List of Linux System Hardening Resources

My recent post about how quickly newly commissioned Linux systems can be attacked and possibly compromised led to a bunch of e-mail queries about resources which explain how to lock down a variety of Linux distributions. Most such guides are distribution specific because, while the basic principles are always the same, there are significant differences between distributions and even versions of the same distribution that make writing a generic guide difficult at best.

I did compile a list which I added to the comments. However, based on the number of questions I've received I thought it would be best to publish the list as a blog post, something people could easily find and bookmark, with some additions to what I originally posted. I've limited this list to distributions commonly used in businesses (large and small), academia, and in non-profits. I have not included specialized distributions, including those designed for use by security professionals. Most of these distributions also are excellent choices for personal use.


Red Hat Enterprise Linux / Centos / Scientific Linux / Springdale Linux

• Red Hat Enterprise Linux 7 Security Guide
  Chapter 4: Hardening Your System with Tools and Services
• Red Hat Enterprise Linux 6 Security Guide
  
• University of Texas Red Hat Enterprise Linux 7 Hardening Checklist
  
• CIS Red Hat Enterprise Linux Security Benchmarks

Debian

• Securing Debian Manual
  
• Debian Wiki: Hardening

SUSE

• Suse Linux Enterprise Server 11 SP4 Security and Hardening
  
• OpenSUSE Security Portal

Ubuntu

• Harden Ubuntu
  
• Ubuntu Community Help Wiki: Security

32-bit Enterprise Linux Still Matters

I've been testing the Red Hat Enterprise Linux 7 Release Candidate. One thing that stuck out right away was the lack of a 32-bit x86 build. In last week's DistroWatch Weekly Jesse Smith questioned the need for such a build, which is only useful on legacy hardware, in the enterprise. He wrote:

"Something which caught my attention while reading this question was the requirement for a 32-bit operating system with newer software than Red Hat Enterprise Linux 6 offers. It seems unusual that someone would want new software versions, enterprise support and a 32-bit operating system. New software and legacy hardware (or new software and enterprise environments) rarely go together and it might be worth looking into whether these criteria are really necessary."

While I certainly understand Jesse's point about 32-bit being legacy hardware, there are still many use cases where 32-bit and current enterprise quality software and OS are necessary. Many current Linux apps are still very light and can run very well on rather old hardware, both in the server room and on the desktop.

I've done a lot of support of government servers and they run for about forever, as in until they serve no further use. Even retired, old servers are often repurposed and put back into service due to budget restrictions and/or long lead times to order new equipment under the required procedures for government procurement. In the United States this is especially true at the state level. When a server is repurposed it is usually reloaded with the current enterprise standard Linux distrubution release and applications, not legacy releases. That's one common use case.

Non-profits and small businesses often get by with older equipment as well, and in the case of non-profits it may even be donated second hand equipment that was no longer useful in it's former commercial enterprise home. Once again, a 32-bit OS and current software makes sense in cases like this.

My personal hope is that the free enterprise Linux clones will take Red Hat's 64-bit sources and create a 32-bit version. It isn't hard to do but it is time consuming. CentOS has already made clear they will release a 32-bit build(see comment by developer Johnny Hughes below), which leaves Scientific Linux and Springdale Linux.

[Note: This article was expanded from my comments on DistroWatch Weekly, Issue 560.]