Linux Network security Tips "Turn"

Linux Network Security Tips

Date: 2001-6-15
Author member name: WANGSB email:wangshoub@yeah.net
Network security is a very important topic, basically you run the service backstage more, you can open more security vulnerabilities. If configured properly, Linux itself is very safe and reliable, if there is a security flaw in the Linux system, because the Linux source is open, There are tens of thousands of volunteers who will immediately discover and repair it. This article is intended to introduce the common techniques used to enhance your network security to Redhat Linux as an operating environment.
1. The internal operating system log file is to detect whether there is an important clue to the network intrusion, of course, this assumes that your logfile is not damaged by intruders, if you have a server with a dedicated line directly connected to the Internet, which means that your IP address is a permanent fixed address, You'll find a lot of people doing telnet/ftp login attempts on your system, trying to run #more/var/log/secure | grep refused to check.
2. Limit the number of programs with SUID permission flags, the program with that permission flag running as root is a potential security vulnerability, of course, some programs must have the logo, like the passwd program.
3.BIOS security. Setting the BIOS password and modifying the boot order prevents booting the system from the floppy disk.
4. User password. User password is a basic Linux security starting point, many people use the user password is simple ' password, which is tantamount to the intruder open the door, although theoretically there is no inaccurate user password, as long as there is enough time and resources available. A better user password is a string of characters that only he can remember and understand, and never write anywhere.
5./etc/exports files. If you use the NFS Network File system service, make sure your/etc/exports has the strictest access permission settings, which means that you do not use any wildcard characters, do not allow root write permissions, and mount the read-only file system. Edit File/etc/exports and add: for example:
/dir/to/export host1.mydomain.com (Ro,root_squash)
/dir/to/export host2.mydomain.com (Ro,root_squash)
/dir/to/export is the directory you want to output, host.mydomain.com is the machine name to log in to this directory, RO means mount into a read-only system, Root_squash prevents root from writing to the directory.
In order for the above change to take effect, run/usr/sbin/exportfs-a
6. Be sure that the owner of the/etc/inetd.conf is root and that the file permissions are set to 600.
[root@deep]# chmod 600/etc/inetd.conf
Ensure that's the owner is root.
[root@deep]# stat/etc/inetd.conf
File: "/etc/inetd.conf"
size:2869 Filetype:regular File