This document provides instructions for hardening the security of an Ubuntu 16.04 server. It outlines 27 steps to secure the server, including updating packages, restricting root access, removing unnecessary services like FTP, configuring a firewall and SSH, enforcing password policies, and logging and monitoring the system. References are provided for additional information on implementing each security measure.

1. Executive MSc in Information Security
Assignment:
Advance Computer Security
Prepared By:
Mohomed Shihan Suhail |EMSC 1515104
Submitted to:
Mr. Kushan Sharma
Due Date:
27-August-2016 (13:00PM)

2. • Information security: a “well-informed sense of assurance that the information
risks and controls are in balance.” —Jim Anderson, Inovant (2002)
Summery
In today’s technology environment, organizations are becoming more and more
dependent on their information security. The public is increasingly concerned about
the proper use of information, particularly personal data. The threats to information
systems from criminals and terrorists are increasing. Many organizations will identify
information as an area of their operation that needs to be protected as part of their
system of internal control.

3. ADVANCED COMPUTER SECURITY
1. Ubuntu 16.04 and hardening process
1.Update the server with latest security patches released by the vendor.
2. Create Separate Partition for /tmp.
3. Set nodev option for /tmp Partition.
4. Bind Mount the /var/tmp directory to /tmp.
5. Set Boot Loader Password so that anyone rebooting the system must enter a password before
being able to set command line boot parameters.

4. 6. Set a password for the root user to force authentication in single user mode.
7. Remove X Window system and make sure that it is not installed.
8. Configure the server in such a way that it synchronizes system clocks across a variety of
systems and use a source that is highly accurate.
9. Remove FTP Server and make sure that it is not enabled.

5. 10. Configure Mail Transfer Agent for Local-Only Mode. This will ensures that the system will
only process local mails.
11. Make sure that the rsync service is not enabled. The rsyncd service can be used to
synchronize files between systems over network links,
12. Disable Send Packet Redirects. As a host itself does not act as a router (in a host only
configuration), there is no need to send redirects.
13. Disable the acceptance of ICMP redirect messages.
14. Activate logs suspicious packets by enabling logging packets with un-routable source
addresses to the kernel log.

6. 15. Enforce accessing the system for specified IP Address range (i.e. 192.168.10.0/24) by
enforcing TCP Wrappers. You may used /etc/host.allow.
16. Enable the host-based firewall and make sure that any outsider can only access webserver
hosted at port 80.
17. Install configure and make sure that the rsyslog is active.
18. Configure logrotate to avoid filling up the system with logs or making the logs unmanageable
large.

7. 19. Enable cron daemon and configure it to take a backup of the web server access and error logs
on everyday at 11.55pm.
21. Configure the server so that it will lock out users after 5 unsuccessful consecutive login
attempts. User accounts should be locked out for 30 minutes.

8. 22. Limit password reuse to prevent users from recycling 5 recent passwords. This will ensure
that the users cannot reuse most recently used passwords.
23. Disable telnet, ftp, rlogin, rsh, and rcp and install and configure ssh for remote access. SSH
settings should be configured to meet below listed requirements.
Disable telnet
Disable rlogin
Remove line in /etc/inetd.conf
#login stream tcp nowait root /usr/sbin/tcpd /usr/sbin/in.rlogind
Disable rsh
Remove shell, login, or exec lines in /etc/inetd.conf
#shell stream tcp nowait root /usr/sbin/tcpd /usr/sbin/in.rshd
#login stream tcp nowait root /usr/sbin/tcpd /usr/sbin/in.rlogind
#exec stream tcp nowait root /usr/sbin/tcpd /usr/sbin/in.rexecd

9. Disable rcp
a. Set SSH Protocol to 2
b. Set LogLevel to INFO
c. Set X11Forwarding to no
d. Set MaxAuthTries to 4
e. Set PermitRootLogin to no
f.Set PermitEmptyPasswords to no
24. Set SSH Banner and it should only display your full name and the registration number.
2. Web Host
Install Apache, PHP7 and MySQL on the server and configured with own database named as
“database” site hosted as cgm/index.php
Root user-“root”
Password- ACSB2#Cicra@2016
Sample project for Laksiri seva and database name “database”
URL: http://Localhost/index.php
Terminal View (Lynx)

10. Reference Guide
Ubuntu 16.0.4
1. Setting up /tmp partition and nodev for /tmp partition
http://www.md3v.com/mount-the-tmp-partition-with-noexec-and-nosuid-options.
http://www.cyberciti.biz/faq/howto-mount-tmp-as-separate-filesystem-with-noexec-nosuid-nodev/
installing lamp https://www.digitalocean.com/community/tutorials/how-to-install-linux-apache-mysql-php-
lamp-stack-on-ubuntu-14-04
http://www.cyberciti.biz/faq/linux-add-nodev-nosuid-noexec-options-to-temporary-storage-partitions/
2. Grub Password
http://www.ostechnix.com/configure-grub-2-boot-loader-settings-ubuntu-16-04/
https://help.ubuntu.com/community/Postfix
http://www.tecmint.com/password-protect-grub-in-linux/
3. Grub protecting
https://blog.sleeplessbeastie.eu/2015/01/06/how-to-password-protect-grub-entries/
4. Xorg configuring
http://www.ubuntugeek.com/ubuntu-tiphow-to-removeinstall-and-reconfigure-xorg-without-reinstalling-
ubuntu.html
http://askubuntu.com/questions/73219/remove-packages-to-tranform-ubuntu-desktop-to-server
http://www.redwireservices.com/remote-x11-for-linux-unix
5. Postfix configuring only to send
https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-postfix-as-a-send-only-smtp-
server-on-ubuntu-14-04
https://help.ubuntu.com/community/Postfix
https://www.digitalocean.com/community/tutorials/how-to-install-and-setup-postfix-on-ubuntu-14-04
https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-postfix-as-a-send-only-smtp-
server-on-ubuntu-16-04
6. ICMP redirects blocking
http://www.tldp.org/LDP/solrhe/Securing-Optimizing-Linux-RH-Edition-v1.3/chap5sec57.html
http://askubuntu.com/questions/118273/what-are-icmp-redirects-and-should-they-be-blocked
http://www.itsyourip.com/Security/how-to-disable-icmp-redirects-in-linux-for-security-
redhatdebianubuntususe-tested/
7. Log configuring
http://www.cyberciti.biz/faq/linux-kernel-etcsysctl-conf-security-hardening/
http://www.cyberciti.biz/faq/linux-log-suspicious-martian-packets-un-routable-source-addresses/
http://www.cyberciti.biz/faq/linux-kernel-etcsysctl-conf-security-hardening/

11. 8. Setting up tcp wrappers
https://www.centos.org/docs/5/html/Deployment_Guide-en-US/ch-tcpwrappers.html
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/3/html/Reference_Guide/s1-
tcpwrappers-access.html
9. Setting up firewall in ubuntu
https://www.digitalocean.com/community/tutorials/how-to-set-up-a-firewall-with-ufw-on-ubuntu-14-04
10. Rsync desabling
https://www.loggly.com/docs/troubleshooting-rsyslog/
11. Log rotate configuring
http://www.thegeekstuff.com/2011/07/rotate-apache-logs
12. Cron tab configure
http://www.cyberciti.biz/faq/howto-linux-unix-start-restart-cron/
https://help.ubuntu.com/community/CronHowto
http://www.computerhope.com/unix/ucrontab.htm
http://www.debianhelp.co.uk/schedulejobs.htm
13. Password policy
http://askubuntu.com/questions/244115/how-do-i-enforce-a-password-complexity-policy
http://xmodulo.com/set-password-policy-linux.html
14. Fail login attempts
http://websistent.com/linux-password-lockout-policy/
http://www.cyberciti.biz/tips/rhel-centos-fedora-linux-log-failed-login.html
http://www.cyberciti.biz/tips/lock-unlock-set-number-of-login-attempts.html
15. Standerd and audit information
https://benchmarks.cisecurity.org/tools2/linux/CIS_Ubuntu_14.04_LTS_Server_Benchmark_v1.0.0.pdf
16. Configring unsuccessfull password attepts relock
https://ubuntuforums.org/showthread.php?t=1024263
17. Configring open SSH
https://help.ubuntu.com/community/SSH/OpenSSH/Configuring