Timeline for How can I protect against intrusion and malware before connecting it to the internet (especially on a public IP address)?
Current License: CC BY-SA 3.0
25 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 11, 2017 at 23:06 | comment | added | user2497 | @AlexChamberlain Only if iptables sends RST, instead of dropping the synpackets. | |
| Jul 11, 2017 at 23:05 | comment | added | user2497 | @Anders No it's not a bad idea, it is a thin layer in many layers of security. When using ShodanHQ (for example), default ports are bannergrabbed; to do a full scan you have to do it yourself, possibly triggering IDS, and some hyper people will immediately report you to abuse@isp. Don't assume that every scriptkiddie uses a VPS to scan, often recon is done days or weeks in advance. | |
| S Jul 11, 2017 at 18:12 | history | suggested | Blair | CC BY-SA 3.0 |
permissions are controlled through octal, not hex
|
| Jul 11, 2017 at 16:29 | review | Suggested edits | |||
| S Jul 11, 2017 at 18:12 | |||||
| Oct 10, 2013 at 6:54 | history | edited | Jivings | CC BY-SA 3.0 |
deleted 121 characters in body
|
| Oct 10, 2013 at 6:47 | history | edited | Jivings | CC BY-SA 3.0 |
deleted 121 characters in body
|
| Aug 6, 2013 at 10:39 | comment | added | dotancohen |
I see that my pi has /etc/passwd set as 0644 permissions by default. I am hesitant to change that default. In fact, it seems that Ubuntu Server uses the same default. If 0600 is fine, then why do these major distros ship the file with 0600?
|
|
| Aug 22, 2012 at 23:04 | comment | added | John La Rooy | I agree. My point was that it's not just thereotical - there has been a time in recent memory where SBO definitely did help, and made a significant difference. | |
| Aug 22, 2012 at 22:51 | comment | added | Jivings | @gnibbler I still maintain that SBO can be a valuable contribution. Especially in relation to the time it takes to enable (10 seconds). | |
| Aug 22, 2012 at 22:42 | comment | added | John La Rooy | @AlexChamberlain, During the debian ssh key debacle we logged a lot of attempts at port 22 and none anywhere else. In that instance, running on a different port would have bought you lots of time while the hackers were trying to work out which of the exploited hosts were valuable. SBO doesn't help nearly as much if the attacker is targeting you specifically. | |
| Jul 15, 2012 at 3:16 | comment | added | Anders | Security through obscurity is a horrible "sollution". Much, much better to use a firewall, like ufw instead. If you don't want that much in the logs, then use your firewall and restrict the number of possible connections per time unit instead. With ufw, that is quite easy to do. | |
| Jul 5, 2012 at 3:58 | comment | added | Beeblebrox | Changing default ports tends to lower door-knocking which often leads to dictionary attacks. Sure it's a terribly minor security measure but it has other benefits as well i.e. it can limit log bloat. It's more of a preventative action than security but still worthy of consideration. | |
| Jun 20, 2012 at 15:30 | comment | added | Jivings |
I spoke about this in chat. I chose to omit iptable due it being quite complex to explain briefly and the fact its not generally included in the preinstalled packages. Feel free to add it.
|
|
| Jun 20, 2012 at 14:50 | comment | added | Alex Chamberlain |
I am a tool - I meant iptable!
|
|
| Jun 20, 2012 at 14:30 | comment | added | Jivings |
@AlexChamberlain: I have no idea how one would relate ifconfig to the use of a firewall. It only controls the state of network interfaces. Also it's in the process of being deprecated.
|
|
| Jun 20, 2012 at 14:26 | comment | added | Alex Chamberlain | A firewall should be installed and configured; ifconfig is the perfect candidate. | |
| Jun 20, 2012 at 14:25 | comment | added | Jivings |
@AlexChamberlain: Arguments for SBO. What about ifconfig?
|
|
| Jun 20, 2012 at 14:15 | comment | added | Alex Chamberlain |
Not convinced. Furthermore, you need to mention ifconfig!
|
|
| Jun 20, 2012 at 11:38 | history | edited | Jivings | CC BY-SA 3.0 |
added 5 characters in body
|
| Jun 20, 2012 at 11:05 | comment | added | Jivings | @AlexChamberlain It is a temporary speed-bump for attackers, but by no means a complete solution alone. | |
| S Jun 20, 2012 at 11:04 | history | suggested | Alex Chamberlain | CC BY-SA 3.0 |
Disable root login regardless.
|
| Jun 20, 2012 at 11:03 | comment | added | Alex Chamberlain | I disagree with your Obscurity remark, it would take seconds to map the ports open on your device and find your ssh server. Disable password logins and stick to the normal ports. I doubt you need ftp at all, use scp instead. | |
| Jun 20, 2012 at 11:01 | review | Suggested edits | |||
| S Jun 20, 2012 at 11:04 | |||||
| Jun 20, 2012 at 10:36 | history | edited | Jivings | CC BY-SA 3.0 |
deleted 12 characters in body
|
| Jun 20, 2012 at 10:18 | history | answered | Jivings | CC BY-SA 3.0 |