Hacker Bits, August 2016

Logwatch monitors your logfiles and
when configured, sends you a daily email
with the information parsed very nicely.
your server (baring application
vulnerabilities), the attacker
would have to have:
1. Access to your certificate
and key to access VPN
2. Access to your computer
to have your private key
3. Access to your passphrase
for your private key
4. Access to your phone for
2FA
These are quite a few hurdles
to jump. Even then to gain
root access via sudo, they'd have
to have deploy's password that
is stored behind AES encryption
(5).
Install this package:
apt-get install libpam-google-authenticator
Set up by running this command
and following the instructions:
su deploy
google-authenticator
2FA is very easy and adds a
great layer of security.
Logwatch
This is really more of a simple
pleasure and monitoring tool
that helps you see what's going
on after the fact. Logwatch monitors
your logfiles and when configured,
sends you a daily email
with the information parsed very
nicely.
The output is quite entertaining
to watch and you'll be
surprised at how many attempts
are made every day to gain
access to your server. I install
it if for no other reason than to
show the team how important
good security is.
There's a great write-up by
DigitalOcean on Logwatch install
and config, but if we're keeping
to 10 minutes, we'll just install it
and run a cron job to run it and
email us daily.
apt-get install logwatch
Add a cron job:
vim /etc/cron.daily/00logwatch
Add this line to the cron file:
/usr/sbin/logwatch --output
mail --mailto you@example.com
--detail high
All done
There you are. Your main concern
and point of vulnerability
after completing this will be
your application and services.
These are another animal entirely
though.
We're making a big push to
externalize our processes and
best practices. If you're interested
in learning more, take a
look at our repository. We open
source all of our policies and
best practices, as well as continue
to add to them there.
Have suggestions or questions?
Comment below or submit
a PR/issue on the Github
repo! There are also a lot of
really good bits of info on the
Hacker News thread and /r/
netsec. •
1
Make sure it's `.pub`. This seems to
be very simple, but I've seen two people
(both *not* members of our organization
— it would be a quick way to stop
being part of our org.) in my career,
send me their private key (`id_rsa` without
the .pub extension) when asking for
their public keys.
2
There's a couple of camps on whether
to keep your SSH connection on a standard
or non-standard port. See [here]
and [here] for opposing sides.
Reprinted with permission of the original author. First appeared at codelitt.com/blog.
hacker bits
17