Linux Server Build Checklist: Difference between revisions

From Federal Burro of Information
Jump to navigationJump to search
No edit summary
No edit summary
Line 37: Line 37:
== Also See ==
== Also See ==


[[StartMTS Linux Build Process 0.9]]
StartMTS Linux Build Process 0.9 - removed




[[Category:Checklist]]
[[Category:Checklist]]

Revision as of 20:24, 9 January 2019

  • The purpose of the server is clear
    • Who will use the server / via what ports? What services?
    • What software will be installed
  • interface configuration is correct
  • routing table is correct
  • minimal software stack is installed. unneeded stuff removed ( bluetooth, gnome )
  • Time services ( Ntp | PTP )
  • Logging services - kern.* /var/log/kernel.log + logrotate
  • ssh updated, and locked down ( no remore root, no version 1 protocol , keys only )
  • open ssl updated
  • kernel updated
  • Password policy updated.
  • update system working: yum , checking in , registered.
  • users defined and locked down.
  • service list defined and locked down.
  • selinux setup as needed
  • iptables / firewall.

Basic default allow + logging iptables:

/sbin/iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -p udp -m multiport --dports 53,5353 -j ACCEPT # example 
/sbin/iptables -A INPUT -p tcp -m state --state NEW -m multiport --dports 22,53,80,443:3000 -j ACCEPT # example
/sbin/iptables -A INPUT -m limit --limit 6/min -j LOG --log-prefix "INPUT "
/sbin/iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -m limit --limit 6/min -j LOG --log-prefix "OUTPUT "

also see some common things you should block: http://newartisans.com/2007/09/neat-tricks-with-iptables/

Also See

StartMTS Linux Build Process 0.9 - removed