Linux Security.pdf

(99 KB) Pobierz
Linux Security
Linux Security
Oded Maimon
Oded Maimon - http://maimon-it.blogspot.com/
-1-
Linux Security
1. Introduction
This document is intended for linux administrator and security personal. The purpose of this document
is to secure linux servers for production use. This document shows how to secure a default installation
of Redhat Enterprise Linux but can be adopt for other linux distors as well.
2. Installation process
•
The Redhat server "Install Everything" installation, installs more than 1000 RPM's in RHEL5
and more than 1400 RPM's in RHEL4. The best way to install a server is to "Install what you
need", Use the "Minimum" installation and after the install add what you need or to use the
"Custom" installation and select the packages needed. (NOTE: The minimum installation
installs less than 300 packages!)
Patch the servers to the latest patch available - After the installation, the server should be
patched to the latest errata available. Run "up2date –u" to update the system, If there is no
internet connection then download the latest patch from Redhat web site.
Some packages are not recommended for installation on a server:
o
X/Gnome/KDE – The reasons to not install X/Gnome/KDE are performance and
security issues
o
Telnet/Ftp/Rsh – SSH is much better solution to for all those tools
•
•
If the OS is already installed then remove unnecessary software
Partition your disks to:
o
/ - 2G
o
/var – 1G (can be smaller)
o
/var/log – 1G
o
/tmp – 2G
o
/usr – 4G (this is the main directory used for tools)
o
/usr/local – 1G (can be smaller)
o
/home – 500M (depends on the space needed by users)
o
/opt – 500M
o
/boot – 100M
•
•
3. Run level
The linux machine run level is used to define what system services are operating. There are seven run
levels:
•
0: Halt the machine
Oded Maimon - http://maimon-it.blogspot.com/
-2-
Linux Security
•
•
1: Single user mode
2-5: Normal operating mode (user defined)
o
2 – Multiuser, without NFS
o
3 – Full multiuser mode
o
4 – Unused
o
5–X
6: Reboot
•
The default run level for a server should be 3. Run level 3 will start without X (GNOME/KDE/other).
To change the default run level on boot you should edit the file /etc/inittab and change the default run
level by editing this line:
id:5:initdefault:
to:
id:3:initdefault:
4. Detect open ports
One of the most important things is to close all unneeded network ports and know which ports you
leave open. To get the list of open ports run:
netstat –tulpn
The output of this command will return something like this:
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address
tcp
tcp
udp
udp
0
0
0
0
0
0
0
0
0.0.0.0:111
0.0.0.0:22
0.0.0.0:68
0.0.0.0:111
Foreign Address
0.0.0.0:*
0.0.0.0:*
0.0.0.0:*
0.0.0.0:*
State
PID/Program name
2391/portmap
1966/sshd
1570/dhclient
2391/portmap
LISTEN
LISTEN
Services/ports that you may not want to leave running/open are:
Tool/Services
Sendmail
25
Port
Dependencies
SMTP protocol
Handle service
If you need the server to act as
SMTP server for outgoing
emails only then go to "Secure
Sendmail" Section in this
document. If you don't need to
use this server as SMTP server
Oded Maimon - http://maimon-it.blogspot.com/
-3-
Linux Security
Tool/Services
Port
Dependencies
Handle service
in any way you can stop it by
running:
service sendmail stop
chkconfig sendmail off
Portmap (RPC)
111
Handles RPC calls
Used by NFS client
Used by NFS client
service portmap stop
chkconfig portmap off
service nfslock stop
chkconfig nfslock off
Nfslock
TCP:32700
UDP:32768,
729
631
Cupsd
Printing service
service cups stop
chkconfig cups off
Hplip/hpiod
2208
HP Linux Imaging and
Printing
MDNS/DNS-SD
Multicast DNS service
Discovery
service hplip stop
chkconfig hplip off
service avahi-daemon stop
chkconfig avahi-daemon off
avahi-daemon
UDP:
1024
,
5353, 1025
5. Stop unneeded services
The default installation starts some services that you may not need or wish to leave running, this list
will show most of them. First of all, the way to get the list of running services is:
chkcnfig –list | grep ":on"
The output for this command will return something like this:
acpid
anacron
apmd
atd
auditd
autofs
avahi-daemon
0:off 1:off 2:off 3:on
0:off 1:off 2:on
0:off 1:off 2:on
0:off 1:off 2:on
3:on
3:on
3:on
4:on
4:on
4:on
4:on
4:on
4:on
5:on
5:on
5:on
5:on
5:on
5:on
6:off
6:off
6:off
6:off
6:off
6:off
0:off 1:off 2:off 3:on
0:off 1:off 2:off 3:on
0:off 1:off 2:off 3:off 4:off 5:off 6:off
Oded Maimon - http://maimon-it.blogspot.com/
-4-
Linux Security
avahi-dnsconfd
bluetooth
conman
cpuspeed
crond
firstboot
gpm
0:off 1:off 2:off 3:off 4:off 5:off 6:off
0:off 1:off 2:on
0:off 1:on
2:on
3:on
3:on
3:on
3:on
4:on
4:on
4:on
4:on
5:on
5:on
5:on
5:on
6:off
6:off
6:off
6:off
6:off
0:off 1:off 2:off 3:off 4:off 5:off 6:off
0:off 1:off 2:on
0:off 1:off 2:on
0:off 1:off 2:off 3:on
4:off 5:on
To stop a service from running and start at boot time use:
service
<service name>
stop
chkconfig
<service name>
off
List of services that run by default:
Service name
acpid
Description
Handles ACPI event and invokes the command. For example, what
happens when the power/sleep button is pressed or AC adapter state is
changed.
Like cron but it will run jobs that didn't run because the server was
down.
Monitoring battery status
Automates a packet filtering firewall with arptables
The same tool as cron. Needed only if using the at command.
Handles the audit system
Automount filesystems
MDNS/DNS-SD, Multicast DNS service Discovery
Daemon which configures unicast DNS servers using server info
published via mDNS
Needed?
Y
anacron
apmd
arptables_jf
atd
auditd
autofs
avahi-daemon
(RHEL5)
avahi-dnsconfd
(RHEL5)
N
N
N
N
Y
If using
autofs
If using
MDNS
If using
MDNS
Oded Maimon - http://maimon-it.blogspot.com/
-5-

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin