Re: [CentOS] SIG - Hardening

2015-04-23 Thread Earl A Ramirez
On 22 April 2015 at 20:49, Mark LaPierre marklap...@gmail.com wrote: On 04/22/15 01:13, Earl A Ramirez wrote: Dear All, About a week ago; I posted a proposal over on the centos-devel mailing list, the proposal is for a SIG 'CentOS hardening', there were a few of the members of the

Re: [CentOS] SIG - Hardening

2015-04-23 Thread Earl A Ramirez
On 22 April 2015 at 20:49, Mark LaPierre marklap...@gmail.com wrote: On 04/22/15 01:13, Earl A Ramirez wrote: Dear All, About a week ago; I posted a proposal over on the centos-devel mailing list, the proposal is for a SIG 'CentOS hardening', there were a few of the members of the

Re: [CentOS] SIG - Hardening

2015-04-23 Thread Rob Townley
The most common way to get root on any box is through the web browser and web browser plugins. sandboxing firefox, acrobat reader, flash-plugin by default has gotta be a priority. Was brought up before. i use a ffSandbox.sh that launches FF in a sandbox, but no longer sandboxes PDFs. Not

Re: [CentOS] SIG - Hardening

2015-04-23 Thread Leon Fauster
Am 23.04.2015 um 02:49 schrieb Mark LaPierre marklap...@gmail.com: On 04/22/15 01:13, Earl A Ramirez wrote: Dear All, About a week ago; I posted a proposal over on the centos-devel mailing list, the proposal is for a SIG 'CentOS hardening', there were a few of the members of the community

Re: [CentOS] SIG - Hardening

2015-04-22 Thread Earl A Ramirez
On Wed, 2015-04-22 at 10:16 +0200, Tim wrote: I think, this SIG would/should care about hardening CentOS itself as a system not a complete environment (proxies, firewalls, etc.) The examples of the opener show this. Something else could be integrity checking possibly. I imagine a

Re: [CentOS] SIG - Hardening

2015-04-22 Thread Tim
I am very interested. One of my suggestions: Firewall: Network based firewall zone assignment (possibly disabling interface based assignment) Regards Tim Am 22. April 2015 07:13:52 MESZ, schrieb Earl A Ramirez earlarami...@gmail.com: Dear All, About a week ago; I posted a proposal over on

Re: [CentOS] SIG - Hardening

2015-04-22 Thread Eero Volotinen
apply also ideas from this document: https://benchmarks.cisecurity.org/downloads/show-single/?file=rhel6.130 -- Eero 2015-04-22 9:30 GMT+03:00 Tim li...@kiuni.de: I am very interested. One of my suggestions: Firewall: Network based firewall zone assignment (possibly disabling interface

Re: [CentOS] SIG - Hardening

2015-04-22 Thread Mark LaPierre
On 04/22/15 01:13, Earl A Ramirez wrote: Dear All, About a week ago; I posted a proposal over on the centos-devel mailing list, the proposal is for a SIG 'CentOS hardening', there were a few of the members of the community who are also interested in this. Therefore, I am extending that

Re: [CentOS] SIG - Hardening

2015-04-22 Thread John R Pierce
On 4/21/2015 11:34 PM, Eero Volotinen wrote: apply also ideas from this document: https://benchmarks.cisecurity.org/downloads/show-single/?file=rhel6.130 that should be your baseline. I suspect you'll find all the things you mentioned are discussed in the CIS benchmarks. -- john r

Re: [CentOS] SIG - Hardening

2015-04-22 Thread Andrew Holway
SELinux? On 22 April 2015 at 09:11, John R Pierce pie...@hogranch.com wrote: On 4/21/2015 11:34 PM, Eero Volotinen wrote: apply also ideas from this document: https://benchmarks.cisecurity.org/downloads/show-single/?file=rhel6.130 that should be your baseline. I suspect you'll find all

Re: [CentOS] SIG - Hardening

2015-04-22 Thread Eero Volotinen
Sounds like a bit basic stuff? How about hardening ciphers, two factor authentication, snort, web application firewall and scap scanning? Eero 22.4.2015 10.14 ap. Andrew Holway andrew.hol...@gmail.com kirjoitti: SELinux? On 22 April 2015 at 09:11, John R Pierce pie...@hogranch.com wrote:

Re: [CentOS] SIG - Hardening

2015-04-22 Thread Tim
I think, this SIG would/should care about hardening CentOS itself as a system not a complete environment (proxies, firewalls, etc.) The examples of the opener show this. Something else could be integrity checking possibly. I imagine a tool/script that could apply hardening stuff. Regards Tim