving the company. Both backup jobs and data retention are just the tip of the iceberg regarding ransomware protection measures. Other examples of appropriate data protection capabilities include backup encryption, encryption key management, regulatory compliance, backup testing, and many others. Why Is Ransomware Especially Threatening to Linux Users? The topic of ransomware becomes even more expansive once the Linux operating system is brought into the picture. Most previous examples have been attributed to Windows-oriented software and hardware, but Linux devices differ. Linux is a well-known group of operating systems with an open-source basis . Some of its most significant advantages are extensive customization and a high level of control over the system as a whole. This freedom is one of the biggest reasons why plenty of people choose Linux over Windows as their primary operating system – for personal and commercial use. However, this kind of customization and control over the entire system comes at a cost. If the ransomware succeeds in getting into one such system, it can take control over practically every single file in the OS, including system files. A detailed backup plan is the only option for mitigating these issues. Ransomware has been one of the most prominent threats in the cybersecurity field for a few years now, and it keeps evolving at an alarming pace. The overwhelming majority (about 85%) of ransomware types are only capable of working on Windows devices to this day – but the size of the Linux portion is getting more and more attention as time goes on. It is common for Linux-based systems to store important information, be it sensitive databases, government files, or web services. Linux and Windows have plenty of differences regarding their internal structures, and these differences are some of the biggest reasons why ransomware isn’t as popular on Linux devices. Windows OS uses a specific database type called registry to store its settings and configuration options, and practically any backup must back this data up for backups to be restored properly. On the other hand, Linux OS uses a much more file-oriented approach where both settings and config files are stored within the file system alongside user data. This is an advantage for backup and recovery processes, but it can also be a potential securityissue if some sort of ransomware gets into the system. What Are the Basic Steps in a Linux Ransomware Attack? Since there are not that many different ransomware types on Linux, we can figure out the basic steps that each ransomware has to go through to perform the cyber attack: Infection. Vulnerability abuse is one of the prime gateways for ransomware since it is not as easy to infect a Linux system with ransomware via infected advertising or emails as on Windows devices. As soon as the ransomware gets inside the system, it initiates downloading a hidden executable by “phoning home” via a specific list of IP addresses. Setup . This is where the ransomware sets itself up for the following attack – including changing folders and giving itself more capabilities within the system via permission modification and config modification. This is also where the random encryption key for the following encryption process is generated on the server side. Scan . Ransomware has to find predefined data types or repositories to ask for ransom, and this process revolves around scanning the infrastructure for vulnerable and vital data in accordance with pre-defined parameters. Encryption . The attack itself commences at this step, and it is also the first step on the list that brings in potentially irreversible changes to the infrastructure – creating encrypted versions of existing files and folders and deleting the original file copies afterward. Extortion . The only step left to do after the encrypted data is to ask for ransom by providing explicit payment instructions to the end user in some way, shape, or form. Secure Data Backup is a Universal Concern It is also worth mentioning that some of the best data backup practices apply to both Linux and Windows environments – although their implementation methods might differ. A well-known technique of “air-gapping” is one such feature, allowing for a specific hardware appliance to be wholly isolated from the rest of theinfrastructure, making it a lot more challenging to infect or delete for malicious purposes. The general advice for diversifying backup and security measures is common for all operating systems since backup diversification lies at the core of a proper backup strategy. Combining multiple storage types and security measures within the same system leads to improved security and a higher degree of protection against potential threats. A higher number of different security layers directly correlates with a lower chance of a specific system or infrastructure being breached. Data protection as a topic can be challenging to work with, especially for larger companies with sophisticated infrastructures. Choosing the appropriate third-party backup solution can be a great advantage in this context. A proper complex backup platform would greatly help with various protective measures and tactics for appropriate backup protection. Final Thoughts on Secure Data Backup for Linux Users Data security is an ongoing process that must evolve and adapt to face new challenges. It is easy to see an initial investment in a complex backup solution as a negative factor. At the same time, it is worth remembering that most data breaches and ransomware attacks usually significantly damage a company’s financial situation and reputation more than an initial investment in a sophisticated backup platform. . Cybersecurity threats have escalated globally; discover key methods for safeguarding data backups designed specifically for Linux enthusiasts.. Data Backup, Ransomware Mitigation, Linux Security, Backup Strategies, Data Protection. . Duane Dunston
Feb 01, 2024
•
102
network securityweb applicationphp securityEnhance PHP Security: Best Practices and Mitigation Strategies
Organizations classify Hypertext Preprocessors (PHPs) as the most popular programming language since some of the biggest Internet names use the service in their businesses. PHPs help companies build websites, create applications, and manage their systems. . Although PHP is a powerful language that permits companies to explore their online potential, PHP is not the most secure option available, leaving organizations at risk of cloud security breaches, attacks, and other issues that could destroy a business’s reputation. Fortunately, there are solutions you can implement to strengthen your PHPs against any network security threat. This article will explain PHP’s relevance today, application pentesting , and best practices to utilize when mitigating attacks. How Do Companies Use PHP for Security? Is It Still Relevant? PHPs can still be helpful in security, as they can be relevant when appropriately used to determine what risks you might have in your system. Companies identify cybersecurity vulnerabilities using application pentesting software to simulate attacks in network security through the system. This type of privacy sandboxing can find flaws in company coding that could permit threat actors to take over websites and compromise sensitive data. This solution can find insecure coding, misconfigured settings, broken authentication controls, and information leaks. You can mitigate data and network security issues straightaway when using PHPs to combat hackers. If you're planning to hire dedicated PHP developer teams, ensure they follow these secure coding practices. What Insecurities Do PHP Web Applications Have? Some PHPs have Content Management Systems (CMS) built into the server as an extra level of protection in your system. To strengthen a company, PHPs implement CMS options like WordPress, Joomla, Magento, and Drupal. However, these services sometimes harbor cybersecurity vulnerabilities that allow cybercriminals to bypass security when you use this product. WordPress has networksecurity issues that have increased vulnerabilities from seventy-four to eighty-three percent in just about a year. Fortunately, organizations consistently seek to improve the security posture options they provide to users to ensure they are safe to utilize for users. How Can Application Pentesting Benefit Businesses? As the name suggests, application pentesting focuses on identifying cybersecurity vulnerabilities in your web applications by inspecting your server for necessary patching in cybersecurity. Pentesting can find flaws in coding that could permit attackers to breach your system and steal credentials or data. With this privacy sandboxing technique, you can learn about misconfigurations, broken authentications, access control weaknesses, information leaks, and more within your company. Once you know the risk, you can remediate these exploits in cybersecurity before threat actors get their hands on them. What PHP Best Practices Should I Employ to Strengthen Security? 1. Always use the latest version of PHP Use the latest PHP version since it will be up-to-date with the latest security news so your company can have the features it needs to strengthen online security. 2. Properly configure the PHP.ini file and other requisites Here is how you can tailor your system to your needs by starting with these configurations: session.save_path session.cookie_path (e.g. /var/www/mysite) session.cookie_domain After configuring those settings properly, there are a couple other settings you can edit to keep your PHP application secure. Let's take a look at the checklist below: expose_php = Off This restricts the disclosure of PHP version from being sent in HTTP Headers. When enabled, expose_php tells everyone that PHP is installed on that specific server or system, which includes the PHP version within the HTTP header, e.g (Powered by: PHP/8.1.2). You can do this for any system and works well if you are using nginx. allow_url_include=Off Setting thisto off prevents remote code execution attacks. display_errors = Off This displays whether errors should be printed on the screen to everyone visiting the site. This should be disabled as a best security practice. session.cookie_httponly = 1 Setting this to 1 disables access to cookies via Javascript APIs but use this with caution as you could break something session.use_strict_mode = 1 Setting this to 1 prevents session fixation attacks session.cookie_secure = 1 This requires cookies to strictly transmitted over HTTPS only session.cookie_samesite = Strict Setting this to strict prevents cross-origin attacks session.use_trans_sid = 0 This is not needed so set it to zero session.sid_length = 128 Here, we are setting the length of the session string which prevents brute force attacks session.sid_bits_per_character = 6 This increases the randomness of the session string which also prevents brute force attack file_uploads=off Here, we are disabling file uploads. If anyone needs to upload files, you can set a limit on the size of the files by doing upload_max_filesize = 1M 3. Use up-to-date code dependencies and third-party components, and update your web server! Update your web server to implement up-to-date code dependencies and third-party components, so your cloud security frameworks utilize newly obtained knowledge to prevent exploits in cybersecurity vulnerabilities. If you use Apache Web Server, keep it updated, turn on error logging, add firewalls, set HTTP limits, and only stay active modules. Install mod_evasive, which will maintain running servers even when attacked. An SSL certificate can provide data and network security in online communication. 4. Do not store passwords using reversible encryption Avoid storing passwords with reversible encryption that attackers can easily crack and decrypt for attackers to spy on and track youractivities. Hackers can also enumerate all other passwords if you have a static decryption key. Hash passwords with algorithms like bcrypt, AES, Open SSL, and Argon2. These options are less vulnerable to attacks in network security, making them better password-storing options that will protect your server from data theft issues. 5. Don’t rely on cookies for security Encrypt cookies before relying on them for security since cookies cannot protect login credentials and sensitive data alone. Use network security toolkits like Halite (by Libsodium), OpenSSL, or AES 256-bit with CBC mode encryption to prevent hacking. 6. Validate user input Only process PHP codes once you validate the user input so PHPs can verify forms, URL parameters, and JSON payloads with filter_var() options like the one below. Utilize this coding to prevent Cross-Site Scripting (XSS) and other malicious attacks. function is_valid_email($email = "") { return filter_var(trim($email), FILTER_VALIDATE_EMAIL); } 7. Perform regular security audits Perform web and cloud security audits to identify web application security vulnerabilities so you can utilize security patching to fix them before an attack. Such audits can improve response times and provide more reliable application performances. These web and cloud security scanners can check for Cross-Site Scripting Vulnerabilities (XSS), Cross-Site Request Forgery Vulnerabilities (CSRF), SQL Injections, PHP Code Injection, Cookie Denial of Service Attacks, and Timing Attacks. 8. Use PHP Libraries Use PHP Libraries so your developers can secure applications better for functionality. Consider the following coding options for preparing your server. Final Thoughts on PHP Security Having a PHP in your server is vital to ensuring robust data and network security. Threat actors like to take advantage of exploits in cybersecurity left behind by poor configurations,so be sure to follow the best php cybersecurity practices we discussed here so you can improve your security posture. Regularly perform web and cloud security audits to identify PHP security issues before they become a substantial risk. Incorporating AI-driven security strategies are becoming increasingly important in the proactive identification and mitigation of sophisticated cyber threats, which PHP applications may also need to consider in their ever-evolving security protocols. . Strengthen PHP applications against network security threats with best practices, pentesting solutions, and expert tips.. organizations, classify, hypertext, preprocessors, (phps), popular, programming, language, since. . Brian Gomez
May 09, 2023
•
102
php securityweb serverbest practicesEffective Strategies to Secure PHP on Linux Web Servers for Safety
Running PHP on a Linux web server is a prerequisite for the use of many popular applications such as Wordpress, Joomla and Drupal. Linux administrators and web developers must approach PHP with caution, as new vulnerabilities in poorly written and implemented PHP code are abundant and dangerous. . In a recent security incident, hackers were able to add a backdoor to the PHP source code . Although the backdoor mechanism was discovered before it made it into production, the incident serves as the latest reminder of the importance of prioritizing PHP security. PHP security is inextricably tied to web server security. Because the popular open-source server-side scripting language is often paired with MySQL, PHP compromise can mean a compromise of the accompanying MySQL database, as well as any web applications running on the web server. This article will examine how you can configure and run PHP securely to mitigate the risk of attacks and compromise, secure web applications, protect user privacy and maintain a secure and properly functioning Linux web server. PHP Vulnerabilities Carry Great Risk for Admins Vulnerabilities in PHP code are a prevalent and serious threat to web server administrators and web application developers. These flaws are often introduced when developers are writing code, either due to a mistake or the inability to anticipate malicious hackers’ ever-evolving techniques. A plethora of vulnerabilities exist in the PHP core - with new security bugs being discovered each month. On March 28, 2021, hackers breached the internal PHP Git repository and inserted a backdoor into the PHP source code. Luckily, the malicious code was discovered by Michael Voříšek before it made it into production, and the hack led the PHP team to move source code management operations from its internal Git server to its official GitHub account, which will serve as PHP’s official Git repository going forward. In another PHP security incident that occurred less than three years ago and has yetto be explained today, hackers compromised the official PHP PEAR extensions system website and hosted a backdoored version of the PHP PEAR package manager for almost six months. PHP vulnerabilities can be exploited by attackers to spread malware & take control of hundreds of thousands of web servers in botnets. In one such instance this past year, the infamous hackers-for-hire group DarkCrewFriends resurfaced with a dangerous botnet strategy exploiting an unrestricted file upload vulnerability to compromise PHP servers running websites. In another malicious campaign a year prior, the Neutrino botnet was discovered hijacking servers by taking over other hackers’ PHP and Java web shells to install a cryptocurrency-mining malware . To help you better understand the threats that your web servers and web applications face, let’s take a look at some of the most notorious types of PHP vulnerabilities. A Quick Look at the Most Common & Dangerous Types of PHP Vulnerabilities Threatening Your Web Servers Remote Code Execution (RCE) In this type of vulnerability, a bug in a PHP application accepts user input and evaluates it as PHP code, enabling an attacker to upload code to a website and execute it. This could, for example, allow a malicious actor to tell the website to create a new file containing code that gives him or her full access to the compromised website. RCE vulnerabilities are very serious because they are easy to exploit and grant an attacker full access when exploited. SQL Injection (SQLi) SQL injection (SQLi) occurs when a hacker is able to send instructions to a database and the database executes those instructions. This type of vulnerability occurs when a PHP developer takes input from a website visitor and passes it to the database without reviewing it for malicious code. SQLi vulnerabilities are very serious because they are easy to exploit and often grant full access immediately. Cross-Site Scripting (XSS) Cross-site scripting (XSS) takes place when an attacker causesmalicious code to load in a website visitor’s browser and execute. This code often steals user cookies to grant the attacker administrative level access or performs functions as the user to grant additional access. Cross-site Request Forgery (CSRF) Cross-site request forgery (CSRF) describes a scenario in which a user is tricked into issuing a request that is not in his or her best interest. For instance, an attacker may create a link and trick an administrator into clicking on that link, causing the site to take a certain action such as creating a new ‘admin’ user with a known password. This critical WordPress vulnerability which was fixed in November of 2020 left servers vulnerable to a variety of attacks including cross-site request forgery and cross-site scripting. Authentication Bypass This type of vulnerability is introduced through incorrect validation that a site visitor has the access level required to take a certain action. For example, a developer may wrongly use a function called ‘is_admin()’ - which is designed to indicate if someone is viewing an admin page - to try to validate that someone is an administrator, mistakenly granting non-admin users access to features that only administrators should have access to. PHP Object Injection PHP object injection is a complex attack that occurs when a PHP application takes user input and passes it to the unserialize() function, which takes a stored object and turns it into an object in memory. This type of vulnerability occurs when a developer allows user input to be used in an unsafe way within a PHP application. The unserialize() function must be approached with extreme caution, as this function is commonly exploited by attackers. PHP 7 has includes a new filtered unserialize feature designed to mitigate the impact of code injection vulnerabilities by requiring that developers specify classes that are safe to unserialize. However, it is critical to keep in mind that even with this improvement, passing untrusted input tounserialize() is never safe. Remote File Inclusion (RFI) & Local File Inclusion (LFI) Remote file inclusion (RFI) and local file inclusion (LFI) take place when a PHP application takes user input and passes it to a function designed to load a file. The inclusion of a remote file in a URL is known as Remote File Inclusion (RFI) while the inclusion of a local file in a URL is known as Local File Inclusion (LFI). LFI is often the method an attacker employs to gain access to a WordPress website’s wp-config.php file. Source Code Revelation This type of vulnerability has to do with people being able to see the names and content of files that they shouldn’t be able to view due to the breakdown of a web server’s configuration. The code revealed in this type of vulnerability may list accessible configuration files or contain sensitive information such as database credentials. Session Hijacking Session hijacking occurs when a malicious actor steals a user’s session ID. When a session is set up between a client and a web server, PHP will store the session ID in a cookie on the client side. Sending the ID with the page request provides access to this confidential information, potentially resulting in session hijacking. Session IDs are commonly stolen via XSS attacks, and can also be vulnerable server-side through the use of hosting services that store session information in globally accessible directories. These vulnerabilities in Apache versions 2.4.33-1 and prior - which have since been fixed upstream - left web servers susceptible to session hijacking and an array of other dangerous exploits. Directory Traversal Directory traversal looks for vulnerable websites and causes files to be accessed that the owner did not plan on making publicly accessible. It is also referred to as the ../ (dot, dot, slash) attack, the climbing attack, or the backtracking attack. Tracking advisories is critical in preventing all of these prevalent and serious types of PHP vulnerabilities. Subscribing to ourweekly Linux Advisory Watch newsletter is an easy, convenient way to stay up-to-date on the latest advisories and updates issues by your Linux distro. In addition to tracking advisories, we recommend that web server administrators implement the ModSecurity web application firewall (WAF), which can provide another line of defense against the attacks listed above. The open-source, cross platform WAF has a robust event-based programming language and allows for HTTP traffic monitoring, logging and real-time analysis. Best Practices for Improving PHP Security The majority of attacks on Linux web servers can be attributed to misconfigurations and poor administration. Thus, it is essential that administrators configure their web servers to be as secure as is practical within the construct of their environment. The Open Web Application Security Project (OWASP) , a nonprofit fo undation we trust and admire that works to improve the security of software through community-led open-source projects, suggests that administrators and developers implement these secure PHP configuration recommendations to protect their web servers against dangerous PHP vulnerabilities and prevent attacks. LinuxSecurity.com PHP security experts Brittany Day and Dave Wreski have additional tips and advice for improving PHP security, which we will explore in this section. Our Top PHP Security Tips & Advice Update Your PHP Version and Modules Regularly It is critically important that administrators and developers update their PHP version and modules regularly. With the support of the open-source community behind PHP, patches and bug fixes for vulnerabilities are released frequently, and newer versions of PHP and its modules often contain mitigations for known security issues that can be exploited by malicious hackers. As of January, 2022, the stable release for PHP is version 8.1.1 , from December 2021. It should be noted that when PHP is being used in a hosting environment, users may not be able to update their PHPversion number. In such scenarios, users must be especially careful and vigilant. They should also explore potential workarounds and demand that their hosting provider update PHP at the earliest opportunity. Restrict PHP Information Leakage The unfortunate reality is that it is common for platforms to leak sensitive information - and PHP is no exception. For example, PHP releases versions and the fact that it is installed on a server through the expose_php directive. To prevent the leakage of this sensitive data, administrators should set this directive to off in /etc/php.d/security.ini. expose_php=Off Control File System Access PHP can access files by default via the open_basedir directive using functions like fopen(). To control file access and prevent security issues, the open_basedir directive should always be set to the /var/www/html directory. open_basedir="/var/www/html/" Disable Remote Code Execution (RCE) In PHP, remote code execution is enabled by default. The "allow_url_fopen" directive allows functions including require, include, or URL-aware fopen wrappers to obtain direct access to PHP files. Remote access can be obtained using the HTTP and FTP protocols, leaving system defenseless against code injection vulnerabilities. To protect against these types of exploits, administrators should disable remote code execution by setting the "allow_url_fopen" directive to "Off". Disable Dangerous PHP Functions & Get Rid of Unnecessary Modules PHP comes with a selection of useful functions, but is also plagued with functions that can be exploited by attackers and should be disabled. To disable these dangerous functions, administrators must edit the php.ini file. In this file, they should find the disable_functions directive and disable the dangerous functions in it using: disable_function =exec,passthru, shell_exec,system,proc_open, popen,curl_exec, curl_multi_exec,parse_ini_file,show_source PHP also comes with an array of excellent modules; however, not all modules arerequired for every project. In PHP, all the extension modules found in /etc/php.d/ directory are loaded by default. Administrators should get rid of all modules that are not currently required, as doing so will improve both security and performance. To view available PHP modules, use the command: php -m Once you have accessed this list, you will be able to get rid of all unnecessary modules. To enable or disable a particular module, simply find the configuration file in the /etc/php.d/ directory and comment the module name. Scan PHP Scripts & Audit PHP Code for Security Vulnerabilities Scanning PHP scripts and auditing PHP code is essential in identifying and fixing potential security vulnerabilities before they are exploited by attackers. There is a plethora of excellent free and open-source tools and utilities available to assist Linux users in this process. Here are some of our favorites: Phpcs-security-audit is a set of customizable PHP_CodeSniffer rules that identifies security vulnerabilities and weaknesses in PHP code. The tool checks for CVE issues and security adviso ries related to the CMS/framework, enabling administrators to follow the versioning o f components during static code analysis. SensioLabs Security Checker is a command line tool that checks if an application uses dependencies with known security vulnerabilities using the Security Check Web service and the Security Advisories Database . Suhosin is an advanced security system for PHP installations designed to protect servers and users from known and unknown flaws in PHP applications and the PHP core. PHP Malware Finder (PMF) is a self-hosted solution designed to help administrators and developers identify potentially malicious code in files. Detection is performed by crawling the filesystem and t esting files against a set of YARA rules. RIPS is a PHP static code analysis tool that is integrated through the development lifecycle to identify security issues in real-time. The toolsupports 15 different types of vulnerabilities, and is able to scan PHP applications very rapidly for PHP-specific vulnerabilities. SonarPHP is a static code analyzer that uses pattern matching and data fl ow techniques to identify vulnerabilities in PHP code. It is used as an extension for the SonarQube platform and features over 200 rules, along with support of custom rules. Dependency-check-cli is a great tool from OWASP that uses dependency-check-core to detect publicly disclosed vulnerabilities associated with the scanned project dependencies. The tool will generate a report listing the dependency, any identified Common Platform Enumeration (CPE) identifiers, and the associated Common Vulnerability and Exposure (CVE) entries. PHP Secure Configuration Checker is a single file that checks a current PHP configuration for potential security flaws. It is user-friendly and has almost no dependencies. The Bottom Line PHP offers web server administrators and web application developers an array of valuable functions and modules paired with robust security inside out - a characteristic that can largely be attributed to the support that PHP receives from the vibrant, global open-source community. However, PHP security is ultimately in the hands of the administrator. He or she must make sure code is written properly, the proper configurations have been made and that the best practices covered in this article are being implemented. PHP security should be a primary concern for administrators and developers, as it is inextricably tied to the security of a web server as a whole. Sound PHP security can help mitigate the risk of attacks and compromise, secure web applications, protect user privacy and maintain a secure and properly functioning Linux web server. Do you have questions about PHP security or want to discuss the topic in more depth? Let’s chat! Connect with us on social media: Twitter | Facebook . In a recent security incident, hackers were able to add a backdoor tothe PHP source code. Although . running, linux, server, prerequisite, popular, applications. . Brittany Day
Jan 02, 2022
•
102
security advisoryconfigurationubuntuImproving Nagios Security On Ubuntu: Configuration Tips
Nagios is a monitoring software designed to let you know about problems on your hosts and networks quickly. You can configure it to be used on any network. Setting up a Nagios server on any Linux distribution is a very quick process however to make it a secure setup it takes some work. This article will not show you how to install Nagios since there are tons of them out there but it will show you in detail ways to improve your Nagios security. . Bill Keys Introduction Nagios is a monitoring software designed to let you know about problems on your hosts and networks quickly. You can configure it to be used on any network. Setting up a Nagios server on any Linux distribution is a very quick process however to make it a secure setup it takes some work. This article will not show you how to install Nagios since there are tons of them out there but it will show you in detail ways to improve your Nagios security. You may be wondering why should I need to think about securing my Nagios server? Well, think about the amount of information the attacker can get if they compromise it. All the examples below assumes you are using Ubuntu. However these examples will help any user running a Nagios server to make it more secure since the concepts will still apply. Web interface If you installed Nagios with one of the quick start guides out there, chances are that you setup the web interface. Since Nagios uses Apache to display it there are many security options. Below is an example of apache configuration for a Nagios web interface: Options ExecCGI AllowOverride None Order allow,deny Allow from all AuthName "Nagios Access" AuthType Basic AuthUserFile /usr/local/nagios/etc/htpasswd.users Require valid-user The 'Allow from' option is used to provide access to only a certain IP address and/or network. The above example allows any IP address to access the web interface. The other security options are used for authentication.'AuthType' defines the type of authentication being used. There are two types you can choose from Basic or Digest. Basic authentication will transmit your passwords and username as clear text. However using Digest the passwords are transmitted as MD5 digests which is more secure then in clear text. After making some security improvement we get the below. Options ExecCGI AllowOverride None Order allow,deny Allow from 192.168.4. AuthName "Nagios Access" AuthType Digest AuthDigestFile /usr/local/nagios/etc/htpasswd.users Require valid-user Now only computers on the 192.168.4.0 network can have access to the web interface. Also we are now using Digest authentication instead of the insecure method of Basic authentication. Now we need to add users and passwords to allow accesses to the web interface. To add a new user using digest authentication use the below command: # htdigest -c /usr/local/nagios/etc/htpasswd.users realm username Digest is more secure then Basic authentication but the best way keep your username and passwords safe is to use SSL. Make sure that you restart apache if you make any configuration changes. # /etc/init.d/apache2 restart Best Practices This sections lists some of the best security practices when setting up an Nagios server. Don't Run Nagios As Root There should be an normal user called nagios. If Nagios is running as root then if Nagios gets compromised then the attacker can do anything they want to your system. Lock Down The Check Result Directory Make sure that only nagios has read/write access to the check result directory otherwise an attacker can send fake host and service checks. This directory is normal at /usr/local/nagios/var/spool/checkresults Use Full Paths In Command Definitions When defining commands, make sure to specify the full path and not the relative one to any scripts or binaries you . Bill Keys Introduction Nagios is a monitoring software designed to let you know about problems on yo. nagios,monitoring, software, designed, about, problems, hosts, networks. . Anthony Pell
Mar 17, 2010
•
102
network securityrisk managementsecurity toolsReview of Network Security Monitoring by Richard Bejtlich
The Tao of Network Security Monitoring is one of the most comprehensive and up-to-date sources available on the subject. It gives an excellent introduction to information security and the importance of network security monitoring, offers hands-on examples of almost 30 open source network security tools, and includes information relevant to security managers through case studies, best practices, and recommendations on how to establish training programs for network security staff. . Book Review Author: Richard Bejtlich Publisher: Addison Wesley Pages: 798 Opinion To be honest, this was one of the best books that I've read on network security. Others books often dive too deeply into technical discussions and fail to provide any relevance to network engineers/administrators working in a corporate environment. Budgets, deadlines, and flexibility are issues that we must all address. The Tao of Network Security Monitoring is presented in such a way that all of these are still relevant. One of the greatest virtues of this book is that is offers real-life technical examples, while backing them up with relevant case studies. Network security engineers, system administrations, and security management will find value in this book. It is a must-read for anyone interested in getting into the field, but would still be useful as a reference for the experienced expert. The book is written in an easy to follow manner and is filled with diagrams, tables, screen shots, and relevant examples. Richard Bejtlich attempts to help network engineers go beyond what is offered by today's intrusion detection systems. He provides a basis for developing an entire network security monitoring architecture, which gives administrators a much clearer view of network activity. I highly recommend this book to anyone involved in network security on a day-to-day basis. Inside the Book The Tao of Network Security Monitoring is written in 6 parts with 18 chapters and several appendixes. Part I gives an introduction tonetwork security monitoring, part II introduces available network security tools with examples of usage as well as how the tool can be acquired. Part III and IV outline the network security monitoring process through best practices and case studies while explaining role of those individuals involved. Part V describes what tools and tactics attackers use to evade network security monitoring systems. Part VI, the appendixes, offer a protocol header reference, an intellectual history of network security monitoring, and an introduction to protocol anomaly detection. Chapter 1 offers a decent introduction to information security, but it focuses specifically on background material that is relevant to network security monitoring. Rather than viewing security in a traditional light, Richard Bejtlich offers an explanation that puts threats and vulnerabilities into the concept of risk management. The characteristics of an intruder are given as well as the phases of a typical network compromise. (Reconnaissance, Exploitation, etc.) One of the more interesting parts of this chapter is the author's description of the phrase 'defensible network.' Defensible networks can be monitored, limit an intruder's maneuverability, keep services to a minimum, and can be managed more easily. Chapter 2 goes more deeply into network security. This chapter is slightly more technical, but still offers a high-level explanation of the principles and concepts necessary when developing a network security plan. Chapter 3 continues to prepare the reader to understand the entire network security environment. This chapter offers an introduction to the security perimeter, demilitarized zone, wireless networks, and intranets. It discusses the use of hubs, span ports, taps, inline devices, monitoring architecture, and monitoring administration considerations. After the first three chapters, readers should have a firm understanding of the role the network security plays in an organization. The next seven chapters offer detailed information aboutmany of the network security monitoring tools available to administrators. The author chose to include only software that is presently available for his FreeBSD 4.9 test platform. However, this should not be a discouraging factor for Linux readers. The sources and binaries for nearly all of the software examined is also available for Linux. Chapter 5 focuses on 'full content' software such as Tcpdump, Tethereal, and Snort as a packet logger. For each tool examined, a basic introduction and usage examples are given as well as extended examples which show how each tool can be used in specific scenarios. Chapter 6 discusses 'additional data analysis' tools such as tcpslice, tcpreplay, ngrep, etherape, etc. Chapter 7 gives examples and usage suggestions for tools that deal with session data and chapter 8 does the same for statistical based tools. Chapters 11 and 12 are probably much more interesting to seasoned information security professionals. Network security best practices are discussed as well as case studies that offer interesting examples of network security incidents. Chapter 13 is an excellent piece of writing that lays out the parts necessary to create a network security analyst training program. This chapters does a good job of outlining the skills necessary to help a security manager determine who should be doing what, how tools are established and used within an organization, how policies are created, and the tasks associated with each area of network security monitoring. It includes weapons and tactics, telecommunications, system administration, scripting and programming, management policy, and examples of training in action. The last two chapters, 17 and 18 will probably be two of the most interesting chapters to the casual reader. Rather than focusing solely on the security engineer, these two chapters consider the perspective of the intruder. Tools used to disrupt the integrity of network security monitoring systems are discussed as well as tactics to promote anonymity, evade detection,and affect the integrity of data collection tools. These chapters show the importance of thinking like the enemy. About the Author Richard Bejtlich is a security engineer in the Computer Forensic and Intrusion Analysis division of ManTech International. He has also worked as a consultant for Foundstone, and managed network security operations for Ball Aerospace & Technologies Corporation. He served in the Air Force Computer Emergency Response Team (AFCERT) as well as support law enforcement investigations. He is well known in the wider security community for writing papers and giving technical lectures at SANS, FIRST, Infragard, ISSA, and SHADOW conferences. He has a Bachelor of Science degree from the United States Air Force Academy, a Master's from Harvard, CISSP, and Certified Information Forensics Investigator certification. . Richard Bejtlich, a cybersecurity expert, shares deep insights on network security monitoring, highlighting continuous threat detection and the importance of logging.. Network Security Monitoring, Open Source Tools, Best Practices, Security Management. . Benjamin D. Thomas
Jan 28, 2005
•
102
security insightsbest practicesfirewall techniques2024 Security Insights: Key Trends and Best Practices for Linux Management
Vincenzo Ciaglia of Linux Netwosix talks about this year of Linux Security. A full immersion in the world of Linux Security from many sides and points of view. . Introduction And another year arrives. What will this 2005 give to us? Only chocolates, cakes, happiness and no other stress from the work or anything else? Ok, I'm just joking. Let's start! The year 2004 has been the year of Linux, according to many "linux critics". In my opinion, it has just been another year for Linux to demonstrate its power, usability, and security in comparison to other operating systems and commercial products. Many successes followed one another without a break. Management's View of Linux Security Today There is still very little consideration for Linux. It's a simple sentence, but a complex situation. Let's take the example of Italy (my home country). Only too few companies understood the real problem of security. Here is a simple example: "Hey manager, you could be a simple target for an attacker if you make this or do this with your LAN", "Hey Linux-Security-addict don't worry, please! We have so many computer experts in our company" Ok, nothing it's strange but the "computer experts" are really so expert? Many times we see how this computer experts are just some Windows beginners who want to conquer the world with a simple "double click". Well, dear managers, the security isn't only this. Security being synonymous with professional is a joke. Moreover I see how many Linux companies all over the world are growing up. This is another very good thing for us. It means that the managers are understanding day by day the problem and want to do everything to solve their big security problems. User's View of Linux Security However, with the passing of the time, there are many home users who love to configure good firewalls for their own computers or use commercial products. This is a very good thing but we're still far away from afull concept of "security". Security isn't just a simple firewall. Security is behavior! If you still take notes of your passwords on some papers and you leave them on your desktop ... well, you can be secure that you're not a security-care user. If you are not a connoisseur of social engineering and its techniques, you can't sleep at night very well, trust me. We can talk about Physical Security, too. If you still leave your computer unguarded at lunch break you can be secure that someone so curious and more clever than you will use your computer to have your sensitive data and use them for some uses (legal or not). So dear user, come on, be careful and don't be sure that you have a big security plan for your LAN. And ... trust no one to avoid social engineering. State of Linux Security On this side we can talk for hours but I have just a little space to spare. There are so many interesting projects that are helping the Linux community to solve the security problems. Linux is the most attaccked system from the attackers but it is even the most secure. Don't worry, isn't a contradiction. I just want to say that thanks to its structure , Linux can be considered as the most secure operating system today but thanks to many sleepy SysAdmin is the most attacked one, too. I appreciate many security projects, for example: Aide, Chkrootkit, Ettercap, Nmap, just to make some names about linux security related packages. I can't forget the SELinux Project, in my opinion the most important and useful kernel security patch never created without forget GrSecurity. What can be done? We must believe in security and in a secure world without attackers. We have to improve our behavior about security and be careful about everything. From the SysAdmin side, the best way to follow is to keep upgraded their systems and don't sleep at work. Finally, we have to burn every Windows copy and switch to Linux ;) Holiday Thanks I can't forget the somany linux security communities on the net and the big helps of the Linux Expert users through mailing lists, forums with the hope of helping the newbie one. It's really a wonderful thing, don't you think? It's just OpenSource and a perfect world is possible with it. Vincenzo Ciaglia is the founder of the Netwosix project and contributing writer for LinuxSecurity.com . The landscape of Linux security is ever-changing, necessitating proactive management and user education to effectively safeguard systems from emerging threats. Linux Security Insights, Proactive Security Management, Open Source Projects, Firewall Strategies. . Brittany Day
Dec 15, 2004
•
102
system hardeningsecurity managementpatch managementManaging Security in Linux 2004: Strategies and Routines for Success
This article examines the process of proper Linux security management in 2004. First, a system should be hardened and patched. Next, a security routine should be established to ensure that all new vulnerabilities are addressed. Linux security should be treated as an evolving process. . Introduction As Linux continues to gain popularity in the business world, security issues are something that cannot be ignored. In 2003, several well known Linux distributors had servers compromised. In one particular case, the vulnerability was well known in advance, but most vendors took entirely too much time to release an update. Similarly, most security problems that users face are known well in advance. As with any system, security on Linux is a process. It requires full commitment and due diligence. The secret is determining your own vulnerabilities and fixing them before anything catastrophic happens. Although Linux security is entirely in the hands of system administrators, several improvements have been made at the kernel level. With the release of kernel version 2.6, users will now be able to take advantage of the Linux Security Module allowing greater levels of security customization, modularization, and ease of management. Another thing that has changed in the past several years is that today more of us are reliant on automated software update services. Rather than download and install patches manually, it is now easier to subscribe to a trusted source and let the system manage itself. As long as the integrity of the trusted source remains strong, automated management works flawlessly. As soon as something questionable happens, it is necessary to re-evaluate. Solve the Problem Addressing Linux security is like solving any problem. It must be approached with a purpose and plan. If you have been using Linux and neglecting security, it is now time to face it head on. Although the task may seems daunting in the beginning, it will soon be apparent that securing a Linux system isactually very strait forward. In general security can be summed up into several steps. First, live by the minimum necessary rule. For example, turn off all unnecessary services, remove all programs that are not being used, and only give access when it is absolutely critical to a particular job function. Taking this simplistic approach will not only increase security, but over time will make life easier. It will eventually mean less stale-accounts to remove, less software to patch, and greater system performance. Next, keep a software inventory of all versions used. Use this information to conduct the research necessary to ensure that all have been patched appropriately. Doing this, will greatly reduce the risk of being compromised by a known vulnerability. As simple as it may sound, doing this will make the system no longer an easy target, therefore be much less likely compromised. Unless the attacker is highly motivated highly sophisticated a hardened system will not be appealing. Because most organizations have tens to hundreds of systems to manage, living by the minimum necessary rule, and establishing a security patch baseline is not always easy. The only way to approach Linux security is by developing a detailed plan. If server roles can be modularized, it may be much easier to determine what software is actually necessary for operation. Similarly, if multiple Web servers are on the network, they should all have the same basic set of software which again makes management easier. Planning for security, rather than trying to bolt it on after implementation is the key to success. Setup a Routine After a security plan is established and well underway, it also necessary to have a security routine. Security patches are released daily and your organization must have a way to deal with these. Hardening a system will only ensure a high level of security a single point in time. As time moves forward and vulnerabilities arediscovered and exploits are made public, the system will become more vulnerable each day. To address this, it is necessary to monitor mailing lists, subscribe to our newsletter Linux Advisory Watch, or subscribe to an automated patch management system. When evaluating Linux distributions, it is important to take into account the frequency, timeliness, and reliability of security updates. Unfortunately, some distributions have been known to only release updates every several months in inconsistent intervals. Others are very good and release patches very soon after the vulnerability is known. Some may wish to apply security updates daily, but it is probably more reasonable to apply them weekly. Of course, exceptions should be made for very critical updates. If production servers are going to be updated, it is advisable to first try them out in a testing environment. This is to minimize any damage that a flawed patch may cause. Also, do not forget to check the MD5 checksums of all downloaded patches. This can be done easily using the command-line tool 'md5sum.' To ensure overall system integrity, it is beneficial to a tool such as tripwire. Being the new year, it is now the best time to establish a routine. Excuses can always be made, but now is the best time to start. Determine what is necessary to keep your systems operating securely, and pick a day each week to devote to this. Time should be spent applying security patches, reviewing logs, reviewing active user accounts, and looking for anomalies. Devoting just a little time specifically security each week can make a huge difference. It is always better to address problems before they crop up. Concluding Remarks Security requires both dedication and commitment. 2004 can be a good year if you expect security problems and then develop specific plans to address each of them. After the basics have been addressed, now is the time to establish a routine thatwill ensure security is addressed on a reoccurring basis rather than waiting for problems to surface. To maintain proper Linux security, it must be a regular part of an organization's operational maintenance. Being the beginning of a new year, it is now the perfect time to establish routines that will promote greater security. Linux is a wonderful operating system and holds a huge amount of potential. Security should not be major concern as long as it is handled properly. . Master essential approaches to Linux security control, including timely updates and routine procedures, to guarantee continuous protection during 2004.. Linux Management, Security Practices, System Hardening. . Brittany Day
Jan 06, 2004
•
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!