A major reason for malicious attacks on Linux servers has been poorly implemented security or existing vulnerabilities. When configuring a server, security policies need to be implemented properly, and ownership needs to be taken in order to properly customize the server.
General Policy:
The administration of all the internal servers in an organization is the responsibility of a dedicated team, which should also keep a look out for any kind of compliance. If any compliance takes place, the team should accordingly implement or review the security policy.
When configuring internal servers, they must be registered in such a way that the servers can be identified on the basis of the following information:
Location of the server
The operating system version and its hardware configuration
Services and applications that are being run
Any kind of information in the organization's management system must always be kept up to date.
Configuration Policy:
The operating system on the server should be configured in accordance with the guidelines approved for InfoSec.
Any service or application not being used should be disabled wherever possible.
All access to the services and applications on the server should be monitored and logged. They should also be protected through access-control methods. An example of this will be covered in Chapter 3, Local Filesystem Security.
The system should be kept updated, and any recent security patches, if available, should be installed as soon as possible.
Avoid using a root account to the maximum extent. It's preferable to use security principles that require the least amount of access to perform a function.
Any kind of privileged access must be performed over secure channel connection (SSH) wherever possible.
The server should be accessed in a controlled environment.
Monitoring Policy:
All security-related actions on server systems must be logged, and audit reports should be saved as follows:
For a period of 1 month, all security-related logs should be kept online
For a period of 1 month, daily backups as well as weekly backups should be retained
For minimum of 2 years, full monthly backups should be retained
Any event related to security being compromised should be reported to the InfoSec team. They shall then review the logs and report the incident to the IT department.
A few examples of security-related events are as follows: