- Community Home
- >
- Servers and Operating Systems
- >
- Legacy
- >
- Secure OS Software for Linux
- >
- Re: LINUX Hardening guide differences
Secure OS Software for Linux
1776901
Members
2343
Online
109061
Solutions
Forums
Categories
Company
Local Language
юдл
back
Forums
Discussions
Forums
- Data Protection and Retention
- Entry Storage Systems
- Legacy
- Midrange and Enterprise Storage
- Storage Networking
- HPE Nimble Storage
Discussions
Discussions
Discussions
Forums
Forums
Discussions
юдл
back
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
- BladeSystem Infrastructure and Application Solutions
- Appliance Servers
- Alpha Servers
- BackOffice Products
- Internet Products
- HPE 9000 and HPE e3000 Servers
- Networking
- Netservers
- Secure OS Software for Linux
- Server Management (Insight Manager 7)
- Windows Server 2003
- Operating System - Tru64 Unix
- ProLiant Deployment and Provisioning
- Linux-Based Community / Regional
- Microsoft System Center Integration
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Blogs
Information
Community
Resources
Community Language
Language
Forums
Blogs
Topic Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО03-02-2010 01:38 PM
тАО03-02-2010 01:38 PM
LINUX Hardening guide differences
What is the difference between the HP Common Criteria EAL4+ Evaluated Configuration Guide for Red Hat Enterprise Linux 5 on Hardware, date 05/31/2007; 2.3 and the NSA Guide to The Secure Configuration of Red Hat Enterprise Linux 5, date 12/20/2007; Revision 2?
Is one of these more complete then the other?
Is one of these more complete then the other?
3 REPLIES 3
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО03-02-2010 01:56 PM
тАО03-02-2010 01:56 PM
Re: LINUX Hardening guide differences
Shalom,
The OS security vulnerabilities are different. HP ships in an insecure but secure able state.
Linux ships in a lot more secure state, but it can be improved.
Think about Bastille for both.
It does a nice job.
SEP
The OS security vulnerabilities are different. HP ships in an insecure but secure able state.
Linux ships in a lot more secure state, but it can be improved.
Think about Bastille for both.
It does a nice job.
SEP
Steven E Protter
Owner of ISN Corporation
http://isnamerica.com
http://hpuxconsulting.com
Sponsor: http://hpux.ws
Twitter: http://twitter.com/hpuxlinux
Founder http://newdatacloud.com
Owner of ISN Corporation
http://isnamerica.com
http://hpuxconsulting.com
Sponsor: http://hpux.ws
Twitter: http://twitter.com/hpuxlinux
Founder http://newdatacloud.com
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО03-02-2010 02:15 PM
тАО03-02-2010 02:15 PM
Re: LINUX Hardening guide differences
Based on the date of the Guides you are looking at it might be best to get into one of the RHEL Classes on SELINUX and Redhat secured over a book that is 4 years old.
I'd be inclined to pickup the NSA guide as NSA wrote the guidelines for SE enhancements which redhat adopted..
I'd be inclined to pickup the NSA guide as NSA wrote the guidelines for SE enhancements which redhat adopted..
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО03-03-2010 04:46 AM
тАО03-03-2010 04:46 AM
Re: LINUX Hardening guide differences
I've always been a fan of the Centre for Internet Security benchmark tools. They are essecentially documents, that are consensus based that help to bring things in line. Large portions of the document also include pre-written scripts to help automate the task.
http://cisecurity.org/en-us/?route=downloads
They have benchmarks for pretty much any OS, as well, they have audit tools to test against later.
Bastille is a great tool to start with, but is lacking in a number of areas. CIS also provides Bastille configs as a base, but enhances on them.
Before wasting your time on an SELinux course, check out SANS (www.sans.org). There is a UNIX specific course, which is primarily Linux based, as well as others. The Essentials bootcamp has a full day of UNIX/Linux as part of the 6-day program, which is an excellent program.
Under the SANS reading room, there are a large number of whitepapers available for pretty much any topic. All papers in here are the work of successful "gold" certifications and double-blind graded by experts in the given field being written about.
Something to remember about these documents is that they are not a "Bible". They are a series of guidelines that can lead to better security and hardening of a host. They change, they are not static, as a host that is secure today, is not secure tomorrow. Security is a journey, not a destination. No single reference is all encompassing.
With that in mind, view the documents as a valid reference, consensus based ones are better than those written in a vacuum. What is most important is understanding the risk to your critical assets, and prioritise time, and resources to reduce those risks. If there is a risk you cannot reduce, understand the risk, and most of all, understand and put in place means by which you can DETECT that the risk has been compromised.
Good luck and happy hunting,
Don
http://cisecurity.org/en-us/?route=downloads
They have benchmarks for pretty much any OS, as well, they have audit tools to test against later.
Bastille is a great tool to start with, but is lacking in a number of areas. CIS also provides Bastille configs as a base, but enhances on them.
Before wasting your time on an SELinux course, check out SANS (www.sans.org). There is a UNIX specific course, which is primarily Linux based, as well as others. The Essentials bootcamp has a full day of UNIX/Linux as part of the 6-day program, which is an excellent program.
Under the SANS reading room, there are a large number of whitepapers available for pretty much any topic. All papers in here are the work of successful "gold" certifications and double-blind graded by experts in the given field being written about.
Something to remember about these documents is that they are not a "Bible". They are a series of guidelines that can lead to better security and hardening of a host. They change, they are not static, as a host that is secure today, is not secure tomorrow. Security is a journey, not a destination. No single reference is all encompassing.
With that in mind, view the documents as a valid reference, consensus based ones are better than those written in a vacuum. What is most important is understanding the risk to your critical assets, and prioritise time, and resources to reduce those risks. If there is a risk you cannot reduce, understand the risk, and most of all, understand and put in place means by which you can DETECT that the risk has been compromised.
Good luck and happy hunting,
Don
The opinions expressed above are the personal opinions of the authors, not of Hewlett Packard Enterprise. By using this site, you accept the Terms of Use and Rules of Participation.
News and Events
Support
© Copyright 2024 Hewlett Packard Enterprise Development LP