SuSe Linux Hardening

UNIX for Advanced & Expert Users
1

We've got a FTP server that's open to the public network and its running on Suse SUSE Linux Enterprise Server 11 (x86_64) SP2

Now, since it's an FTP server I can't disable that service, but how else do I harden this server from attacks from outside?

I am thinking of disabling the firewall and only allow communications with FTP ports, and also changing the Selinux to enforcing mode.

Anything else anyone can think of?

2

maybe you can replace ftp by sftp ?

disable firewall ?:confused: the real problem with FTP is that service sends all data in clear text. If you allow only FTP service ...imho it is a poor protection. SeLinux is a good start. What about chroot all ftp users ?

3

On SUSE I would use a good ftpd, try AppArmor, leave that firewall on and only allow the required ports and maybe also use TCP_wrappers (it can't hurt).

1 Like
4

Have a look at the OS-hardening tool Bastille.

1 Like