I'm running some tor exitrelays with rsyslog off. Does this disable ALL loggin? If no how I disable ALL loggin? Next to that I want to secure those against hijacking as good as possible. So I was thinking to disable root and all sudoers. Which commands and file I need to remove for that. And what about blocking port except for the needed ports for tor etc etc.
Person with the best/most complete answer will get $50 bitcoin, please leave your wallet adress after answering
Does this disable ALL loggin?
Sort of. It disables all logging to the disk as done by the syslog daemon, but there will still be some kernel logs stored in memory that last either until it gets too full or the system reboots. See the output of the command dmesg to view these logs. These logs do not need to be disabled, as they are ephemeral and harmless.
Next to that I want to secure those against hijacking as good as possible.
This is a very complicated process that takes years to understand even the basics. You may want to consider using OpenBSD, as it is fairly secure out-of-the-box and is not much different from Linux in terms of administration (OpenBSD derived directly from UNIX, and Linux being UNIX-like).
So I was thinking to disable root and all sudoers. Which commands and file I need to remove for that.
Disabling root only prevents logging in as root with the proper credentials. An exploit can still be used to get root. In other words, "disabling" root simply tells su and sudo to always deny access, but does not remove support for root in the kernel. In the kernel, users are identified numerically. These are called UIDs, with the most privileged, root, being 0. If an exploit against a privileged process succeeds, an attacker can gain root. There is no way to disable a UID in the kernel. Disabling root login would only help against malicious software that knows your password.
If you still want to, you can lock root logins using passwd:
passwd -l root # locks the root user
chage -E 0 root # expires the root password, to lock SSH logins
This can be reversed as so:
passwd -u root
chage -E -1 root
And what about blocking port except for the needed ports for tor etc etc.
Ports are blocked by default unless there is any listener. You can block incoming ports explicitly by using iptables, such as this:
iptables -A INPUT -m tcp -p tcp --dport 9050 -j ACCEPT
iptables -A INPUT -m tcp -p tcp --dport 9001 -j ACCEPT
iptables -A INPUT -m tcp -p tcp --dport 22 -j ACCEPT
iptables -P INPUT DROP
Assuming the only ports used by Tor are 9050 and 9001, and SSH is on port 22. This is just an example. Unless you have other services running on the system which are listening on the network, there is not much risk of leaving ports open. You can still block them to be safe, though.
Person with the best/most complete answer will get $50 bitcoin, please leave your wallet adress after answering
There's no need to have a monitory bounty, but if you still want to, please consider donating to the EFF (Electronic Frontier Foundation)! Every dollar helps them.
