By:kapil Sharma from Linux_month (a onine monthly Linux magzine)
Translation: F@tfox
This article describes how to make your Linux system reliable with basic security measures.
1. Bios Security
Be sure to set the BIOS password to prevent booting from the floppy disk by changing the boot sequence in the BIOS. This prevents others from trying to start your system with a special boot disk and prevents others from entering the BIOS to change the settings (such as allowing the floppy disk to boot).
2, LILO Security
Add the following three parameters to the "/etc/lilo.conf" file: Time-out,restricted,password. These three parameters allow your system to require password verification when you start Lilo.
First step:
Edit lilo.conf file (VI/ETC/LILO.COMF), if or change these three parameters:
Boot=/dev/hda
Map=/boot/map
install=/boot/boot.b
time-out=00 #把这行该为00
Prompt
Default=linux
Restricted #加入这行
Password=<password> #加入这行并设置自己的密码
Image=/boot/vmlinuz-2.2.14-12
Label=linux
Initrd=/boot/initrd-2.2.14-12.img
Root=/dev/hda6
Read-only
Step Two:
Because the "/etc/lilo.conf" file contains a plaintext password, it is set to read as root.
[Root@kapil/]# chmod 600/etc/lilo.conf
Step Three:
Update the system so that modifications made to the "/etc/lilo.conf" file work.
[Root@kapil/]#/sbin/lilo-v
Fourth Step:
Use the "chattr" command to make the "/etc/lilo.conf" file immutable.
[Root@kapil/]# chattr +i/etc/lilo.conf
This will prevent any changes to "/etc/lilo.conf" (other than or other reasons)
3, delete all the special accounts
You should delete all unused default user and group accounts (such as LP, Sync, Shutdown, halt, news, UUCP, operator, games, Gopher, etc.).
Delete User:
[Root@kapil/]# Userdel LP
To delete a group:
[Root@kapil/]# Groupdel LP
4, choose the correct password
You should also make the following modifications before choosing the correct password:
Modify password Length: The default password length is 5 bytes when you install Linux. But that's not enough, to set it to 8. Modify the minimum password length need to edit the Login.defs file (vi/etc/login.defs), put the following line
Pass_min_len 5
To
Pass_min_len 8
