Yubico Forum

We'd like very much to harden our YubiRADIUS server and at the very least, turn off all the services that are not required.

Using Webadmin:
"System" - "Boot and Shutdown"



Then, I can go through and switch to "Start at boot time" - "No" for the rest of the services.

There seems to be a large number of services that are not required which are running, e.g.
* bluetooth
* cpufrequtil
* cups
* fancontrol
* kerneloops
* loadcpufreq
* nfs-common
* nfs-kernel-server
* rsync
* samba
* slapd (if your not going to use the built-in LDAP server)
* smartmontools

Bump.
I'd like to see the appliance as hardened as possible. There is really no reason to have anything unnecessary running, especially considered this is a security appliance. Let's not let it get hacked due to some stupid bug in a package that was inadvertently installed and left running.

Agreed, there's really no reason to even have all these things installed. I would like to see a minimal debian installation as base and then only the services needed installed.

Can we please have an answer?

I concur. The documentation says, "we are limiting automatically starting services to only those needed for YubiRADIUS authentication." However, I'm having a hard time understanding how or why several of these services are needed and are running.

Some clarification on the policy and why these service are not disabled would be greatly appreciated.

As YubiRADIUS is no longer being maintained, you should check out GreenRADIUS – Yubico Edition. GreenRADIUS is built from YubiRADIUS by the original developers, but is being carried forward by Green Rocket Security, a Yubico partner. It is kept current with the latest updates, taking care of issues such as Heartbleed, Shellshock, and POODLE.

In addition, the server has been hardened specifically to remove unneeded services out of the box so you don’t need to. Services such as cups for printing, Samba for Windows file sharing, and NFS tools for accessing NFS shares are not included in the VM.

Check out the GreenRADIUS hardening page to see how the server is hardened out of the box, and check out the latest security updates to the server here.