2.8. Hardening Pyramid

Problem

You want your little routerboard to be as hardened as you can make it. What steps can you take to make it as secure as possible?

Solution

Your first job is to change root's password to something a little less obvious than "root," the default password. Run these commands:

	pyramid:~# /sbin/rw
	pyramid:~# passwd

Then, add an unprivileged user for remote logins over SSH:

	pyramid:~# useradd -m alrac
	pyramid:~# passwd alrac

You'll need to set the setuid bit on the su command so that ordinary users can su to root:

	pyramid:~# chmod +s /bin/su

Next, harden OpenSSH: disable root logins over SSH, disable password logins, and set up public-key authentication. Chapter 7 tells how to do all this.

Turn off unnecessary services and network interfaces. If you're not going to use the web interface or SSH login, turn them off. SSH is disabled by changing its startup command to a kill command, like this:

	pyramid:/etc/rc2.d# mv S20ssh K20ssh

The web GUI is disabled by commenting out this line in /etc/inittab:

	# Lighttpd (with FastCGI, SSL and PHP)
	HT:23:respawn:/sbin/lighttpd -f /etc/lighttpd.conf -m /lib -D > /dev/null 2>&1

Pay close attention to your application security. Because this is a multihomed device, configure your applications to use only the interfaces they need to, and allow only authorized users. Keep your user accounts tidy, and don't leave unused ones lying around. Use good strong passwords, written down and stored in a safe place.

Run Netstat locally and Nmap remotely to see what services are listening, and to see what the outside world sees.

When you're finished, don't forget to run /sbin/ro to set the filesystem back to read-only.

Discussion

That's right, the same old basic steps for any Linux. They work.

2.8. Hardening Pyramid

Problem

Solution

Discussion

See Also