freebsd security - Mar 2004 - General Security Issues

Greetings list,

As a newbie to security I would like to ask any recommendation that the list
might have.
We are about to "install" a new box with 4.9 stable to the nice and
innocent
internet world. :-P
The box has no services running expect apache and we telnet to it via SSH.
Main function of this box will be graphing various interfaces via rrdtool.
So, I would like to ask if there is any other precautions that I must take
in order to sleep safe at night. Should I check for any other opened ports ?
Should I do something with the kernel to be more secure ?
I know this ain't so easy, but let's say my main scope is to get a least
a
decent sleep :-)

Kind Regards,

Kostas

Konstantinos Fotiadis wrote:
>Greetings list,
>
>As a newbie to security I would like to ask any recommendation that the list
>might have.
>We are about to "install" a new box with 4.9 stable to the nice
and innocent
>internet world. :-P
>The box has no services running expect apache and we telnet to it via SSH.
>  
>
So you've disabled sendmail and inetd.conf?
>Main function of this box will be graphing various interfaces via rrdtool.
>So, I would like to ask if there is any other precautions that I must take
>in order to sleep safe at night. Should I check for any other opened ports ?
>  
>
Good idea, always ... from inside (netstat) and outside
(port scanner, like nmap<?>)....
>Should I do something with the kernel to be more secure ?
>  
>
A firewall is often considered a must.
>I know this ain't so easy, but let's say my main scope is to get a
least a
>decent sleep :-)
>
>Kind Regards,
>
>Kostas
>
>
>  
>
I imagine this list would prefer that you send your
questions to the questions@ list.  I can't remember
the list charter enough to know exactly *why* at
the moment ... so I've made a comment or two.

I imagine that if you can find no open ports, and stay
on top of any changes to Apache and OpenSSH,
you should have few worries --- except for the scripts
that run on the webserver...which is a whole different
topic, as I see it.... :-(

Kevin Kinsey
DaleCo, S.P.

On Mon, 1 Mar 2004 16:48:07 +0200
"Konstantinos Fotiadis" <bookman@oteglobe.net> wrote:
> The box has no services running expect apache and we telnet to it via
> SSH. Main function of this box will be graphing various interfaces via
> rrdtool. So, I would like to ask if there is any other precautions
> that I must take in order to sleep safe at night. Should I check for
> any other opened ports ? 
sockstat -l -4
>Should I do something with the kernel to be
> more secure ? I know this ain't so easy, but let's say my main
scope
> is to get a least a decent sleep :-)
Try these ports (all under "security"):
lockdown
chkrootkit
portaudit
tripwire
snort
freebsd-update
just to name a few. Of course you should read about OpenSSH and Apache
security and keep them up to date. Maybe even run sshd at some high port
like 56789?

br
db