Harden security settings

[JasonYao]

Splits off from #7, since security hardening contains a lot of moving parts.

[Unix] Harden default security settings

Completed:

• Install and configure Firewall - ufw
  • Completed prior
• SSH - Key based login, disable root login and change port
  • Completed prior
• Apache SSL - Disable SSL v3 support (nginx version is completed)
  • Completed prior
• Secure shared memory - fstab
  • Completed as of 12d42a97240a6cc44c2a56c845d5d4ab296bcd32
• Protect su by limiting access only to admin group
  • Completed as of 12d42a97240a6cc44c2a56c845d5d4ab296bcd32
• Harden network with sysctl settings
  • Completed as of 6dbba7c6fae92426d3434707208d34ce2ce029f4
• Scan logs and ban suspicious hosts - DenyHosts and Fail2Ban
  • Completed prior

TODO:

• Implement port knocking automatically for both client and server side
• Prevent IP Spoofing
• Intrusion Detection - PSAD
• Check for RootKits - RKHunter and CHKRootKit
• Scan open Ports - Nmap
• Analyse system LOG files - LogWatch
• SELinux - Apparmor
• Audit your system security - Tiger and Tripwire

Don't need to do:

• Disable Open DNS Recursion and Remove Version Info - (only Bind9 DNS)
• Harden PHP for security
• Restrict Apache Information Leakage
• Install and configure Apache application firewall - ModSecurity
• Protect from DDOS (Denial of Service) attacks with ModEvasive

[JasonYao]

Security hardening has been moved to an external repo, located here