Linux server security - Revision history

Lilith2 at 14:55, 26 July 2015

2015-07-26T14:55:01Z

Lilith2: /* Installing intrusion detection */

2015-07-26T14:52:05Z

‎Installing intrusion detection

Lilith2: /* tripwire */

2015-07-26T14:35:59Z

‎tripwire

Lilith2 at 14:35, 26 July 2015

2015-07-26T14:35:06Z

Lilith2 at 14:34, 26 July 2015

2015-07-26T14:34:23Z

Lilith2 at 14:18, 26 July 2015

2015-07-26T14:18:06Z

Lilith2 at 14:06, 26 July 2015

2015-07-26T14:06:38Z

Lilith2 at 14:05, 26 July 2015

2015-07-26T14:05:19Z

Lilith2 at 14:04, 26 July 2015

2015-07-26T14:04:24Z

Lilith2: Created page with "== Server connections == === Remote commands and procedure calls === ssh, rssh, scp and sftp. Remote Procedure Calls (RPC), Portmapper === Network Wrappers (PAM) === ===..."

2015-07-21T09:18:13Z

Created page with "== Server connections == === Remote commands and procedure calls === ssh, rssh, scp and sftp. Remote Procedure Calls (RPC), Portmapper === Network Wrappers (PAM) === ===..."

New page

== Server connections ==

=== Remote commands and procedure calls ===

ssh, rssh, scp and sftp.

Remote Procedure Calls (RPC), Portmapper

=== Network Wrappers (PAM) ===

=== ICMP ===

Blocking ICMP and look invisible to ping.

=== Traffic control ===

Traffic Control (TC) and TC New Generation (TCNG)

← Older revision		Revision as of 14:55, 26 July 2015
Line 6:		Line 6:

	=== snort ===		=== snort ===
		+
		+	== Firewall ==
		+
		+	=== iptables ===
		+
		+	=== netfilter ===

	== Server connections ==		== Server connections ==

← Older revision		Revision as of 14:52, 26 July 2015
Line 4:		Line 4:

	=== tripwire ===		=== tripwire ===
		+
		+	=== snort ===

	== Server connections ==		== Server connections ==

← Older revision		Revision as of 14:35, 26 July 2015
Line 4:		Line 4:

	=== tripwire ===		=== tripwire ===
−
−	~~== Installing~~

	== Server connections ==		== Server connections ==

@@ Line 20: / Line 20: @@
 Blocking ICMP and look invisible to ping.
 == Backups ==
@@ Line 28: / Line 32: @@
 === Backup with unison ===

@@ Line 21: / Line 21: @@
 Blocking ICMP and look invisible to ping.
-== Traffic analysis ==
+== Backups ==
-=== snort ===
+=== Backup over ssh ===
 === Traffic control ===
 Traffic Control (TC) and TC New Generation (TCNG)

@@ Line 1: / Line 1: @@
-== Intrusion detection ==
+== Installing intrusion detection ==
-In hostile environments such as server environments, using a FIA makes sense only if it is installed, fully configured and initialised at the very first boot after an installation from scratch, before ever connecting to the internet or doing anything else. It takes only one attack to install a backdoor. Installing ''aide'' or ''tripwire'' after such an event would guarantee that the backdoor remains just as open as the day an intruder installed it.
+In hostile environments such as server environments, using a FIA makes sense only if it is installed, fully configured and initialised at the very first boot after an installation from scratch, before ever connecting to the internet or doing anything else. It takes only one attack to install a backdoor. Installing ''aide'' or ''tripwire'' after such an event would guarantee that the backdoor remains just as open as the day an intruder installed it. For more on ''aide'' vs ''tripwire'', see [[Linux applications#Intrusion detection|Linux applications: Intrusion detection]], and for an example install of aide, see [[Linux_security#Installing_intrusion_detection|Linux security: Installing intrusion detection]].
-−
 For more on aide vs tripwire, see [[Linux applications#Intrusion detection]], and for an example install of aide, see [[Linux_security#Installing_intrusion_detection]]
 === tripwire ===
-== Traffic
+== Installing
-−
-=== snort ===
 == Server connections ==
@@ Line 24: / Line 20: @@
 Blocking ICMP and look invisible to ping.
 === Traffic control ===
 Traffic Control (TC) and TC New Generation (TCNG)

@@ Line 3: / Line 3: @@
 In hostile environments such as server environments, using a FIA makes sense only if it is installed, fully configured and initialised at the very first boot after an installation from scratch, before ever connecting to the internet or doing anything else. It takes only one attack to install a backdoor. Installing ''aide'' or ''tripwire'' after such an event would guarantee that the backdoor remains just as open as the day an intruder installed it.
-For more on aide vs tripwire, see [[Linux applications#Intrusion detection]], and for an example install of aide, see [[Linux security#Installing intrusion detection: aide]]
+For more on aide vs tripwire, see [[Linux applications#Intrusion detection]], and for an example install of aide, see [[Linux_security#Installing_intrusion_detection:_aide]]
 === tripwire ===

← Older revision		Revision as of 14:04, 26 July 2015
Line 1:		Line 1:
		+	== Intrusion detection ==
		+
		+	In hostile environments such as server environments, using a FIA makes sense only if it is installed, fully configured and initialised at the very first boot after an installation from scratch, before ever connecting to the internet or doing anything else. It takes only one attack to install a backdoor. Installing ''aide'' or ''tripwire'' after such an event would guarantee that the backdoor remains just as open as the day an intruder installed it.
		+
		+	For more on aide vs tripwire, see [[Linux applications#Intrusion detection]], and for an example install of aide, see [[Linux security#Installing intrusion detection: aide]]
		+
		+	=== tripwire ===
		+
		+	== Traffic
		+
		+	=== snort ===
		+
	== Server connections ==		== Server connections ==