TABLE OF CONTENTS The general concepts behind hardening a Linux bastion host are no different than they are for any other OS.You still need to minimize the installed software, update and patch the OS, and tighten the security settings. It is only the specific methods for accomplishing these tasks that vary with a Linux-based bastion host over a Windows-based one.The basic approach to hardening any bastion host (whether Linux, UNIX, Windows, or other) can be summarized in the following high-level steps:
Planning comes before doing.
Remember the bastion host s role during all stages.
Leave only the minimum components on the system to get the job done.
Take what s left and make it as secure as possible, avoiding default settings where practical.
In some ways, securing Linux to serve as a bastion host can be harder than if you were using a Microsoft product, because there are so many options. If you aren t thoroughly comfortable with the landscape, the task of sorting out what tool and configuration to use can seem daunting. On the flip side, this same weakness Linux s extreme flexibility is also its main strength.Those same bewildering number of options provide you with near-infinite flexibility in how you accomplish your objectives. In this chapter we walk through the steps for hardening a Linux computer and preparing it to serve in the role of bastion host. We cover the specific steps you need to take and contrast those with the same steps you would use on a Windows system. It is assumed that the...
