CS Security Guide - Revision history

Miket: /* Linux Hardening Scripts */

2024-11-08T15:24:43Z

Linux Hardening Scripts

← Older revision		Revision as of 11:24, 8 November 2024
Line 81:		Line 81:
	=Linux Hardening Scripts=		=Linux Hardening Scripts=
	Here are a couple of example scripts to help get you started.<BR>		Here are a couple of example scripts to help get you started.<BR>
	- ([https://version.cs.vt.edu/techstaff/~~linux-audit~~ Ansible])<BR>		- ([https://version.cs.vt.edu/techstaff/ansible Ansible])<BR>
	- ([https://version.cs.vt.edu/rhunter/cs-linux-hardening-script Bash])		- ([https://version.cs.vt.edu/rhunter/cs-linux-hardening-script Bash])

Miket: Protected "CS Security Guide" ([Edit=Allow only administrators] (indefinite) [Move=Allow only administrators] (indefinite))

2023-10-18T15:09:17Z

Protected "CS Security Guide" ([Edit=Allow only administrators] (indefinite) [Move=Allow only administrators] (indefinite))

← Older revision	Revision as of 11:09, 18 October 2023
(No difference)

Miket: /* Keys */

2023-08-29T13:10:33Z

Keys

← Older revision		Revision as of 09:10, 29 August 2023
Line 36:		Line 36:
	The IT Security Office currently recommends the use of SSH keys requiring a password as the preferred method of securing root access and providing multifactor authentication for remote access.		The IT Security Office currently recommends the use of SSH keys requiring a password as the preferred method of securing root access and providing multifactor authentication for remote access.

	[https://wiki.cs.vt.edu/index.php/Howto::SSH_Key CS SSH Key Guide]		* [https://wiki.cs.vt.edu/index.php/Howto::SSH_Key CS SSH Key Guide]
	[https://4help.vt.edu/sp?id=kb_article&sys_id=7afe908fdb67e4106ee1d2cb4b961982#client 4help - SSH Key Guide]		* [https://4help.vt.edu/sp?id=kb_article&sys_id=7afe908fdb67e4106ee1d2cb4b961982#client 4help - SSH Key Guide]

	==Fail2Ban==		==Fail2Ban==

Miket: /* Keys */

2023-08-29T13:10:19Z

Keys

← Older revision		Revision as of 09:10, 29 August 2023
Line 36:		Line 36:
	The IT Security Office currently recommends the use of SSH keys requiring a password as the preferred method of securing root access and providing multifactor authentication for remote access.		The IT Security Office currently recommends the use of SSH keys requiring a password as the preferred method of securing root access and providing multifactor authentication for remote access.

			[https://wiki.cs.vt.edu/index.php/Howto::SSH_Key CS SSH Key Guide]
	[https://4help.vt.edu/sp?id=kb_article&sys_id=7afe908fdb67e4106ee1d2cb4b961982#client 4help - SSH Key Guide]		[https://4help.vt.edu/sp?id=kb_article&sys_id=7afe908fdb67e4106ee1d2cb4b961982#client 4help - SSH Key Guide]

	==Fail2Ban==		==Fail2Ban==
	There are guides on using fail2ban to dynamically block an IP that is making repeated failed login attempts through SSH. This would limit the effectiveness of password spray attacks and brute forcing.		There are guides on using fail2ban to dynamically block an IP that is making repeated failed login attempts through SSH. This would limit the effectiveness of password spray attacks and brute forcing.

Carnold: /* Hardening Scripts */

2021-10-07T11:41:36Z

Hardening Scripts

← Older revision		Revision as of 07:41, 7 October 2021
Line 77:		Line 77:
	Currently our recommendation is Nightly backups for 7 days and weekly snapshots for a month, then monthly snapshots.		Currently our recommendation is Nightly backups for 7 days and weekly snapshots for a month, then monthly snapshots.

	=Hardening Scripts=		=Linux Hardening Scripts=
	Here are a couple of example scripts to help get you started.<BR>		Here are a couple of example scripts to help get you started.<BR>
	- ([https://version.cs.vt.edu/techstaff/linux-audit Ansible])<BR>		- ([https://version.cs.vt.edu/techstaff/linux-audit Ansible])<BR>

Miket: /* Databases, NFS Shares, and Printers */

2021-10-04T17:12:49Z

Databases, NFS Shares, and Printers

← Older revision		Revision as of 13:12, 4 October 2021
Line 30:		Line 30:
	=Databases, NFS Shares, and Printers=		=Databases, NFS Shares, and Printers=
	These services almost never need public internet access and should be among the first ports you restrict access to with your firewalls or Access Control Lists (Printers).		These services almost never need public internet access and should be among the first ports you restrict access to with your firewalls or Access Control Lists (Printers).

	=SSH=		=SSH=
	Based on recent attack history, SSH brute forcing tends to be one of most common infiltration methods we have been seeing. Often times in relation to insecure password generation (see above).		Based on recent attack history, SSH brute forcing tends to be one of most common infiltration methods we have been seeing. Often times in relation to insecure password generation (see above).

Miket: /* Passwords */

2021-10-04T17:10:44Z

Passwords

← Older revision		Revision as of 13:10, 4 October 2021
Line 14:		Line 14:
	#Accounts with Sudo access are just as dangerous if compromised.		#Accounts with Sudo access are just as dangerous if compromised.
	=Passwords=		=Passwords=
	==~~Complexity~~==
	Secure passwords feature a number of special characters, numbers, and a mix of upper and lowercase letters (8+ Characters), or are of significant length (16+ Characters).		==Guidelines==
	Even following these complexity rules can result in a password that is insecure. For instance take a “four seasons” password (Example: Winter2020! ) This password is 11 characters long, features mixed-case, numbers and a special character, and yet exists in common password lists.		# Complexity - Secure passwords feature a number of special characters, numbers, and a mix of upper and lowercase letters (8+ Characters), or are of significant length (16+ Characters). Even following these complexity rules can result in a password that is insecure. For instance take a “four seasons” password (Example: Winter2020! ) This password is 11 characters long, features mixed-case, numbers and a special character, and yet exists in common password lists.
	==Sharing==		# Sharing - Do not share passwords for your personal account or an admin account. It is also recommended not creating a shared account.
	Do not share passwords for your personal account or an admin account. It is also recommended not creating a shared account.		# Reuse - Do not reuse passwords, especially for accounts with Admin Privileges. This means do not use the same password for more than one account. And it also means do not change back to the password at a later time.
	==Reuse==		# Checking for Compromise - A variety of password managers will review your list of passwords periodically against a list of compromised passwords to ensure that your password doesn't appear in a dictionary that attackers are using. You can also check at a variety of websites the standard being [https://haveibeenpwned.com/Passwords HaveIBeenPwned]
	Do not reuse passwords, especially for accounts with Admin Privileges. This means do not use the same password for more than one account. And it also means do not change back to the password at a later time.		# Common/Default Passwords - Most password lists include common and default passwords (ie: password, toor, admin, etc) If a device has a documented default password it is most likely included on the lists.
	==Checking for Compromise==
	A variety of password managers will review your list of passwords periodically against a list of compromised passwords to ensure that your password doesn't appear in a dictionary that attackers are using. You can also check at a variety of websites the standard being [https://haveibeenpwned.com/Passwords HaveIBeenPwned]

	=Firewalls=		=Firewalls=

Miket: /* Windows 10 */

2021-10-04T16:56:23Z

Windows 10

← Older revision		Revision as of 12:56, 4 October 2021
Line 94:		Line 94:

	==Windows 10==		==Windows 10==
	LinkedIn Learning		===LinkedIn Learning===
	[https://www.linkedin.com/learning/windows-10-security/securing-network-traffic-by-using-ipsec?u=57888345]		[https://www.linkedin.com/learning/windows-10-security/securing-network-traffic-by-using-ipsec?u=57888345 Securing Network Traffic by Using IPSec]

Miket: /* MacOS */

2021-10-04T16:55:48Z

MacOS

← Older revision		Revision as of 12:55, 4 October 2021
Line 90:		Line 90:

	==MacOS==		==MacOS==
	Apple Support		===Apple Support===
	[https://support.apple.com/guide/mac-help/set-up-your-mac-to-be-secure-flvlt003/mac]		[https://support.apple.com/guide/mac-help/set-up-your-mac-to-be-secure-flvlt003/mac Set Up your Mac to Be Secure]

	==Windows 10==		==Windows 10==
	LinkedIn Learning		LinkedIn Learning
	[https://www.linkedin.com/learning/windows-10-security/securing-network-traffic-by-using-ipsec?u=57888345]		[https://www.linkedin.com/learning/windows-10-security/securing-network-traffic-by-using-ipsec?u=57888345]

Miket: /* Linux Training */

2021-10-04T16:55:21Z

Linux Training

← Older revision		Revision as of 12:55, 4 October 2021
Line 86:		Line 86:
	Below are some links for training.		Below are some links for training.
	==Linux Training==		==Linux Training==
	LinkedIn Learning		===LinkedIn Learning===

	[https://www.linkedin.com/learning/linux-security-and-hardening-essential-training/welcome?u=57888345 Linux Security & Hardening Essentials]		[https://www.linkedin.com/learning/linux-security-and-hardening-essential-training/welcome?u=57888345 Linux Security & Hardening Essentials]