Linux Server Build Checklist: Difference between revisions
From Federal Burro of Information
Jump to navigationJump to search
No edit summary |
No edit summary |
||
| Line 1: | Line 1: | ||
* | * The purpose of the server is clear | ||
* Who will use the server / via what ports? What services? | ** Who will use the server / via what ports? What services? | ||
* What software will be installed | ** What software will be installed | ||
* interface configuration is correct | |||
* routing table is correct | |||
* minimal software stack is installed. unneeded stuff removed ( bluetooth, gnome ) | * minimal software stack is installed. unneeded stuff removed ( bluetooth, gnome ) | ||
* Time services ( [[Ntp]] | [[PTP]] ) | * Time services ( [[Ntp]] | [[PTP]] ) | ||
* Logging services | * Logging services - kern.* /var/log/kernel.log + logrotate | ||
* ssh updated, and locked down ( no remore root, no version 1 protocol , keys only ) | * ssh updated, and locked down ( no remore root, no version 1 protocol , keys only ) | ||
* open ssl updated | * open ssl updated | ||
* kernel updated | * kernel updated | ||
* Password policy updated. | * Password policy updated. | ||
* update system working | * update system working. | ||
* users defined and locked down. | * users defined and locked down. | ||
* service list defined and locked | * service list defined and locked down. | ||
* selinux setup as needed | * selinux setup as needed | ||
* iptables / firewall. | * iptables / firewall. | ||
* server is monitored properly | * server is monitored properly. | ||
* timestamp in bash history: "export HISTTIMEFORMAT='%F %T '" | * timestamp in bash history: "export HISTTIMEFORMAT='%F %T '" | ||
* Hardened ( http://www.nsa.gov/ia/_files/factsheets/rhel5-pamphlet-i731.pdf ) | * Hardened ( http://www.nsa.gov/ia/_files/factsheets/rhel5-pamphlet-i731.pdf ) | ||
Revision as of 19:00, 29 July 2013
- The purpose of the server is clear
- Who will use the server / via what ports? What services?
- What software will be installed
- interface configuration is correct
- routing table is correct
- minimal software stack is installed. unneeded stuff removed ( bluetooth, gnome )
- Time services ( Ntp | PTP )
- Logging services - kern.* /var/log/kernel.log + logrotate
- ssh updated, and locked down ( no remore root, no version 1 protocol , keys only )
- open ssl updated
- kernel updated
- Password policy updated.
- update system working.
- users defined and locked down.
- service list defined and locked down.
- selinux setup as needed
- iptables / firewall.
- server is monitored properly.
- timestamp in bash history: "export HISTTIMEFORMAT='%F %T '"
- Hardened ( http://www.nsa.gov/ia/_files/factsheets/rhel5-pamphlet-i731.pdf )
- check list: ( http://security.utexas.edu/admin/redhat-linux.html )
