|
I had to build a very paranoid Linux system for an experiment using hackers and various scenarios in which they attack through unknown channels. With Linux, I could use a number of tools, which let me harden my Linux system to really high degrees. I modified the kernel and changed some of the in-depth system options to prevent certain types of attacks. I found that, if you want to go that far, you can go to the kernel level and harden. Modifying the system kernel is very effective because you can disable unused functionality at the very heart of the OS, making it unavailable to be abused by attackers.
I found that Linux is very securable. It gives you lots of different pedals you can pull and buttons you can press to make it more secure.
As for tools for Linux, number one would be a host-hardening tool, such as Bastille Linux. Bastille, written by Jay Beale, is of the best scripts ever. You install a Linux distribution, and then you install Bastille. Then, Bastille recommends which software settings you should change to make the system more secure.
For example, Bastille would identify an FTP server and ask if you need this FTP service tie-in. If not, Bastille can turn it off for you. You run Bastille so that you supply security settings properly. As a result, you arrive with a much better secured Linux system.
Nessus is a vulnerability scanner that runs on different Unix flavors and Linux. It is a very good idea to use Nessus to scan your systems' blocks on a fresh newly-built Linux system.
Scanning production machines is a different story. In that case, you might need permissions or a separate scan window, or you only scan during certain times. There are lots of issues, and nmap can address some of them. It is another tool that is not limited to Linux. I am not that convinced that everyone knows about nmap, but they should.
Say, you don't want to go for a full vulnerability scan, but you want to scan a new production system for, say, open ports or management for a special secure shelf. You scan with nmap, and it tells you that port 6000 -- which is Xwindows -- hasn't been disabled. Then, you can simply disable it. With nmap, you can avoid some common holes in Linux.
|
