ndice

ndice

Prlogo ........................................................................................................11
&DStWXOR,,QWURGXFFLyQDODIRUWLFDFLyQ ...............................................13
,QWURGXFFLyQDODIRUWLFDFLyQGHHQWRUQRV ............................................................13
2. Defensa en profundidad ............................................................................................15
Procedimientos, concienciacin y polticas .................................................................16
6HJXULGDGItVLFD ...........................................................................................................17
Seguridad del permetro ...............................................................................................17
Seguridad en la red interna ..........................................................................................19
Seguridad a nivel de servidor ......................................................................................20
Seguridad en la aplicacin ...........................................................................................20
6HJXULGDGDQLYHOGHODLQIRUPDFLyQ ............................................................................21
3. Mnimo privilegio posible .........................................................................................22
4. Mnimo punto de exposicin.....................................................................................22
5. Gestin de riesgos ......................................................................................................24

Captulo II. Proteccin fsica ....................................................................27

1. BIOS / UEFI ...............................................................................................................27
2. Gestor de arranque. GRUB y GRUB2 ....................................................................28
Impacto de un gestor de arranque no protegido...........................................................28
Proteccin del gestor de arranque ................................................................................31
3URWHFFLyQGHOVLVWHPDGHFKHURV ............................................................................33
&RQFHSWRGHDFFHVRDXQVLVWHPDGHFKHURV ..............................................................33
&LIUDGRGHGLVFRRSDUWLFLRQHV .....................................................................................34
&LIUDGRGHFKHURV ....................................................................................................44
JJJ

Hardening de servidores GNU/Linux

6REUH*3*\VXPRGRGHIXQFLRQDPLHQWR ..................................................................45
&LIUDGRVLPpWULFRFRQ*3* .........................................................................................46
&LIUDGRDVLPpWULFRFRQ*3* ........................................................................................47
5. Otras protecciones .....................................................................................................49

Captulo III. Proteccin perimetral..........................................................51

1. iptables........................................................................................................................51
Qu es iptables? .........................................................................................................51
Funcionamiento de iptables .........................................................................................51
Decisin de enrutamiento ............................................................................................52
Tablas ...........................................................................................................................52
Agregando reglas con iptables .....................................................................................54
Listando reglas con iptables.........................................................................................56
Eliminando reglas aplicadas ........................................................................................56
&DPELDQGRSROtWLFDSRUGHIHFWR ...................................................................................57
Haciendo las reglas permanentes .................................................................................57
Firewall de 2 patas.....................................................................................................58
Firewall de 3 patas.....................................................................................................63
Front-ends para iptables ...............................................................................................72
iptables e ipv6 ..............................................................................................................73
2. VPN .............................................................................................................................75
'HQLFLyQ\WLSRV .........................................................................................................75
PPTP, Point-to-point Tunneling Protocol ....................................................................76
OpenVPN .....................................................................................................................80
3. Monitorizacin de la red ...........................................................................................97
Icinga ...........................................................................................................................97

Captulo IV. Proteccin de la red interna ..............................................107

6SRRQJRVXSODQWDFLyQGHLGHQWLGDG....................................................................107
ARP Poisoning ...........................................................................................................108
'+&36SRRQJ ......................................................................................................... 113
ICMP Redirect ........................................................................................................... 116
JJJ

ndice

2. VLAN ....................................................................................................................... 118

&RQJXUDFLyQGH9/$1HQ/LQX[ ............................................................................ 119
3. IPsec .........................................................................................................................120
6REUHHOIXQFLRQDPLHQWRGH,3VHF..............................................................................121
,3VHFFRQ/LQX[ .........................................................................................................125
4. IDS Snort .................................................................................................................145
,QVWDODFLyQGH6QRUWGHVGHORVUHSRVLWRULRVRFLDOHVGH'HELDQ ................................147

Captulo V. Proteccin de la capa de aplicacin ....................................153

-DXODVFRQFKURRW.....................................................................................................153
Prueba de concepto de una jaula con chroot ..............................................................154
2. Permisos especiales, atributos y ACL....................................................................157
Un poco de teora bsica de permisos........................................................................157
Permisos especiales ...................................................................................................158
Atributos ....................................................................................................................160
ACL, Access Control List ..........................................................................................162
3. Elevacin de privilegios con sudo........................................................................166
Instalacin de sudo y anlisis de sus componentes ...................................................166
(MHPSORGHFRQJXUDFLyQSDUDVXGR..........................................................................170
4. Limitacin de recursos ...........................................................................................172
Inicio de sesin, passwords y lmites .........................................................................172
Cuotas de almacenamiento ........................................................................................182
Monit..........................................................................................................................185
5. Port-Knocking .........................................................................................................188
SPA, Single Packet Authorization..............................................................................189
6. Actualizaciones seguras en Debian ........................................................................194
Es seguro apt? ..........................................................................................................194
7. HIDS, Host-based Intrusion Detection System ....................................................200
OSSEC .......................................................................................................................200

&DStWXOR9,)RUWLFDFLyQGHXQHQWRUQR/$03 ..................................211
1. Instalacin de un entorno LAMP .......................................................................... 211
JJJ

Hardening de servidores GNU/Linux

2. MySQL .....................................................................................................................214
Direccin de escucha .................................................................................................214
&DUJDGHFKHURVORFDOHV ...........................................................................................214
Renombrar el usuario root .........................................................................................215
&RPSUREDUH[LVWHQFLDGHXVXDULRVDQyQLPRV ............................................................215
Controlar los privilegios de los usuarios ...................................................................216
mysql_secure_installation..........................................................................................216
3. PHP...........................................................................................................................216
H[SRVHBSKS ................................................................................................................217
display_errors ............................................................................................................217
open_basedir ..............................................................................................................217
GLVDEOHBIXQFWLRQV .......................................................................................................218
Deshabilitar RFI.........................................................................................................218
Suhosin ......................................................................................................................219
$SDFKH ......................................................................................................................220
&RQJXUDFLRQHVJOREDOHV ...........................................................................................220
'HVKDELOLWDULQIRUPDFLyQRIUHFLGDSRUHOVHUYLGRU .....................................................221
&RQJXUDFLRQHVSRUFRQWH[WR ....................................................................................222
mod_security..............................................................................................................226
HTTPS .......................................................................................................................228

&DStWXOR9,,)RUWLFDFLyQ\VHJXULGDGHQ66+ ...................................233
1. Introduccin a SSH .................................................................................................233
Funcionamiento del protocolo ...................................................................................233
/DSULPHUDFRQH[LyQ ..................................................................................................235
&RQJXUDFLyQGHOVHUYLFLR ......................................................................................235
Archivos del servicio .................................................................................................236
Directivas bsicas ......................................................................................................238
Autenticacin con contrasea ....................................................................................241
Clave pblica y clave privada ....................................................................................242
5HVXPHQGHOSURFHVRGHFRQH[LyQ .............................................................................244
3. Aplicaciones con SSH ..............................................................................................246
JJJ

ndice

Copia segura con SCP................................................................................................246

FTP seguro con SFTP ................................................................................................248
SSHFS: El sistema de archivos de SSH ....................................................................248
;IRUZDUGLQJFRQ66+ ...........................................................................................250
Fail2ban .....................................................................................................................250
4. Tunneling ..................................................................................................................253
SSH: tunneling ...........................................................................................................253
7~QHOHV7&3,3FRQSRUWIRUZDUGLQJPHGLDQWH66+ .................................................256
5. SOCKS con SSH ......................................................................................................256
Habilitando y utilizando SOCKS...............................................................................257

Captulo VIII. Logging ............................................................................261

1. Consideraciones previas..........................................................................................261
2. rsyslogd .....................................................................................................................262
&ODVLFDFLyQGHPHQVDMHV)DFLOLW\\VHYHULW\ ..........................................................262
&RQJXUDFLyQGHUV\VORJG .........................................................................................263
3. Rotacin de logs .......................................................................................................265
)LFKHURVGHFRQJXUDFLyQGHORJURWDWH ......................................................................265
Output channels y logrotate .......................................................................................268
4. Logging remoto o centralizado ...............................................................................269
&RQJXUDFLyQGHODPiTXLQD$..................................................................................269
&RQJXUDFLyQGHODPiTXLQD% .................................................................................269
2WUDVFRQJXUDFLRQHVLQWHUHVDQWHV ............................................................................271

ndice alfabtico .......................................................................................273

ndice de imgenes ...................................................................................277
Libros publicados .....................................................................................281

JJJ