File System Security, File System

File System Security, File System
Zookeeper

1. Globally readable files
A globally readable file is a file that any user has the permission to view.
Find/-type f-perm-4-print 2>/dev/null

2. Globally Writable Files
Globally writable files are files that all users have the permission to change.
Find/-type f-perm-2-print 2>/dev/null
Find/-type d-perm-2-print 2>/dev/null

3. Special file permissions: setuid and setgid
If the setuid file is set, the user executes the file as the owner of the file, instead of the user who executes the file.
Similar to setgid, it is executed as a file group.
/Etc/shadow is such a file
 
Add setuid permission
Chmod u + x testfile
Chmod u + s testfile
 
Cancel setuid permission
Chmod u-s testfile
 
Add setgid permission
Chmod g + x testfile
Chmod g + s testfile
 
Cancel setgid permission
Chmod g-s testfile

Find the setuid or setgid file in the system.
Find/-perm-4000-print // setuid
Find/-perm-2000-print // setgid

4. No owner File
Find the files without the owner and group in the system.
Find/-nouser-o-nogroup

5. Device Files
The device files are stored in/dev/. Do not set the permission to be globally readable.

6. Disk partitioning
DoS attacks by occupying all the available disk space
Cat/dev/zero>/tmp/bigfile // keep writing 0 to byodps, consuming disk space

Use the Linux disk quota to limit the disk space that each user can use
Partition disks reasonably and Mount important file systems to different disk partitions.

7. Set the grub Password
Generate MD5 encrypted password information
/Sbin/grub-md5-crypt

Change/etc/grub. conf configuration
Password -- md5 xxxxxxxxxxxxxxxxxxxx
Lock
 
Reboot

8. Restrict su Switching
Configure to only allow users in the wheel group to su
Change su command group to wheel
Chgrp wheel/bin/su

Change the su command permission and reject the execution of users except the root and wheel groups.
Chmod u + s, o-rwx, u + rwx, g + rx/bin/su

Add trusted users to the wheel group
Usermod-G wheel sam

9. Use the appropriate mount options
Use noexec \ nosuid \ nodev and other options to better control the mounted file system