Configuring server security

A major reason for malicious attacks on Linux servers has been poorly implemented security or existing vulnerabilities. When configuring a server, security policies need to be implemented properly, and ownership needs to be taken in order to properly customize the server.

How to do it…

General Policy:

• The administration of all the internal servers in an organization is the responsibility of a dedicated team, which should also keep a look out for any kind of compliance. If any compliance takes place, the team should accordingly implement or review the security policy.
• When configuring internal servers, they must be registered in such a way that the servers can be identified on the basis of the following information:
  • Location of the server
  • The operating system version and its hardware configuration
  • Services and applications that are being run
• Any kind of information in the organization's management system must always be kept up to date.

Configuration Policy:

• The operating system on the server should be configured in accordance with the guidelines approved for InfoSec.
• Any service or application not being used should be disabled wherever possible.
• All access to the services and applications on the server should be monitored and logged. They should also be protected through access-control methods. An example of this will be covered in Chapter 3, Local Filesystem Security.
• The system should be kept updated, and any recent security patches, if available, should be installed as soon as possible.
• Avoid using a root account to the maximum extent. It's preferable to use security principles that require the least amount of access to perform a function.
• Any kind of privileged access must be performed over secure channel connection (SSH) wherever possible.
• The server should be accessed in a controlled environment.

Monitoring Policy:

• All security-related actions on server systems must be logged, and audit reports should be saved as follows:
  • For a period of 1 month, all security-related logs should be kept online
  • For a period of 1 month, daily backups as well as weekly backups should be retained
  • For minimum of 2 years, full monthly backups should be retained
• Any event related to security being compromised should be reported to the InfoSec team. They shall then review the logs and report the incident to the IT department.
• A few examples of security-related events are as follows:
  • Port scanning-related attacks
  • Access to privileged accounts without authorization
  • Unusual occurrences due to a particular application being present on the host

How it works…

Following the preceding policy helps in the base configuration of the internal server that is owned or operated by the organization. Implementing the policy effectively will minimize any unauthorized access to sensitive and proprietary information.

There's more…

There are some more things to discover when we talk about security in Linux.