0

I'm running some tor exitrelays with rsyslog off. Does this disable ALL loggin? If no how I disable ALL loggin? Next to that I want to secure those against hijacking as good as possible. So I was thinking to disable root and all sudoers. Which commands and file I need to remove for that. And what about blocking port except for the needed ports for tor etc etc.

Person with the best/most complete answer will get $50 bitcoin, please leave your wallet adress after answering

  • I dont mind losing acces as root etc for myself – Peter Appel Dec 5 '17 at 2:29
0

Does this disable ALL loggin?

Sort of. It disables all logging to the disk as done by the syslog daemon, but there will still be some kernel logs stored in memory that last either until it gets too full or the system reboots. See the output of the command dmesg to view these logs. These logs do not need to be disabled, as they are ephemeral and harmless.

Next to that I want to secure those against hijacking as good as possible.

This is a very complicated process that takes years to understand even the basics. You may want to consider using OpenBSD, as it is fairly secure out-of-the-box and is not much different from Linux in terms of administration (OpenBSD derived directly from UNIX, and Linux being UNIX-like).

So I was thinking to disable root and all sudoers. Which commands and file I need to remove for that.

Disabling root only prevents logging in as root with the proper credentials. An exploit can still be used to get root. In other words, "disabling" root simply tells su and sudo to always deny access, but does not remove support for root in the kernel. In the kernel, users are identified numerically. These are called UIDs, with the most privileged, root, being 0. If an exploit against a privileged process succeeds, an attacker can gain root. There is no way to disable a UID in the kernel. Disabling root login would only help against malicious software that knows your password.

If you still want to, you can lock root logins using passwd:

passwd -l root # locks the root user
chage -E 0 root # expires the root password, to lock SSH logins

This can be reversed as so:

passwd -u root
chage -E -1 root

And what about blocking port except for the needed ports for tor etc etc.

Ports are blocked by default unless there is any listener. You can block incoming ports explicitly by using iptables, such as this:

iptables -A INPUT -m tcp -p tcp --dport 9050 -j ACCEPT
iptables -A INPUT -m tcp -p tcp --dport 9001 -j ACCEPT
iptables -A INPUT -m tcp -p tcp --dport 22 -j ACCEPT
iptables -P INPUT DROP

Assuming the only ports used by Tor are 9050 and 9001, and SSH is on port 22. This is just an example. Unless you have other services running on the system which are listening on the network, there is not much risk of leaving ports open. You can still block them to be safe, though.

Person with the best/most complete answer will get $50 bitcoin, please leave your wallet adress after answering

There's no need to have a monitory bounty, but if you still want to, please consider donating to the EFF (Electronic Frontier Foundation)! Every dollar helps them.

  • Thank you for responding. No way to disable the UIDs right? Nothing to do against those exploits I guess. But disabling will help against malicious software right? I was searching for a few commands to make it more secure. I will checkout OpenBSD. If there wont come any new answer next few days about this question, since a better answer with more details on the process is possible. In case this will be the best answer I would love to donate. I did google it and found more 'EFF's. Did you mean the Electronic Frontier Foundation? – Peter Appel Dec 5 '17 at 4:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.