Softpanorama (slightly skeptical) Open Source Software Educational Society

May the source be with you, but remember the KISS principle ;-) Softpanorama Search

Harden the server

Perform initial hardening to satisfy audit req (should be automatic or semiautomatic):

1. ___ Delete redundant accounts:
   • uucp
   • ftp (unless you need anonymous ftp access; this account is often abused)
   • games
   • possibly wwwrun (unless you need a webserver on the box)
   • Note: Do not delete news account or logrotate will stop working
      
2. ___ Delete redundant groups
    
3. ___  Modify /etc/issue & motd according to company standards
    
4. ____ Configure syslog-ng to report to remote host if such infrastructure (central log server) exists in your company (it should !)
    
5. Enroll primary and secondary administrators into the wheel group and  activate this group in sudo: \

   • Edit /etc/group by appending primary and secondary administrators to wheel group (do not overcrowd the group)

   • Edit  /etc/sudoers and uncomment the line in the line

   %wheel ALL=(ALL) NOPASSWD: ALL

   Note: this is preferred method of controlling root access as linux does not have RBAC.
    

6. Install writable files checking script into cron 
    
7. Verify correctness of home directories permissions
    
8. Populate all home directories and /root directory with .profile  and .kshrc files  (for bash users this is .bash_profile and .bashrc) and verify they are properly owned and have permissions  701
    
9. ___  Important Check and if necessary disable test, guest and any other unused accounts if any were created during the installation.
    
10. Notes
    •  __________________________________________________________________________________
    •  __________________________________________________________________________________
    •  __________________________________________________________________________________
    •  __________________________________________________________________________________
    •  __________________________________________________________________________________

1.  

2. Notes
   •  __________________________________________________________________________________
   •  __________________________________________________________________________________
   •  __________________________________________________________________________________
   •  __________________________________________________________________________________
   •  __________________________________________________________________________________

Change monitor resolution if the server will be shipped to different location

1. If you plan to ship the server to other location change resolution to 800x600 and color depth to 16. Most older KVM switches do not support high resolution. 

Create baseline

1. ___ Create the baseline of key config files for the server and burn it to CD.
    
   1. Adopt one of the scripts used in troubleshooting and run it after the installation just before giving the server to application people.
       
   2. Copy all the critical config file to /root/baseline/date directory the way JASS does this on Solaris.  Tar the directory, move it to your desktop and burn to CD.
       
2. ___ Verify the /boot/grub/menu.lst is configured correctly.
    
3. Notes
   •  __________________________________________________________________________________
   •  __________________________________________________________________________________
   •  __________________________________________________________________________________
   •  __________________________________________________________________________________
   •  __________________________________________________________________________________

Additional installation steps that were missed

1. Notes
    
   •  __________________________________________________________________________________
   •  __________________________________________________________________________________
   •  __________________________________________________________________________________
   •  __________________________________________________________________________________
   •  __________________________________________________________________________________