Hardening Guide

This resource describes how the King Phisher server can be configured with additional security protections. These are meant to be used in addition to standard Linux security best practices.

Server Hardening Checklist

• Configuration settings to apply
  • require_id: True (Set by default) Require valid message IDs from visitors
  • setuid_username: nobody (Set by default) Drop privileges to this user
  • authentication.group: king-phisher Set this to require local users to be members of this group in order to authenticate to the server
  • rest_api.enabled: False (Set by default) Leave the REST API disabled unless it is being used
• Enroll users in TOTP for two-factor authentication
• Configure SSH to require key-based authentication
• Prevent SSH users from running commands by setting their shell to /sbin/nologin
• Configure iptables to only allow trusted IPs to access the SSH service

Client Hardening Checklist

• Do not run the client as root
• Disable automatically installing plugin dependencies from PyPi with pip (Enabled by default)