What You Need to Know as an Administrator
You got yourself a position, or made a decision, or run a public server. Great! Hope this checklist helps, I certaintly haven't thought of every one of these things when I was starting out.
- Every app, every binary, every package that exists on the server is a liability. Subscribe to the 'least bit' principle; if it's not installed, it can't be compromised.
- Implement intrusion detection, such as Tripwire or similar, and scan frequently.
- Invest in a hardware firewall and only open the ports you need for your application. Do not allow your administration ports (ssh, rdp etc) to be publicly visible; restrict them to approved management IP addresses.
- Have backups of your firewall/switch/router configurations at the time of going into production. If one of those devices is compromised, it is significantly faster to recover from by wiping the device's brain and reloading the config than to perform a line by line audit of the config when the clock's ticking.
- nmap your environment from the outside frequently to ensure no new ports have opened.
- Never trust the internet; make sure whatever it is that you're serving up to the net is a safe as it can be (perform server-side input validation and sanitisation to stop SQL-injection attacks, for example).
- Keep on top of your patching.
- If you are compromised, rebuild from scratch with freshly downloaded media. You can no longer trust your backups are safe and haven't also become compromised (although tripwire can help with this) for anything other than inert, non-executable data.
If you have any comments, feel free to post them below or find us on Twitter and Facebook!
- Until next time!
Have questions or suggestions? @ us on Twitter and Facebook, and stay updated on new releases and articles.
November 19 2021