News for hackers. Stuff that matters.
Re:Automatic server hardening framework by allendoerfer on Monday January 12, 2015 @01:38PM (#8875581)
Seems like a nice and comfortable way to set sane defaults for nginx, Apache, MySQL, PostgreSQL and some Unix stuff - but they really should have been set by each software in the first place.

I like, the private touch the screencast and the developer-designed website gives the project, even if part of a big company. This actually raises its credibility.

[ Parent | on HN ]
Re:Automatic server hardening framework by ams6110 on Monday January 12, 2015 @02:29PM (#8875881)
they really should have been set by each software

Yes, and it seems to me that distros (at least those intended for "enterprise") should be hardened by default also. If I install RHEL or OEL and then have to run a Chef or Puppet config to "harden" it, something is wrong.

[ Parent | on HN ]
Re:Automatic server hardening framework by jlawer on Monday January 12, 2015 @03:36PM (#8876261)
Well, thats been tried and rejected by the user base. If you harden too much it becomes a real PITA to do anything productive (SELinux running in strict mode).

RHEL aims to be secure, while also remaining fairly compatible with previous versions.

Red Hat do have documentation on how to harden, but most users don't use it and instead turn SELinux completely off as one of the first configuration steps.

[ Parent | on HN ]
Re:Automatic server hardening framework by iand675 on Monday January 12, 2015 @02:46PM (#8875967)
Very cool, but seems like it would be nice to have the hardening steps documented outside of code too (for those of us with more exotic provisioning tastes).
[ Parent | on HN ]
Re:Automatic server hardening framework by mikegioia on Monday January 12, 2015 @06:45PM (#8877249)
I completely agree. I was looking for the SSH settings but I don't use Puppet or Chef. This is why I prefer shell scripts so I can see what's going on and run parts of it on my own.
[ Parent | on HN ]
Re:Automatic server hardening framework by metatron31 on Thursday January 15, 2015 @12:03PM (#8893658)
You can check the references here in the lifecycle section: http://telekomlabs.github.io/docs/
[ Parent | on HN ]
Re:Automatic server hardening framework by virtuallynathan on Monday January 12, 2015 @02:33PM (#8875901)
Seems bad that it disables IPv6 "for security".
[ Parent | on HN ]
Re:Automatic server hardening framework by ownagefool on Monday January 12, 2015 @03:55PM (#8876367)
Disable anything you don't use. I wish it weren't so but IPv6 is probably a safe assumption there.
[ Parent | on HN ]
Re:Automatic server hardening framework by eropple on Monday January 12, 2015 @03:35PM (#8876256)
I don't really have a problem with that, to be honest--I certainly don't run an IPv6 network internally (and neither does anyone else on AWS) and IPv6 translation can happen at the edges.
[ Parent | on HN ]
Re:Automatic server hardening framework by crymer11 on Monday January 12, 2015 @01:55PM (#8875689)
Ansible support would be spiffy.
[ Parent | on HN ]
Re:Automatic server hardening framework by kieranajp on Monday January 12, 2015 @04:08PM (#8876421)
I was looking for the same thing; however I can't find any acknowledgement of Ansible's existence anywhere on the site or in the docs :(
[ Parent | on HN ]
Re:Automatic server hardening framework by dsl on Monday January 12, 2015 @06:29PM (#8877176)
or Salt for the cool kids.
[ Parent | on HN ]
Re:Automatic server hardening framework by zobzu on Monday January 12, 2015 @02:51PM (#8875998)
tldr its a set of open source puppet/chef/others modules to harden the default configuration of common daemons.
[ Parent | on HN ]
Re:Automatic server hardening framework by codezero on Monday January 12, 2015 @01:36PM (#8875574)
The audio on the demo video is really choppy, is that just me?
[ Parent | on HN ]
Re:Automatic server hardening framework by dewey on Monday January 12, 2015 @01:41PM (#8875595)
The same is happening for me, didn't notice it when I watched it before I posted it though. Maybe Vimeo is having problems.
[ Parent | on HN ]
Re:Automatic server hardening framework by markcampbell on Monday January 12, 2015 @02:26PM (#8875867)
It's not vimeo. Downloading the video and playing it locally with VLC yields the same problems.
[ Parent | on HN ]
Re:Automatic server hardening framework by Alupis on Monday January 12, 2015 @02:21PM (#8875835)
It this an arm of T-Mobile (the US carrier)? Their logos are strikingly similar, but their websites make no reference to each other.

Telekom Labs logo: http://www.laboratories.telekom.com/public/Deutsch/Pages/def...

T-Mobile logo: http://www.t-mobile.com/

[ Parent | on HN ]
Re:Automatic server hardening framework by Fastidious on Monday January 12, 2015 @02:24PM (#8875857)
T-Mobile is German. And yes, same company (http://en.wikipedia.org/wiki/T-Mobile).
[ Parent | on HN ]
Re:Automatic server hardening framework by dsl on Monday January 12, 2015 @05:48PM (#8876956)
T-Mobile is the US subsidiary of Deutsche Telekom.
[ Parent | on HN ]
Re:Automatic server hardening framework by pluma on Monday January 12, 2015 @09:58PM (#8877862)
Nitpicking: T-Mobile is the international mobile branch of Deutsche Telekom, not just in the US (though there is a US subsidiary).

Other branches include T-Online (private ISP, actually a former subsidiary), T-Systems (subsidiary proving services to the public sector and larger corporations) and T-Home (which I have trouble telling apart from T-Online). There may be other branches too, but in practice most people in Germany just lump them all together anyway.

[ Parent | on HN ]