Summary of Linux security settings

I. disk partition 1. if the system is newly installed, security should be considered for disk partitions: 1) root directory (/), user directory (/home), temporary directory (/tmp) and/var directories should be separated into different disk partitions; 2) the disk space of the partitions where the directories are located should be fully considered to avoid system crash due to some causes of insufficient partition space; 2. Disk partitioning
1. if the system is newly installed, consider the security of disk partitions:
1) the root directory (/), user directory (/home), temporary directory (/tmp), and/var directory should be separated to different disk partitions;
2) the disk space of the partitions where the directories are located should be fully taken into account to avoid system crash due to insufficient partition space due to some reasons;
2. for partitions in the/tmp and/var directories, programs with the suid attribute are not required in most cases, so the nosuid attribute should be added for these partitions;
Method 1: modify the/etc/fstab file and add the nosuid attribute. For example:
/Dev/hda2/tmp ext2 exec, dev, nosuid, rw 0 0
Method 2: If you are not familiar with the operations on the/etc/fstab file, we recommend that you use the linuxconf program.
Run the linuxconf program;
Select "Access local drive" under "File systems ";
Select the disk partition for which you want to modify the attribute;
Select "No setuid programs allowed;
Select other options as needed;
Exit normally. (The system will usually prompt you to re-mount the partition)

II. Installation
1. do not install too many non-test hosts SoftwarePackage. This reduces the possibility of security vulnerabilities caused by software packages.
2. for non-test hosts, do not select a non-essential service when selecting a host to start the service. Such as routed and ypbind.

III. security configuration and enhancement
Kernel upgrade. Upgrade to 2.2.16 or later.
Upgrade the GNU libc shared library. (Warning: you cannot try it easily if you have no experience. Can be suspended .)
Disable dangerous NetworkService. Echo, chargen, shell, login, finger, NFS, RPC, etc.
Disable non-essential network services. Talk, ntalk, pop-2, etc.
Security Configuration and upgrade of common network services
Make sure that the version used by the network service is the latest and safest version.
Cancel anonymous FTP access
Unless necessary suid program
Use tcpwrapper
Use ipchains firewall
Syslogd

Some details:
1. the logfile in the operating system is an important clue to check whether there is any network intrusion. of course, this assumes that your logfile is not damaged by the intruders. if you have ServerUsing a leased line to connect directly to the Internet means that your IP address is a permanent fixed address. you will find that many people attempt to telnet/ftp login to your system, run # more/var/log/secure grep refused to check.
2. restrict the number of programs with the SUID permission flag. programs with this permission flag run as root, which is a potential security vulnerability. of course, some programs must have this flag, like the passwd program.
3. BIOS security. Set the BIOS password and modify the boot sequence to disable system startup from a floppy disk.
4. user password. User passwords are the most basic starting point for Linux Security. many users use simple 'password', which opens the door to intruders, although theoretically there is no uncertain user password, it can be used as long as there is enough time and resources. A good user password is a string of characters that can only be easily remembered and understood by himself, and should never be written anywhere.
5./etc/exports file. If you use the NFS network file system service, make sure that your/etc/exports has the strictest access permission settings. This does not mean that you do not use any wildcards and do not allow root write permissions, mount the file to a read-only file system. Edit the/etc/exports file and add: for example:
/Dir/to/export host1.mydomain.com (ro, root_squash)
/Dir/to/export host2.mydomain.com (ro, root_squash)
/Dir/to/export is the directory you want to output, host.mydomain.com is the name of the machine that logs on to this directory,
Ro means to mount the file to a read-only system. root_squash prohibits root from writing data to this directory.
To make the above changes take effect, run/usr/sbin/exportfs-
6. make sure that the owner of/etc/inetd. conf is root and the file permission is set to 600.
[Root @ deep] # chmod 600/etc/inetd. conf
ENSURE that the owner is root.
[Root @ deep] # stat/etc/inetd. conf
File: "/etc/inetd. conf"
Size: 2869 Filetype: Regular File
Mode: (0600/-rw -------) Uid: (0/root) Gid: (0/root)
Device: 8, 6 Inode: 18219 Links: 1
Access: Wed Sep 22 16:24:16 1999 (00000.00: 10: 44)
Modify: Mon Sep 20 10:22:44 1999 (00002.06: 12: 16)
Change: Mon Sep 20 10:22:44 1999 (00002.06: 12: 16)
Edit/etc/inetd. conf to disable the following services:
Ftp, telnet, shell, login, exec, talk, ntalk, imap, pop-2, pop-3, finger,
Auth, etc. unless you really want to use it.
In particular, prohibit those r commands. if you use ssh/scp, you can also disable telnet/ftp.
To make the change take effect, run # killall-HUP inetd
You can also run # chattr + I/etc/inetd. conf to make the file unchangeable.
Only the root user can unlock it. use the command
# Chattr-I/etc/inetd. conf
7. TCP_WRAPPERS
By default, Redhat Linux allows all requests and uses TCP_WRAPPERS to enhance the security of your site.
You can put
"ALL: ALL" to/etc/hosts. deny to deny ALL requests, and then put those explicitly allowed requests
/Etc/hosts. allow, for example:
Sshd: 192.168.1.10/255.255.255.0 gate.openarch.com
The IP address 192.168.1.10 and the host name gate.openarch.com can be connected through ssh.
After the configuration is complete, use tcpdchk to check
[Root @ deep] # tcpdchk
Tcpchk is the TCP_Wrapper configuration check tool,
It checks your tcp wrapper configuration and reports all detected potential/existing problems.
8. alias file aliases
Edit the alias file/etc/aliases (or/etc/mail/aliases) and delete/comment the following line.
# Basic system aliases -- these MUST be present.
MAILER-DAEMON: postmaster
Postmaster: root
# General redirections for pseudo do accounts.
Bin: root
Daemon: root
# Games: root? Remove or comment out.
# Ingres: root? Remove or comment out.
Nobody: root
# System: root? Remove or comment out.
# Toor: root? Remove or comment out.
# Uucp: root? Remove or comment out.
# Well-known aliases.
# Manager: root? Remove or comment out.
# Dumper: root? Remove or comment out.
# Operator: root? Remove or comment out.
# Trap decode to catch security attacks
# Decode: root
# Person who shocould get roots mail
# Root: marc
After the last update, do not forget to run/usr/bin/newaliases to make the change take effect.
9. prevent your system from responding to any external/internal ping requests.
Since no one can ping your machine and receive a response, you can greatly enhance the security of your site. You can add the following command to/etc/rc. d/rc. local to run automatically after each startup.
Echo 1>;/proc/sys/net/ipv4/icmp_echo_ignore_all
10. do not display the operating system and version information.
If you want someone to remotely log on to your server without displaying the operating system and version information, you can change
The line in/etc/inetd. conf is as follows:
Telnet stream tcp nowait root/usr/sbin/tcpd in. telnetd-h
Add the-h sign to the end so that the telnet background does not display system information, but only login:
11. The/etc/host. conf file
Edit the host. conf file (vi/etc/host. conf) and add the following line:
# Lookup names via DNS first then fall back to/etc/hosts.
Order bind, hosts
# We dont have machines with multiple IP addresses on the samecard
(Like virtual server, IP Aliasing ).
Multi off
# Check for IP address spoofing.
Nospoof on
IP Spoofing: IP-Spoofing is a security exploit that works bytricking
Computers in a trust relationship that you are someone that youreally arent.
12. The/etc/securetty file
This file specifies the tty device that allows root login./etc/securetty is read by the/bin/login program.
The format is a list of permitted names. for example, you can edit/etc/securetty and comment out the following rows.
Tty1 # tty2 # tty3 # tty4 # tty5 # tty6 # tty7 # tty8
This means that the root user is only allowed to log on to the tty1 terminal.
13. Special Account
Disable all accounts that are started by the operating system and do not need it by default. this check should be performed when you install the system for the first time. Linux provides various accounts, which you may not need, if you do not need this account, remove it. the more accounts you have, the more vulnerable you will be to attacks.
To delete users on your system, run the following command:
[Root @ deep] # Use the following command to delete a group of user accounts on your system: [root @ deep] # enter the following command on the terminal to delete the following user. [Root @ deep] # userdel adm [root @ deep] # userdel lp [root @ deep] # userdel sync [root @ deep] # userdel shutdown [root @ deep] # userdel halt [root @ deep] # userdelmail SendmailServer, procmail. mailx, delete this account. [Root @ deep] # userdelnews [root @ deep] # userdel uucp [root @ deep] # userdel operator [root @ deep] # userdel games if you do not need X windows Server, delete this account. [Root @ deep] # userdel gopher [root @ deep] # userdel ftp if you do not allow anonymous FTP, delete this user account. Run the following command to delete the group account [root @ deep] # groupdel adm [root @ deep] # groupdel lp [root @ deep] # if groupdel mail does not use the Sendmail server, delete this account [root @ deep] # groupdel news [root @ deep] # groupdel uuucp [root @ deep] # If you do not need X Windows, delete this account [root @ deep] # groupdel dip [root @ deep] # groupdel pppusers [root @ deep] # groupdel popusers if you do not need a POP server, delete this account Group [root @ deep] # groupdel slipusers use the following command to add the required user account [root @ deep] # useradd username use the following command Change the user password [root @ deep] # passwd username. use the chattr command to add unchangeable attributes to the following files. [Root @ deep] # chattr + I/etc/passwd [root @ deep] # chattr + I/etc/shadow [root @ deep] # chattr + I/etc/group [root @ deep] # chattr + I/etc/gshadow
14. prevent anyone from using su as root.
If you don't want anyone to use su as the root user, you can edit/etc/pam. d/su and add the following lines:
Auth sufficient/lib/security/pam_rootok.so debug
Auth required/lib/security/pam_wheel.so group = isd
This means that only users in the isd group can use su as the root.
Then, if you want the user admin to su as root, run the following command.
[Root @ deep] # usermod-G10 admin
16. resource restrictions
Setting resource limits for all users on your system can prevent DoS attacks (denial of service attacks)
Such as the maximum number of processes and the number of memories. For example, the following restrictions apply to all users:
Edit/etc/security/limits. con Plus: * hard core 0 * hard rss 5000 * hard nproc 20
You must also edit the/etc/pam. d/login file and check the existence of this row.
Session required/lib/security/pam_limits.so
The preceding command disables core files "core 0", limits the number of processes to "nproc50", and limits the memory usage to 5 MB "rss 5000 ".
17. The/etc/lilo. conf file
A) Add: restricted
Add this line to each boot image. This indicates that if you use (linux single) during boot, a password is required.
B) Add: password = some_password
When used in combination with restricted, and the user needs to enter the password for normal boot, you also need to ensure that the lilo. conf file cannot be readable by non-root users, and the password is free of plaintext. The following is an example:
Edit/etc/lilo. conf and add: boot =/dev/sda map =/boot/mapinstall =/boot. B prompt timeout = 50 Default = linux restricted? Add this line. password = some_password? Add this line. image =/boot/vmlinuz-2.2.12-20 label = linuxinitrd =/boot/initrd-2.2.12-10.img root =/dev/sda6 read-only [root @ deep] # chmod 600/etc/lilo. conf (no longer readable by other users ). [root @ deep] #/sbin/lilo-v (update lilo configuration ). [root @ deep] # chattr + I/etc/lilo. conf (prevent this file from being modified)
18. Disable Control-Alt-Delete from restarting machine commands
[Root @ deep] # vi/etc/inittab
Ca: ctrlaltdel:/sbin/shutdown-t3-r now
To
# Ca: ctrlaltdel:/sbin/shutdown-t3-r now
[Root @ deep] #/sbin/init q
19. reset the permission for all files in the/etc/rc. d/init. d/directory.
[Root @ deep] # chmod-R 700/etc/rc. d/init. d /*
Only the root user can read, write, and execute all the above script. file.
20. The/etc/rc. d/rc. local file
By default, when you log in to the linux server, it tells you the linux version name, kernel version name, and server
Host name. It gives you too much information. if you want to get the prompt login:, edit/etc/rc. d/rc. local to put # in front of the following line
# This will overwrite/etc/issue at every boot. So, make anychanges you
# Want to make to/etc/issue here or you will lose them when youreboot.
# Echo "">;/etc/issue
# Echo "$ R" >;>;/etc/issue
# Echo "Kernel $ (uname-r) on $ a $ (uname-m)" >;>;/etc/issue
#
# Cp-f/etc/issue/etc/issue.net
# Echo >;>;/etc/issue
Then, do the following:
[Root @ deep] # rm-f/etc/issue
[Root @ deep] # rm-f/etc/issue.net
[Root @ deep] # touch/etc/issue
[Root @ deep] # touch/etc/issue.net
21. the bit of the program owned by the root user.
Remove the s-bit flag of programs owned by the root user. of course, some programs need this. run the 'chmod a-s' command to complete this operation.
Note: the programs with the (*) sign in front do not need the s-bit flag.
[Root @ deep] # find/-type f \ (-perm-04000-o-perm-02000 \) \-exec ls? Lg {}\;
-Rwsr-xr-x 1 root 33120 Mar 21 1999/usr/bin/
*-Rwsr-xr-x 1 root 30560 Apr 15/usr/bin/chage
*-Rwsr-xr-x 1 root 29492 Apr 15/usr/bin/gpasswd
-Rwsr-xr-x 1 root 3208 Mar 22 1999/usr/bin/disable-paste
-Rwxr-sr-x 1 root man 32320 Apr 9 1999/usr/bin/man
-R-s -- x 1 root 10704 Apr 14/usr/bin/passwd
-Rws -- x 2 root 517916 Apr 6 1999/usr/bin/suidperl
-Rws -- x 2 root 517916 Apr 6 1999/usr/bin/sperl5.00503
-Rwxr-sr-x 1 root email 11432 Apr 6 1999/usr/bin/lockfile
-Rwsr-sr-x 1 root mail 64468 Apr 6 1999/usr/bin/procmail
-Rwsr-xr-x 1 root 21848 Aug 27/usr/bin/crontab
-Rwxr-sr-x 1 root slocate 15032 Apr 19 14:55/usr/bin/slocate
*-R-xr-sr-x 1 root tty 6212 Apr 17/usr/bin/wall
*-Rws -- x 1 root 14088 Apr 17/usr/bin/chfn
*-Rws -- x 1 root 13800 Apr 17/usr/bin/chsh
*-Rws -- x 1 root 5576 Apr 17/usr/bin/newgrp
*-Rwxr-sr-x 1 root tty 8392 Apr 17/usr/bin/write
-Rwsr-x --- 1 root squid 14076 Oct 7/usr/lib/squid/pinger
-Rwxr-sr-x 1 root utmp 15587 Jun 9 09:30/usr/sbin/utempter
*-Rwsr-xr-x 1 root 5736 Apr 19/usr/sbin/usernetctl
*-Rwsr-xr-x 1 root bin 16488 Jul 6/usr/sbin/traceroute
-Rwsr-sr-x 1 root 299364 Apr 19/usr/sbin/sendmail
-Rwsr-xr-x 1 root 34131 Apr 16/usr/libexec/pt_chown
-Rwsr-xr-x 1 root 13208 Apr 13/bin/su
*-Rwsr-xr-x 1 root 52788 Apr 17/bin/mount
*-Rwsr-xr-x 1 root 26508 Apr 17/bin/umount
*-Rwsr-xr-x 1 root 17652 Jul 6 09:33/bin/ping
-Rwsr-xr-x 1 root 20164 Apr 17/bin/login
*-Rwxr-sr-x 1 root 3860 Apr 19/sbin/netreport
-R-sr-xr-x 1 root 46472 Apr 17/sbin/pwdb_chkpwd
[Root @ deep] # chmod a-s/usr/bin/chage
[Root @ deep] # chmod a-s/usr/bin/gpasswd
[Root @ deep] # chmod a-s/usr/bin/wall
[Root @ deep] # chmod a-s/usr/bin/chfn
[Root @ deep] # chmod a-s/usr/bin/chsh
[Root @ deep] # chmod a-s/usr/bin/newgrp
[Root @ deep] # chmod a-s/usr/bin/write
[Root @ deep] # chmod a-s/usr/sbin/usernetctl
[Root @ deep] # chmod a-s/usr/sbin/traceroute
[Root @ deep] # chmod a-s/bin/mount
[Root @ deep] # chmod a-s/bin/umount
[Root @ deep] # chmod a-s/bin/ping
[Root @ deep] # chmod a-s/sbin/netreport
You can use the following command to find all programs with the s-bit flag:
[Root @ deep] # find/-type f \ (-perm-04000-o-perm-02000 \) \-exec ls-lg {}\;
>; Suid-sgid-results
Output the result to the suid-sgid-results file.
To find all writable files and directories, run the following command:
[Root @ deep] # find/-type f \ (-perm-2-o-perm-20 \)-execls-lg {}\;>; ww-files-results
[Root @ deep] # find/-type d \ (-perm-2-o-perm-20 \)-execls-ldg {}\;>; ww-directories-results
Run the following command to find files without owners:
[Root @ deep] # find/-nouser-o-nogroup>; unowed-results
Run the following command to find all. rhosts files:
[Root @ deep] # find/home-name. rhosts>; rhost-results
Common network service applications recommended for replacement
WuFTPD
WuFTD has been prone to security vulnerabilities since 1994. hackers can easily obtain Remote root access permissions, in addition, many security vulnerabilities do not even require a valid account on the FTP server. Recently, WuFTP also frequently experienced security vulnerabilities.
Its best alternative is ProFTPD. ProFTPD is easy to configure. In most cases, it is faster, and its source code is also relatively clean (fewer buffer overflow errors ). Many important sites use ProFTPD. Sourceforge.net is a good example (this site has a total of 3,000 open-source projects, and its load is not small !). Some Linux publishers also use ProFTPD on their main FTP site, and WuFTPD is only used by two major Linux Publishers (SuSE and Caldera.
Another advantage of ProFTPD is that it can run both from inetd and as a separate daemon. In this way, some problems caused by inetd can be easily solved, such as denial-of-service (DoS) attacks. The simpler the system, the easier it is to ensure system security. WuFTPD either review all source code (very difficult) or completely rewrite the code. otherwise, WuFTPD must be replaced by ProFTPD.
Telnet
Telnet is very insecure. it uses plain text to send passwords. Its safe alternative is OpenSSH.
OpenSSH is very mature and stable on Linux, and there are also a lot of free client software on Windows platform. Linux publishers should adopt the OpenBSD policy: install OpenSSH and set it to the default one. install Telnet but do not set it to the default one. For USALinux publishers can easily add OpenSSH to the Linux release. Linux publishers in the United States need to find some other methods (for example, RedHat has the latest OpenSSH rpm package on the FTP server in Germany (ftp.redhat.de ).
Telnet is a hopeless program. To ensure system security, software such as OpenSSH must be used instead.
Sendmail
In recent years, the security of Sendmail has improved a lot (in the past, it was usually a program that hackers attacked ). However, Sendmail still has a serious problem. Once a security vulnerability occurs (for example, a Linux kernel error occurs recently), Sendmail is a program that has been attacked by hackers, because Sendmail runs with root permission and the code is huge and prone to problems.
Almost all Linux publishers use Sendmail as the default configuration, and only a few use Postfix or Qmail as optional software packages. However, few Linux publishers use Sendmail on their own mail servers. Both SuSE and RedHat use Qmail-based systems.
Sendmail is not necessarily replaced by other programs. However, its two alternatives, Qmail and Postfix, are safer and faster than it, and especially Postfix, is easier to configure and maintain than it.
Su
Su is used to change the ID of the current user and convert it to another user. You can log on as a common user. when you need to do something as root, you only need to execute the "su" command and then enter the root password. Su itself is no problem, but it will make people develop bad habits. If a system has multiple administrators, you must give them the root password.
An alternative to su is sudo. Red Hat6.2 contains the software. Sudo allows you to set which user group can execute programs as root. You can also restrict the user's logon location (if someone breaks a user's password and uses this account to log on from a remote computer, you can restrict the user's use of sudo ). Debian also has a similar program called super, which has advantages and disadvantages compared with sudo.
Let users develop good habits. Using the root account and letting multiple people know the root password is not a good habit. This is why www.apache.org was infiltrated because it has multiple system administrators who have root privileges. A messy system is easy to intrude.
Named
Most Linux publishers solve this problem. Named was previously run as root. Therefore, when a new vulnerability occurs in named, it is easy to intrude into some important computers and obtain the root permission. Now, you only need to use some command line parameters to run named as a non-root user. In addition, most Linux publishers now allow named to run with the permissions of common users. Command format: named-u;-g;
INN
The INN documentation clearly states that "disabling this function (verifycancels) is useless and will be removed ". About a month ago, a hacker released a method to intrude into INN when verifycancels takes effect. RedHat sets verifycancels as valid. Any setuid/setgid program or network service program must be correctly installed and checked to ensure that security vulnerabilities are not found.

Security Code
1. abolish all default accounts and passwords of the system.
2. do not display company headers, online help, or other information before your legality is verified.
3. abolish the network services that hackers can attack the system.
4. Use a 6-to 8-digit alphanumeric password.
5. restrict the number of times a user attempts to log on to the system.
6. record security violations and review security records.
7. encryption must be performed before important information is transmitted over the Internet.
8. pay attention to the suggestions made by experts and install the system "patches" they recommend ".
9. restrict host files that can be accessed without a password.
10. modify the network configuration file to limit the number of TCP connections from outside to the minimum number of ports. Protocols such as tftp, sunrpc, printer, rlogin, and rexec are not allowed.
11. use upas instead of sendmail. Sendmail has many known vulnerabilities and is difficult to completely fix.
12. remove programs that are not critical to the operation and are rarely used.
13. use chmod to change all system directories to the 711 mode. In this way, attackers will not be able to see what is in them, and users can still execute.
14. if possible, install the disk in read-only mode. In fact, only a few directories need to be read and written.
15. upgrade the system software to the latest version. The old version may have been researched and successfully attacked. The latest version generally includes the remedy for these problems.