LINUX benchmark security list

System security record file the record file inside the operating system is an important clue to detect network intrusion. If your system is directly connected to the Internet, you find that many people try to Telnet/FTP login to your system, you can run "# more/var/log/secure | grep refused" to check the system's attacks and take corresponding countermeasures, such as replacing Telnet/rlogin with SSH.

Startup and login security

1. BIOS Security
Set the BIOS password and modify the boot sequence to disable system startup from a floppy disk.

2. User Password
The user password is a basic starting point for Linux security. The user password used by many people is too simple, which opens the door to the intruders, although theoretically speaking, as long as you have enough time and resources to use, there is no user password that cannot be cracked. However, selecting a proper password is difficult to crack. A good user password is a string of characters that only he can easily remember and understand, and should never be written anywhere.

3. Default Account
All default accounts that are started by the operating system and are not necessary should be prohibited. This should be done when you install the system for the first time. Linux provides many default accounts, and the more accounts, the more vulnerable the system is.
You can use the following command to delete an account.
# Userdel Username
Or use the following command to delete the group user account.
# Groupdel username

4. Password File
The chattr command adds unchangeable attributes to the following files to prevent unauthorized users from obtaining permissions.
# Chattr + I/etc/passwd
# Chattr + I/etc/shadow
# Chattr + I/etc/group
# Chattr + I/etc/gshadow

5. Disable Ctrl + Alt + delete to restart the machine command.
Modify the/etc/inittab file and comment out the line "ca: ctrlaltdel:/sbin/shutdown-t3-r now. Then reset the permission for all files in the/etc/rc. d/init. d/directory and run the following command:
# Chmod-R 700/etc/rc. d/init. d /*
In this way, only the root user can read, write, or execute all the above script files.

6. Restrict su commands
If you don't want anyone to use su as root, you can edit the/etc/pam. d/su file and add the following two lines:
Auth sufficient/lib/security/pam_rootok.so debug
Auth required/lib/security/pam_wheel.so group = isd
In this case, only users in the isd group can use su as the root user. After that, if you want the user admin to use su as the root user, you can run the following command:
# Usermod-G10 admin

7. Delete logon information
By default, the logon prompt includes the Linux release, kernel version, and server host name.
For a machine with high security requirements, too much information is leaked.
You can edit/etc/rc. d/rc. local to comment out the following lines of output system information.
# This will overwrite/etc/issue at every boot. So, make any changes you
# Want to make to/etc/issue here or you will lose them when you reboot
# Echo "">/etc/issue
# Echo "$ R">/etc/issue
# Echo "Kernel $ (uname-r) on $ a $ (uname-m)">/etc/issue
# Cp-f/etc/issue/etc/issue.net
# Echo>/etc/issue
Then, perform the following operations:
# Rm-f/etc/issue
# Rm-f/etc/issue.net
# Touch/etc/issue
# Touch/etc/issue.net

Restrict network access

1. NFS access
If you use the NFS Network File System Service, make sure that your/etc/exports has the strictest access permission settings, that is to say, do not use any wildcard characters, do not allow root write permissions, and can only be installed as a read-only file system. Edit the/etc/exports file and add the following two lines.
/Dir/to/export host1.mydomain.com (ro, root_squash)
/Dir/to/export host2.mydomain.com (ro, root_squash)
/Dir/to/export is the directory you want to output, host.mydomain.com is the name of the machine that logs on to this directory, ro means to mount it into a read-only system, and root_squash prohibits root from writing to this directory. To make the changes take effect, run the following command.
#/Usr/sbin/exportfs-

2. Inetd settings
First, make sure that the owner of/etc/inetd. conf is root and the File Permission is set to 600. After the settings are complete, you can run the "stat" command to check.
# Chmod 600/etc/inetd. conf
Edit/etc/inetd. conf to disable the following services.
Ftp telnet shell login exec talk ntalk imap pop-2 pop-3 finger auth
If you have installed ssh/scp, you can disable Telnet/FTP. To make the change take effect, run the following command:
# Killall-HUP inetd
By default, most Linux systems allow all requests, and using TCP_WRAPPERS to enhance system security is a breeze. You can modify/etc/hosts. deny and/etc/hosts. allow to add access restrictions. For example, setting/etc/hosts. deny to "ALL: ALL" can deny ALL access by default. Then add the allowed access to the/etc/hosts. allow file. For example, "sshd: 192.168.1.10/255.255.255.0 gate.openarch.com" indicates that the IP address 192.168.1.10 and the host name gate.openarch.com are allowed to be connected through SSH.
After the configuration is complete, you can use tcpdchk to check:
# Tcpdchk
Tcpchk is a TCP_Wrapper configuration check tool that checks your tcp wrapper configuration and reports all detected potential/existing problems.

3. logon terminal settings
The/etc/securetty file specifies the tty device that allows root login, which is read by the/bin/login program,
The format is a list of allowed names. You can edit/etc/securetty and comment out the following rows.
# Tty1
# Tty2
# Tty3
# Tty4
# Tty5
# Tty6
In this case, root can only log on to the tty1 terminal.

4. Avoid Displaying System and version information
If you want the remote login user to see the system and version information, you can change the/etc/inetd. conf file by performing the following operations:
Telnet stream tcp nowait root/usr/sbin/tcpd in. telnetd-h
-H indicates that telnet does not display system information, but only displays "login :".

Attack prevention

1. Stop ping
If no one can ping your system, the security will naturally increase. Therefore, you can add the following line to the/etc/rc. d/rc. local file:
Echo 1>/proc/sys/net/ipv4/
Icmp_echo_ignore_all

2. prevent IP Spoofing
Edit the host. conf file and add the following lines to prevent IP spoofing attacks.
Order bind, hosts
Multi off
Nospoof on

3. Prevent DoS Attacks
Setting resource limits for all users of the system can prevent DoS attacks. Such as the maximum number of processes and memory usage.
For example, you can add the following lines in/etc/security/limits. conf:
* Hard core 0
* Hard rss 5000
* Hard nproc 20
Then, you must edit the/etc/pam. d/login file to check whether the following row exists.
Session required/lib/security/pam_limits.so
The preceding command prohibits debugging files. The maximum number of processes is 50 and the memory usage is 5 MB.

Install patches

We recommend that you visit the relevant homepage to obtain information for different linux versions.

Redhat
Ftp://updates.redhat.com/
Use the following command to install the patch:
Rpm-fvl [file name]

Debian
Http://www.debian.org/security/
You can use apt to download the latest security updates. Set the following line
Deb http://security.debian.org/slink updates
Or
Deb http://security.debian.org/potato/updates main contrib non-free
Add the/etc/apt/sources. list file.
Manually install the patch:
Use apt-get to automatically install the patch package:
First, use the following command to update the internal database:
# Apt-get update

Then, run the following command to install the update software package:
# Apt-get upgrade
Manual installation:
First, use the following command to download the patch software:
# Wget url (the url is the patch download link)
Then, use the following command to install the patch:
# Dpkg-I file. after the above settings, your Linux Server can be immune to the vast majority of known security issues and network attacks, however, an excellent system administrator must always pay attention to network security trends and fix exposed and potential security vulnerabilities at any time.