Hardening the host operating system (OS) further strengthens security within the architecture by adding another layer of defense. There are various considerations when securing the host OS with some best practices and recommendations listed below.
Additionally, there are industry-recommended security configuration settings such as the CIS benchmark for Ubuntu, as described in the Ubuntu Security Guide. When applying benchmarks, scoping which controls and settings apply to the organization and then tailoring any controls or settings to fit deployment specifics is recommended. Some best practices include:
- Ensuring that only those who are required have access to the OS
- Ensuring that any user or service account has the minimum number of privileges necessary to carry out the required tasks
- Using strong passwords
- Configuring host OS firewall rules (access lists) for managing traffic incoming and leaving the host
- Integrating authentication with an existing central authentication system when possible
- Keeping updated on the latest patches and ensuring they are applied only after being tested and approved
- Disabling unused or unnecessary services
- Configuring the system to use NTP
- Configuring logging settings and integrate with a central logging system or SIEM when possible
- Conducting vulnerability scanning regularly (per organizational policy)
When configuring the Ubuntu OS for Deep North , a specific user account is required. Ensure that this account has the least privileges necessary to execute the tasks to run Deep North software. Consider file permissions settings and the ability to audit the Deep North account using various logs.
The Deep North installation process also includes the installation and configuration of the Fail2ban software, which scans log file to search for suspicious behavior. If any suspicious behavior is detected, such as excessive login attempts, Fail2ban can be configured to deny the specific IP address from attempting any further connections.