Server Security Guide

From Kicksecure
Jump to navigation Jump to search

Server Security Guide for Kicksecure, Linux, and Kicksecure Hardening

Documentation for this is incomplete. Contributions are happily considered! See this for potential alternatives.

User Account Password Security

An adversary might connect a keyboard to a server and attempt to login into a virtual console. See also Virtual Consoles Usage Documentation and Protection against Physical Attacks, Virtual Consoles.

The user should set a password for account user. If using user-sysmaint-split, the user should also set a password for account sysmaint.

If logging in passwordless over SSH using public key authentication, the user might be tempted to Locking a Password. However, then recovery using a virtual console over a KVM switch (such as PiKVM) will be no longer possible.

Confidential Computing

Confidential computing is an advanced security technology that protects data while it's in use, complementing existing protections for data at rest and in transit. The goal is to isolate sensitive data from unauthorized access, even from the cloud provider or system administrators.Confidential Computing (developers)

To the best of the author's knowledge, reasonably secure confidential computing is not currently achievable with Freedom Software. Technical details are available on the wiki pages Confidential Computing (developers) and Verified Boot.

E-Mail Delivery

DMARC Strict Alignment

Consider using DMARC strict alignment:

Tools

DKIM Header Injection Attack

Introduction:

Mitigation:

Future:

DKIM Replay Attack

Could a DKIM replay attack be resolved by enforcing In theory, yes. In practice, unsupported by DMARC. See DMARC Alignment: Enforce messages pass BOTH SPF and DKIMarchive.org iconarchive.today icon. And unlikely to be ever implemented since this would break the e-mail forwarding use case.

DKIM Required

Is SPF + DMARC sufficient or would this lead to ending up in the spam folder?

  • DMARC will pass (success, not a failure) when either SPF or DMARC has pass.
    • Such as pass (as in DMARC reports) however does only indicate that DMARC was pass. The e-mail could still end up being rejected for being spam or end up in the spam folder.
  • Quote https://emfluence.com/blog/how-dkim-affects-email-deliverabilityarchive.org iconarchive.today icon:

    Yahoo! requires DKIM to sign up for their Feedback Loop (where they keep track of spam complaints). That means anyone who doesn’t have DKIM set up isn’t capturing spam complaints at Yahoo!, and because of that, those email addresses aren’t being suppressed automatically. That could put you on the road to being blocked or blacklisted by Yahoo!

  • https://dmarcly.com/blog/can-i-set-up-dmarc-without-dkimarchive.org iconarchive.today icon doesn't mention spam.
  • Quote https://support.google.com/a/answer/174124?hl=enarchive.org iconarchive.today icon:

    Without DKIM, messages sent from your organization or domain are more likely to be marked as spam by receiving mail servers.

e-mail self hosting is hard

rain dance required:

SPF

SPF mostly ignored:

Headers

View e-mail headers:

  • For example in Thunderbird: select an e-mail -> View -> Message Source

There are two different "From" fields in an e-mail.

Very good explanation here: https://www.xeams.com/difference-envelope-header.htmarchive.org iconarchive.today icon

Checking DKIM Signatures on the Command Line

Might be mostly only useful for learning and testing purposes.

Install dkimverify.

Install package(s) python3-dkim following these instructions

1 Platform specific notice.

2 Update the package lists and upgrade the systemOnion Logo.

Click = Copy Copied to clipboard! sudo apt update && sudo apt full-upgrade

3 Install the python3-dkim package(s).

Using apt command line --no-install-recommends optionOnion Logo is in most cases optional.

Click = Copy Copied to clipboard! sudo apt install --no-install-recommends python3-dkim

4 Platform specific notice.

  • Kicksecure: No special notice.
  • Kicksecure-Qubes: Shut down Template and restart App Qubes based on it as per Qubes Template ModificationOnion Logo.

5 Done.

The procedure of installing package(s) python3-dkim is complete.

Click = Copy Copied to clipboard! dkimverify < e-mail.eml

Abuse Notifications

Standard E-Mail Addresses

Miscellaneous Server Tests

See Also

Footnotes

Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!

Retrieved from "https://www.kicksecure.com/w/index.php?title=Server_Security_Guide&oldid=90318"