Tech Support
Documentation
Login
Contact Us
8 Tools to Keep Linux Servers Secure
October 27, 2020 - TuxCare PR Team
Keeping Linux servers updated and patched isn’t the job of just one tool. You need several tools to ensure your servers are configured properly and aren’t a target for the latest exploits. Checking one server could be done manually, but when you’re responsible for hundreds of critical servers, you need tools to audit current server functionality, update software, set configurations, and perform any other actions required during maintenance. The following list of tools is a breakdown of the best software that will help administrators be proactive in Linux server management, configuration management, updates and patching.
Contents:
Vulnerability Management
The network and threat landscape of today will not be the same tomorrow. New technology is introduced, and attackers find new ways to exploit vulnerabilities. Administrators need tools to scan servers and find misconfigurations, out-of-date software, or other infrastructure issues that could lead to a compromise. These tools are used by some of the world’s biggest organizations to ensure that their servers are patched and secure.
Tenable Nessus
Arguably one of the most popular vulnerability scanners is Tenable Nessus. Tenable is the vulnerability management tool (Tenable.io is a cloud-based management tool popular with customers who use Nessus scanning), and Nessus is the scanner incorporated into its packaging. One feature of Nessus that makes it attractive to organizations is its predictable prioritization. This feature provides a path for administrators as they determine which vulnerabilities should be dealt with first.
Nessus is best for on-premise servers where administrators must ensure the security of internal and public-facing servers. It’s also great when the organization knows that effective scanning is lacking with other tools and patches must be installed. With the prioritization features, administrators can remediate known issues on servers by tackling the worst threats first.
Rapid7 Metasploit
While Nessus scans for vulnerabilities, Rapid7 Metasploit is the king of penetration testing. It allows users to deploy exploit code to test vulnerabilities. In other words, Nessus will scan for vulnerabilities, but Metasploit lets you exploit them. Of course, this should not be done in a production environment, but it’s good for developers and administrators who are curious about the cybersecurity of their infrastructure and software.
Metasploit is beneficial for security teams to allow them to improve security across the environment. For developers, it can help them verify vulnerabilities, assess risk, and educate others on the severity of a particular vulnerability. It also lets you be proactive when it comes to identifying and remediating vulnerabilities in your software.
Qualys
For businesses that have most of their infrastructure in the cloud, Qualys is a good fit for cloud-based vulnerability scanning. Qualys excels at scanning environments that are either fully in the cloud or have a hybrid of on-premise and cloud infrastructure. It can be deployed 100% as a SaaS-based solution for scanning applications and infrastructure stored at a cloud provider’s data center.
Similar to Nessus, Qualys will also prioritize vulnerabilities and place a value on each risk so that organizations can reduce potentially thousands of issues to the few dozen that matter the most. Qualys has been around for years, so its API is a bit dated. Their API is a non-REST, XML-based API that can integrate into your own applications.
Configuration Management
Misconfigurations can lead to severe data breaches. If administrators don’t configure cloud infrastructure and servers correctly, it can open vulnerabilities to any attacker with the right scanning tools and exploits. Configuration management tools will deploy configurations during software promotion to production and eliminate human error from manually configuring hundreds of servers.
Chef
For businesses that work with developers and custom software, Chef is a good choice for configuration deployment and management. Chef was built for developers, especially for those who understand the Ruby language. Chef will also pull current configurations so that they can be reviewed before the next push.
Chef is completely programmable and flexible. If your programmers know Ruby, it can be easy to deploy large-scale configuration changes across several servers. SaaS versions of the tool will provide analytics and reporting capabilities.
SaltStack
In Linux environments, SaltStack is a common tool used for deploying configurations and SSH commands using encrypted communication with your servers. SaltStack has a learning curve similar to Chef, but it requires fewer programming skills than Chef. It can be used to horizontally or vertically scale resources during deployment. Instead of Ruby, SaltStack uses Python, which is a much more popular language for Linux administrators.
To create templates, users can create YAML templates that will deploy standard configurations across the environment. SaltStack is made for large environments where load must be balanced and administrators need a standard for every server. It has a central server and agents called minions that run on each server.
Puppet
Puppet is one of the more popular configuration managers on the list. It’s used by very prominent businesses on the web including Reddit, Google, PayPal and Oracle. It’s open-source and written in the Ruby language, and administrators can use a command-line interface or choose to work with the GUI.
Agents must run on each node, which requires some security and permissions overhead. Developers for Puppet allow Ruby commands with the CLI but have been moving towards a Puppet proprietary language. This could create a huge learning curve for future Puppet deployments.
Ansible
Red Hat Ansible is a lightweight configuration tool perfect for network administrators who need a way to send commands to servers using Python rather than complex proprietary languages or Ruby. Most notable with this solution is that commands can be written in any language and isn’t limited to the underlying framework.
Configuration files called playbooks can be created in YAML to standardize configurations across multiple servers. No agents are required on the target client machines, so there is much smaller overhead in deployments and configurations to get started. Configurations can also be deployed to cloud environments or virtual machines using VMWare on your local network.
Live Patching
KernelCare
Vulnerability scanners and configuration deployment tools are great for automation and finding issues, but you still need a way to patch the Linux kernel. Patches and updates from vendors require a reboot, and this means that security patches are delayed until a scheduled date. Live patching allows for rebootless patching, but most solutions only patch a specific distribution.
KernelCare integrates with vulnerability scanners and configuration managers to automatically patch Linux when a vulnerability is found. After live patching completes, KernelCare will report the updated version to vulnerability scanners. In addition to working with scanners, KernelCare can also be deployed to each server using configuration management tools like Puppet, Chef, Ansible, and SaltStack.
Conclusion
Any large environment needs tools to help administrators maintain the stability of the network. KernelCare can take care of the Linux kernel security patches without the need for reboots, so you don’t delay patching. It seamlessly works with the vulnerability and configuration management tools mentioned above. We have servers that have not been reboot in 6 years and these customers continue to stay SOC2 compliant. Using KernelCare, you can remove much of the overhead with server maintenance and time-consuming processes.
