Yubico Forum

Re: [QUESTION] Hardening YubiRADIUS, what services can be of

2015-01-09T04:49:08+01:00

As YubiRADIUS is no longer being maintained, you should check out GreenRADIUS – Yubico Edition. GreenRADIUS is built from YubiRADIUS by the original developers, but is being carried forward by Green Rocket Security, a Yubico partner. It is kept current with the latest updates, taking care of issues such as Heartbleed, Shellshock, and POODLE.

In addition, the server has been hardened specifically to remove unneeded services out of the box so you don’t need to. Services such as cups for printing, Samba for Windows file sharing, and NFS tools for accessing NFS shares are not included in the VM.

Check out the GreenRADIUS hardening page to see how the server is hardened out of the box, and check out the latest security updates to the server here.

Statistics: Posted by GRS — Fri Jan 09, 2015 4:49 am

Re: [QUESTION] Hardening YubiRADIUS, what services can be of

2013-05-15T15:19:58+01:00

I concur. The documentation says, "we are limiting automatically starting services to only those needed for YubiRADIUS authentication." However, I'm having a hard time understanding how or why several of these services are needed and are running.

Some clarification on the policy and why these service are not disabled would be greatly appreciated.

Statistics: Posted by GregL — Wed May 15, 2013 3:19 pm

Re: [QUESTION] Hardening YubiRADIUS, what services can be of

2013-04-02T03:14:20+01:00

Can we please have an answer?

Statistics: Posted by nzkiwi68 — Tue Apr 02, 2013 3:14 am

Re: [QUESTION] Hardening YubiRADIUS, what services can be of

2013-03-04T19:54:02+01:00

Agreed, there's really no reason to even have all these things installed. I would like to see a minimal debian installation as base and then only the services needed installed.

Statistics: Posted by kore — Mon Mar 04, 2013 7:54 pm

Re: [QUESTION] Hardening YubiRADIUS, what services can be of

2013-02-27T21:51:48+01:00

Bump.
I'd like to see the appliance as hardened as possible. There is really no reason to have anything unnecessary running, especially considered this is a security appliance. Let's not let it get hacked due to some stupid bug in a package that was inadvertently installed and left running.

Statistics: Posted by ronsdavis — Wed Feb 27, 2013 9:51 pm

[QUESTION] Hardening YubiRADIUS, what services can be off?

2013-02-27T01:18:52+01:00

We'd like very much to harden our YubiRADIUS server and at the very least, turn off all the services that are not required.

Using Webadmin:
"System" - "Boot and Shutdown"

Quote:

Can support tell us EXACTY what services are required for YubiRADIUS to function?

Then, I can go through and switch to "Start at boot time" - "No" for the rest of the services.

There seems to be a large number of services that are not required which are running, e.g.
* bluetooth
* cpufrequtil
* cups
* fancontrol
* kerneloops
* loadcpufreq
* nfs-common
* nfs-kernel-server
* rsync
* samba
* slapd (if your not going to use the built-in LDAP server)
* smartmontools

Statistics: Posted by nzkiwi68 — Wed Feb 27, 2013 1:18 am