Comments (7)
This is great. I will work to add it in. Might be a few as we just moved and I'm knee deep in unpacking.
from how-to-secure-a-linux-server.
Sounds good, a couple things I noticed/forgot to mention.
The mounts being read only or read/write depends on their owner and permissions which I usually set to 755 (so they're not actually read only by default if you use 777). To actually make them read only, regardless of permissions, use
lxc config device add <container name> <device name> disk source=<path on host> path=<path on container> readonly=true
edit: this is better than what I wrote before about using a read-only bind mount on the host
The other thing is ufw doesn't start after a reboot if using netfilter-persistent (at least on ubuntu). The fix found here is to add the line After=netfilter-persistent.service
after Before=network.target
in the file /lib/systemd/system/ufw.service
from how-to-secure-a-linux-server.
Another thing I found that might be of interest is that a compromised container could potentially do MAC or IP spoofing on the bridge (source)
To prevent this, you can enable MAC and IP filtering by running this command for every container (if you already ran your containers, it'll probably be assigned a new IP address, which you can also set yourself by setting ipv4.address on the eth0 device)
lxc config device override <container name> eth0 security.mac_filtering=true security.ipv4_filtering=true
from how-to-secure-a-linux-server.
Have you thought about creating a new guide just for LXD? I worry if we merge the two it might create confusion for folks who aren't using LXD? Thoughts?
from how-to-secure-a-linux-server.
Have you thought about creating a new guide just for LXD? I worry if we merge the two it might create confusion for folks who aren't using LXD? Thoughts?
I was starting to work on one but stopped due to no longer using LXD myself and migrating my setup to use just docker.
I also agree, combining LXD with this guide might create confusion for people who probably don't need LXD and just be too much. It's probably still worth mentioning along with AppArmor for people who wish to go that route and that's it. I think you took a good approach by sticking to the base OS and this is a great guide as it is.
from how-to-secure-a-linux-server.
Thank you!
from how-to-secure-a-linux-server.
I think we can close this issue now, I was going to add a couple links mentioning this to the AppArmor section, but since it hasn't been written yet and I'm not familiar enough to write anything on it, I'll just leave it up to whoever does to decide if they want to mention this.
- LXD Guide (unprivileged and uses AppArmor by default) (this one goes a bit more in depth in some areas I didn't mention)
- AppArmor profiles for Docker
- Run Docker in rootless mode (alternative to using AppArmor to mitigate some potential vulnerabilities)
- Podman compose (drop-in replacement for docker compose with goal of being rootless)
from how-to-secure-a-linux-server.
Related Issues (20)
- Translate into Mandarin HOT 2
- SSH options HOT 2
- psad fails to update signatures HOT 1
- Implementing Post‑quantum Cryptography
- Gmail SMTP: You can no longer use the account's password HOT 2
- exim4 Gmail - TLS connection errors / "Authentication Required" HOT 3
- SSH keypair not able to login with passpharase HOT 1
- Fail2ban fails on fresh Debian12
- Disabling bash history on root account? HOT 3
- HashKnownHosts set to yes HOT 4
- psad missing ufw log setting
- sshd_config compression option no longer a security risk HOT 1
- sshd_config protocol 1 support completely removed resulting in protocol option being removed
- [Ubuntu 24.04] Error: fail2ban [5004]: ERROR No module named 'asynchat'
- Version this guide and create tags
- Ubuntu Guide is Unreachable HOT 1
- Suggestion: UFW Firewall for Cloudflare
- Please add Postgres section HOT 2
- Conflicting statements on CIS benchmarks HOT 1
- A dead article. HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from how-to-secure-a-linux-server.