“Part I of this article focused on basic methods to secure a
default Linux installation. Aside from SSH, no additional software
was installed on the machine to increase security. This article
will examine some additional tools that can be installed to
increase the overall security posture of a Linux system.”
“Many kernel level modifications are available to help increase
system security. Even if an attacker was to gain root access to a
machine it would be difficult, if not impossible, to circumvent
some of these security measures. Naturally, in order to take
advantage of these tools you must be familiar with rebuilding a
kernel. Typically the modifications come in the form of a patch to
apply to the Linux source code. After applying the patch, a fresh
kernel is then built. Kernel patches tend to favor more recent
kernels.”
“By default Linux does not log all TCP connections, but rather
only connections to “well-known” ports, or those ports listed in
the /etc/services file. In this day and age this is woefully
inadequate. Linux does not include any means to log any additional
ports besides those listed in /etc/services. However, there are
tools that can be added to log any TCP connection to any port.
Although extended logging mechanisms can make it easier to
determine if a system is under attack, it can also make it more
difficult at the same time by vastly increasing the amount of logs
generated, and could even in some cases lead to a denial of service
by overfilling the drive where logging takes place.”