News for hackers. Stuff that matters.

A comment on How to Secure a Linux Server.

Re:How to Secure a Linux Server by supakeen on Saturday February 16, 2019 @09:30AM (#19178681)
No mention of shipping off logs to another place? It's probably good to assume someone will gain access and make after-the-fact forensics a primary concern as well.

Something a lot of hardening guides seem to skip!

[ Parent | on HN ]
Re:How to Secure a Linux Server by Someone1234 on Saturday February 16, 2019 @10:20AM (#19178928)
A lot of hardening guides skip the long tail for security.

Which is to say: So you've shipped logs off, so then what? How are you going to monitor those regularly, what are you looking for, how are you going to make sure important information stands out?

Many people set up remote logging and then never check the logs until after there is an issue. An unread log isn't useful. Logs that are too spammy aren't going to be read.

[ Parent | on HN ]
Re:How to Secure a Linux Server by imthenachoman on Monday February 18, 2019 @06:27PM (#19195435)
Good idea. I need to figure out how to work that in into the guide. I added to the to-do list. Thanks!
[ Parent | on HN ]