Phantasm66
Posts: 4,909 +8
Here's a great article on Linux Security Tips
Linux Security Tips
While writing this text I'm thinking that you already know how to install linux and you also know the basic commands, in other words I assume that you already know how to mess with linux. If you think this is a step by step document your are wrong, here are given ideas and thoughts that will help you to secure your box. When you end this text you'll have a secure box/network, but, remember that nothing is 100% secure, be paranoid. You won't be treated as a newbie to all this, because I'm assuming you aren't.
The only 3 things you need to keep going through:
- Brain (I guess there's no problem with this one)
- Linux Knowledge
- Coffee or something with caffein
So let's start this shall we?
"To protect yourself you need to see your system from the attackers eyes"
<-- Your mission Mr. Sysadmin is Securing your box -->
------------------------------------------------------
The first step on securing a box is re-installing your system. Your are
probably asking why? Well if we really want to secure a system, we need to have
100% sure that it wasn't compromised before you started implementing security
measures, otherwise it can just be a complete waste of time. Lets suppose that
you have just finished installing again your favorite linux distro, and you are
ready to secure it.
Selecting services
------------------
Log in as root.
First thing is to check what daemons are running as default, we can use
netstat for that.
# netstat -a
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 *:ftp *:* LISTEN
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 *:telnet *:* LISTEN
tcp 0 0 *:smtp *:* LISTEN
tcp 0 0 *:finger *:* LISTEN
tcp 0 0 *:www-http *:* LISTEN
tcp 0 0 *
tcp 0 0 *:shell *:* LISTEN
raw 0 0 *:icmp *:* 7
raw 0 0 *:tcp *:* 7
#
Well for what I'm checking I can tell that this is a newbie linux version,
probably RedHat or Mandrake. Why do I say that? Because those distros come with
plenty of active daemons, this way if the user need it don't need to try to
configure it. Unfortunately the default configurations aren't what we can call
secure so let's get working.
Finger and shell daemons should be shuted ASAP. Why?
- Finger daemon gives away info to everyone that requests it, even if it's not
much, it gives valid usernames for brute force attempts.
- Shell daemon, is one of the so called the r* services, the characteristic in
all of this services is that no authentification is needed. It's all based in
trusted host. If you still wanna run those be sure you set kerberos
identification.
- r* services running without kerberos or any other kind of auth method:
There's a file (.rhosts) where the trusted IPs are and if the IP trying to
login matches with the ones of the file, you get access to the box. So an IP
Spoffing attack would do the job, and you would get your box in trouble.
Now we still have the following services running:
- ftp (File Transfer Protocol)
- ssh (Secure Shell)
- telnet (actually this one should also be shuted after all we have ssh)
- smtp (Simple Mail Transfer Protocol)
- www-http (Web server)
- pop3 (Post Office Protocol 3)
Now you have to ask yourself a question. What do I pretend to do with my box?
- If you want to do a shell provider, you probably want to leave ftp daemon so
users can upload things to their shells, ssh open, and unfortunately telnet
too because there are many people (mostly windows users wanting to get a *nix
shell) that don't know what ssh is and don't have clients for it.
- If you want a mail server, you probably would close every port besides smtp,
and pop3.
NOTE: If the smtp daemon that you are using is sendmail, check if it's the
latest version, actually you should do this with every daemon, but specially
with sendmail. Why? Well because sendmail daemon is a massive coding with over
80.000 lines of code. So as you can imagine it's heaven for exploit writers. In
the past there actually was the joke "So what's this week sendmail
vulnerability?". If you really need a smtp daemon also think in changing from
sendmail to qmail (www.qmail.org).
- If you want a web server you should leave www-httpd daemon and ftp daemon. Or
even better if you have physical access to the web server and you can access
it regurally shut the ftp daemon too, and when there's need to upload things
just log locally.
- If you want a standalone box, just for you why not to close every single port
you have. But let's say that you want to play around in your box trying to
exploit the services, but you don't want nobody to access them besides you, so
it's still a standalone box but for everyone else besides you. The solution is
to set a firewall with deny policy, we'll have a little discussion about that
later.
WHAT YOU ALREADY SHOULD NOW: To open/close ports you need to edit the file
/etc/inetd.conf. If the service you wanna close
isn't listed there check init scripts that can
be found in the /etc/rc.d directory or /etc/init.d
deppend on what initialization system your distro
uses.
IMPORTANT: Remember it's really important that you will ALWAYS running the
latest daemons versions. Subscribe BugTraq mailing list
(http://www.securityfocus.com) to know about the latest exploits and
patches. If deamons allow, drop user permissions to normal users
that just own that deamon. Create new users for each deamon you are
running.
Avoiding to get in trouble
--------------------------
Well in the last section I gave 4 examples of what you could want to make with
your box:
- shell provider
- Mail server
- Web server
- Standalone box
Well in this section the standalone option won't be discussed by obvious
reasons.
Let's first see what measures we could take about in the shell provider.
Shell provider
--------------
In this kind of server you'll have plenty of people around the server,
probably even giving passwords to friends for their shells, it can be a really
dark environment for the sysadmin.
Services Running:
- FTP
- SSH
- TELNET
Tips:
- Do not allow root to login remotely
- Remove, or at least change passwords from default accounts.
- Do not allow anonymous ftp users to login, nor root, nor any user has to
much power to login by ftp, bin, daemon, and other pseudo users from
root.
- Check all files with SUID bit, and check their man page, if they say
that they can run without SUID bit just take it out. Files like at,
mount, umount should always be without the SUID bit..If they have it in
your system just take it out
- Chroot() user in is own home directory when login by ftp.
- Use shadow passwords
- Delete su from your system and get sudo instead, if you really want to
be secure or your the only sysadmin remove both
- Don't allow normal users to use commands like, mount, umount, uname,
netstat, w, who, and others that can give some kind of info from your
machine not actually needed
- Use npasswd instead of passwd, or use vpass with passwd
- Install Crack (remember to set permission to rwx------) and once a week
run a check in passwords of your system. Remember that it can take hours
or even days if your system as many users, but you also have to remember
that it can make your box secure. Set cron to run it and report by mail.
- If you want secure passwords, and crypt() accepts long passwords use
ppgen (password generator) that will generate passwords for users,
instead of being them to give passwords
- Warn users about possible social engineer attacks.
- Make users change their pass often
- Always display something like "This host logs everything you do,
break in attempts will be punished by law" at the login prompt and motd.
It's always good to do this, it won't secure your box but might put some
script kiddie think twice.
URLs:
sudo (ftp://ftp.courtesan.com/pub/sudo/)
npasswd (ftp://ftp.cc.utexas.edu/pub/npasswd/)
ppgen (ftp://coast.cd.purdue.edu/pub/tolls/unix/ppgen/)
crack (http://www.users.dircon.co.uk/~crypto/)
Mail server
-----------
Actually we can think that this kind of servers won't be in such danger as a
Shell provider, but that's not true, a Mail server is sometimes in MORE danger
that a shell provider. Why? Well because sendmail daemon is really buggy, POP3
can be brute forced to get passwords from users, and even if this host doesn't
allow any kind of remote login, the passwords of the users should be the same in
other hosts of the same network right? So you starting to imagine a chaos
environment, that's good, your opening your eyes to the reality.
Services Running:
- SMTP
- POP3
Tips:
- Give a try with qmail daemon instead of sendmail one.
- Check if the commands vrfy and expn, they probably are, but if they aren't
disable them.
- In POP3, if possible, set lock account so that if in an amount of time
there's a large number of failed login attempts. Remember to get an
auto-unlock mechanism too, something like, after 30 minutes unlock account.
If there's no such option you can alway login into the account that is being
attack, and nobody can login again until you logout (I'm are talking about
pop3 login).
