12:36 p.m.
Someone has broken into my fedora 13 machine. Aside from closing unused
ports on the firewall and router and disabling unused services, what should
I be doing to harden my set up? Tripwire? AIDE? What else? Thanks in
advance!
1:18 p.m.
On Wed, 27 Jun 2012, Dov-el wrote:
Someone has broken into my fedora 13 machine. Aside from closing unused ports on the
firewall and router and disabling unused services, what should I be doing to harden my set
up? Tripwire? AIDE?
What else? Thanks in advance!
you should stop running out of date releases like fedora 13. Shut your
system down and reinstall from scratch.
-sv
1:40 p.m.
The issue is far bigger than just doing a few things to close your system up. How
valuable is your system for the 'mission' it
provides? What about your data? What backup and/or disaster recovery
processes have you prepared?
I'd actively migrate to a more recent edition of the OS, and put processes in place to
keep patches updated.There are a number of places to get hardening guidance... YMMV.
There is the Center for Internet Security, DISA and NIST. Those are pretty good
starting point.
________________________________
From: Dov-el <dov_el(a)qx.net>
To: security(a)lists.fedoraproject.org
Sent: Wednesday, June 27, 2012 1:36 PM
Subject: my fedora 13 machine has been cracked
Someone has broken into my fedora 13 machine. Aside from closing unused ports on the
firewall and router and disabling unused services, what should I be doing to harden my set
up? Tripwire? AIDE? What else? Thanks in advance!
--
security mailing list
security(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/security
1:59 p.m.
On 27/06/12 19:18, Seth Vidal wrote:
On Wed, 27 Jun 2012, Dov-el wrote:
>
> Someone has broken into my fedora 13 machine. Aside from closing
> unused ports on the firewall and router and disabling unused services,
> what should I be doing to harden my set up? Tripwire? AIDE?
> What else? Thanks in advance!
>
>
>
you should stop running out of date releases like fedora 13. Shut your
system down and reinstall from scratch.
-sv
--
security mailing list
security(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/security
Also, this is the wrong
list to seek support for such an issue from.
Further, Seth is right, make a backup, reinstall, analyse backup. Do NOT
reuse data from backup, specially web code specific data. This includes
databases. Everything on the machine should be deemed compromised. File
a law enforcement notice in your country to protect yourself from abuse
claims, remove the machine from the network. Keep hard drive untouched
in case of forensic analysis (this should be a preferred method over a
reinstall on same hard drive) , that your law enforcement department
might want to undertake. Any tainted evidence is useless evidence. Also
note, that at least in the UK, you are responsible for a safe operation
of your system, running a Fedora 13 release, which ended support over a
year ago, is hardly fulfilling the requirement.
Maybe you should consider using Redhat Enterprise or, if it must be and
you do not need support, Centos. otherwise, make sure you maintain your
Fedora release in production. This takes a considerable effort and is
not for everyone. I run multiple Fedora systems in production and they
require constant maintenance.
Regards,
Tristan
--
Tristan Santore BSc MBCS
TS4523-RIPE
Network and Infrastructure Operations
InterNexusConnect
Mobile +44-78-55069812
Tristan.Santore(a)internexusconnect.net
Former Thawte Notary
(Please note: Thawte has closed its WoT programme down,
and I am therefore no longer able to accredit trust)
For Fedora related issues, please email me at:
TSantore(a)fedoraproject.org
2:03 p.m.
Aside from the "centers" Joe mentioned, there were and are some books that give
quite a good overview of all the components, services and config files that take part in
GNU/Linux security.
I read these 2 a long while back, so you might want to check if either have been updated
or search for other "hardening" Linux books:
- Real World Linux® Security -- Intrusion Prevention, Detection, and Recovery, 2nd Edition
(2002)
- Practical Unix & Internet Security, 3rd Edition (2003)
Andri
On Jun 27, 2012, at 9:40 PM, Joe Wulf wrote:
The issue is far bigger than just doing a few things to close your
system up. How valuable is your system for the 'mission' it provides? What about
your data? What backup and/or disaster recovery processes have you prepared?
I'd actively migrate to a more recent edition of the OS, and put processes in place
to keep patches updated.
There are a number of places to get hardening guidance... YMMV. There is the Center for
Internet Security, DISA and NIST. Those are pretty good starting point.
From: Dov-el <dov_el(a)qx.net>
To: security(a)lists.fedoraproject.org
Sent: Wednesday, June 27, 2012 1:36 PM
Subject: my fedora 13 machine has been cracked
Someone has broken into my fedora 13 machine. Aside from closing unused ports on the
firewall and router and disabling unused services, what should I be doing to harden my set
up? Tripwire? AIDE? What else? Thanks in advance!
--
security mailing list
security(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/security
--
security mailing list
security(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/security
2:13 p.m.
Dov,
As it was mentioned if your machine was compromised, it's basically game over.
Reinstall on a different sets of hard drives, recover from a trusted backup
(pre-compromise), contact your local authorities and report the issue and be very cautious
about the other systems that may be accessible from that machine.
Jean
From: security-bounces(a)lists.fedoraproject.org
[mailto:security-bounces@lists.fedoraproject.org] On Behalf Of Dov-el
Sent: Wednesday, June 27, 2012 1:36 PM
To: security(a)lists.fedoraproject.org
Subject: my fedora 13 machine has been cracked
Someone has broken into my fedora 13 machine. Aside from closing unused ports on the
firewall and router and disabling unused services, what should I be doing to harden my set
up? Tripwire? AIDE? What else? Thanks in advance!
4322
days inactive
4322
days old
security@lists.fedoraproject.org
5 comments
6 participants
participants (6)
-
Andri Möll -
Dov-el -
Jean Gobin -
Joe Wulf -
Seth Vidal -
Tristan Santore