
Automatic server hardening framework - dewey
https://telekomlabs.github.io/
======
allendoerfer
Seems like a nice and comfortable way to set sane defaults for nginx, Apache,
MySQL, PostgreSQL and some Unix stuff - but they really should have been set
by each software in the first place.

I like, the private touch the screencast and the developer-designed website
gives the project, even if part of a big company. This actually raises its
credibility.

~~~
ams6110
_they really should have been set by each software_

Yes, and it seems to me that distros (at least those intended for
"enterprise") should be hardened by default also. If I install RHEL or OEL and
then have to run a Chef or Puppet config to "harden" it, something is wrong.

~~~
jlawer
Well, thats been tried and rejected by the user base. If you harden too much
it becomes a real PITA to do anything productive (SELinux running in strict
mode).

RHEL aims to be secure, while also remaining fairly compatible with previous
versions.

Red Hat do have documentation on how to harden, but most users don't use it
and instead turn SELinux completely off as one of the first configuration
steps.

------
iand675
Very cool, but seems like it would be nice to have the hardening steps
documented outside of code too (for those of us with more exotic provisioning
tastes).

~~~
mikegioia
I completely agree. I was looking for the SSH settings but I don't use Puppet
or Chef. This is why I prefer shell scripts so I can see what's going on and
run parts of it on my own.

~~~
metatron31
You can check the references here in the lifecycle section:
[http://telekomlabs.github.io/docs/](http://telekomlabs.github.io/docs/)

------
virtuallynathan
Seems bad that it disables IPv6 "for security".

~~~
ownagefool
Disable anything you don't use. I wish it weren't so but IPv6 is probably a
safe assumption there.

------
crymer11
Ansible support would be spiffy.

~~~
kieranajp
I was looking for the same thing; however I can't find any acknowledgement of
Ansible's existence anywhere on the site or in the docs :(

------
zobzu
tldr its a set of open source puppet/chef/others modules to harden the default
configuration of common daemons.

------
codezero
The audio on the demo video is really choppy, is that just me?

~~~
dewey
The same is happening for me, didn't notice it when I watched it before I
posted it though. Maybe Vimeo is having problems.

~~~
markcampbell
It's not vimeo. Downloading the video and playing it locally with VLC yields
the same problems.

------
Alupis
It this an arm of T-Mobile (the US carrier)? Their logos are strikingly
similar, but their websites make no reference to each other.

Telekom Labs logo:
[http://www.laboratories.telekom.com/public/Deutsch/Pages/def...](http://www.laboratories.telekom.com/public/Deutsch/Pages/default.aspx)

T-Mobile logo: [http://www.t-mobile.com/](http://www.t-mobile.com/)

~~~
dsl
T-Mobile is the US subsidiary of Deutsche Telekom.

~~~
pluma
Nitpicking: T-Mobile is the international mobile branch of Deutsche Telekom,
not just in the US (though there is a US subsidiary).

Other branches include T-Online (private ISP, actually a former subsidiary),
T-Systems (subsidiary proving services to the public sector and larger
corporations) and T-Home (which I have trouble telling apart from T-Online).
There may be other branches too, but in practice most people in Germany just
lump them all together anyway.

