bk99.de entertain the web since 1997

bk99.de
CCC · Server hardeningCurated

Securing Linux and BSD servers properly

Summary

Philipp Pobaschnig shows why default installations are not a finished security strategy and how small, systematic changes close typical attack paths. Server hardening is a recurring operational process rather than a one-off checklist. The most secure feature is often the service nobody had to install.

Ideas

  • Unnecessary services enlarge the reachable attack surface.
  • Default configurations often put compatibility before least privilege.
  • Up-to-date software only prevents known bugs, not wrong permissions.
  • Logs and integrity checks make successful attacks visible earlier.

Recommendations

  • Regularly take inventory of reachable ports and the processes responsible for them.
  • Automate updates, configuration checks and tested recovery.

References

Watch the talk

Search the Web Archive

CCC · 2020

Running your own Matrix server on Arch Linux

Brendan Abolivier explains Matrix as a federated communication standard and shows how your own homeserver on Arch Linux becomes part of the network. Decentralisation distributes control but increases the demands on operations and moderation. Self-hosting only creates sovereignty with reliable updates, backups and key protection.

CCC · 2022

Linux security monitoring with audit events

Hilko Bengen shows how Linux auditd delivers fine-grained host events and how the unwieldy format can be made usable for attack detection with reasonable effort. Network monitoring only detects many attacks together with context from the affected host. More telemetry only helps if events are reliably correlated and prioritised.

CCC · 2021

Two-factor authentication for your own SSH server

Florian Winkler shows how SSH can be extended with a second factor via PAM and which configuration steps effectively secure your own Linux server. More factors only increase security if recovery and bypasses are designed just as carefully. A factor stored separately makes the theft of a single file less valuable.