Linux Server Build Checklist: Difference between revisions

From Federal Burro of Information
Jump to navigationJump to search
No edit summary
No edit summary
Line 17: Line 17:
* selinux setup as needed
* selinux setup as needed
* iptables / firewall.
* iptables / firewall.
Basic default allow + logging iptables:
<pre>
/sbin/iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -m limit --limit 6/min -j LOG --log-prefix "INPUT "
/sbin/iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -m limit --limit 6/min -j LOG --log-prefix "OUTPUT "
</pre>
* server is monitored properly.
* server is monitored properly.
* timestamp in bash history: "export HISTTIMEFORMAT='%F %T '"
* timestamp in bash history: "export HISTTIMEFORMAT='%F %T '"

Revision as of 13:48, 25 May 2015

  • The purpose of the server is clear
    • Who will use the server / via what ports? What services?
    • What software will be installed
  • interface configuration is correct
  • routing table is correct
  • minimal software stack is installed. unneeded stuff removed ( bluetooth, gnome )
  • Time services ( Ntp | PTP )
  • Logging services - kern.* /var/log/kernel.log + logrotate
  • ssh updated, and locked down ( no remore root, no version 1 protocol , keys only )
  • open ssl updated
  • kernel updated
  • Password policy updated.
  • update system working.
  • users defined and locked down.
  • service list defined and locked down.
  • selinux setup as needed
  • iptables / firewall.

Basic default allow + logging iptables: 

/sbin/iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -m limit --limit 6/min -j LOG --log-prefix "INPUT "
/sbin/iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -m limit --limit 6/min -j LOG --log-prefix "OUTPUT "
Retrieved from "https://wiki.quadratic.net/index.php?title=Linux_Server_Build_Checklist&oldid=2513"