HARDENING LINUX

By P. NAORK

CONTENTS ICHAPTER HARDENING THE BASICS INSTALLING YOUR DISTRIBUTION SECURELY SOME ANSWERS TO COMMON INSTALLATION QUESTIONS INSTALL ONLY WHAT YOU NEED SECURE BOOTING, BOOT LOADERS, AND BOOT-TIME SERVICES SECURING YOUR BOAT LOADER INIT, STARTING SERVICES, AND BOOT SEQUENCING CONSOLES, VIRTUAL TERMINALS, AND LOGIN SCREENS SECURING THE CONSOLE THE RED HAT CONSOLE SECURING VIRTUAL TERMINALS SECURING LOGIN SCREENS USERS AND GROUPS SHADOW PASSWORDING GROUPS ADDING USERS ADDING GROUPS DELETING UNNECESSARY USERS AND GROUPS PASSWORDS PASSWORD AGING SUDO USER ACCOUNTING PROCESS ACCOUNTING PLUGGABLE AUTHENTICATION MODULES (PAM) PAM MODULE STACKING THE PAM “OTHER” SERVICE RESTRICTING SU USING PAM SETTING LIMITS WITH PAM RESTRICTING USERS TO SPECIFIC LOGIN TIMES WITH PAM PACKAGE MANAGEMENT, FILE INTEGRITY, AND UPDATING ENSURING FILE INTEGRITY DOWNLOADING UPDATES AND PATCHES COMPILERS AND DEVELOPMENT TOOLS REMOVING THE COMPILERS AND DEVELOPMENT TOOLS RESTRICTING THE COMPILERS AND DEVELOPMENT TOOLS HARDENING AND SECURING YOUR KERNEL GETTING YOUR KERNEL SOURCE THE OPENWALL PROJECT OTHER KERNEL-HARDENING OPTIONS KEEPING INFORMED ABOUT SECURITY SECURITY SITES AND MAILING LISTS VENDOR AND DISTRIBUTION SECURITY SITES RESOURCES MAILING LISTS SITES ICHAPTER FIREWALLING YOUR HOSTS SO, HOW DOES A LINUX FIREWALL WORK? TABLES CHAINS POLICIES ADDING YOUR FIRST RULES CHOOSING FILTERING CRITERIA THE IPTABLES COMMAND CREATING A BASIC FIREWALL CREATING A FIREWALL FOR A BASTION HOST SECURING THE BASTION SERVICES FIREWALL LOGGING HANDLING ICMP TRAFFIC SPOOFING, HIJACKING, AND DENIAL OF SERVICE ATTACKS IPTABLES AND TCP FLAGS SOME FINAL BASTION HOST RULES KERNEL MODULES AND PARAMETERS PATCH-O-MATIC KERNEL PARAMETERS MANAGING IPTABLES AND YOUR RULES IPTABLES-SAVE AND IPTABLES-RESTORE IPTABLES INIT SCRIPTS TESTING AND TROUBLESHOOTING BOOKS SECURING CONNECTIONS AND REMOTE ADMINISTRATION PUBLIC-KEY ENCRYPTION SSL, TLS, AND OPENSSL STUNNEL IPSEC, VPNS, AND OPENSWAN INETD AND XINETD-BASED CONNECTIONS REMOTE ADMINISTRATION SSH SCP AND SFTP SSH-AGENT AND AGENT FORWARDING THE SSHD DAEMON CONFIGURING SSH AND SSHD PORT FORWARDING WITH OPENSSH FORWARDING X WITH OPENSSH SECURING FILES AND FILE SYSTEMS BASIC FILE PERMISSIONS AND FILE ATTRIBUTES ACCESS PERMISSIONS OWNERSHIP IMMUTABLE FILES CAPABILITIES AND LCAP ENCRYPTING FILES SECURELY MOUNTING FILE SYSTEMS SECURING REMOVABLE DEVICES CREATING AN ENCRYPTED FILE SYSTEM INSTALLING THE USERLAND TOOLS ENABLING THE FUNCTIONALITY ENCRYPTING A LOOP FILE SYSTEM UNMOUNTING YOUR ENCRYPTED FILE SYSTEM REMOUNTING MAINTAINING FILE INTEGRITY WITH TRIPWIRE CONFIGURING TRIPWIRE EXPLAINING TRIPWIRE POLICY NETWORK FILE SYSTEM (NFS) SITES ABOUT ACLS UNDERSTANDING LOGGING AND LOG MONITORING SYSLOG CONFIGURING SYSLOG STARTING SYSLOGD AND ITS OPTIONS SYSLOG-NG INSTALLING AND CONFIGURING SYSLOG-NG THE CONTRIB DIRECTORY RUNNING AND CONFIGURING SYSLOG-NG SAMPLE SYSLOG-NGCONF FILE LOGGING TO A DATABASE WITH SYSLOG-NG SECURE LOGGING WITH SYSLOG-NG TESTING LOGGING WITH LOGGER LOG ANALYSIS AND CORRELATION INSTALLING AND RUNNING SEC INPUTTING MESSAGES TO SEC BUILDING YOUR SEC RULES LOG MANAGEMENT AND ROTATION USING TOOLS FOR SECURITY TESTING INNER LAYER SCANNING FOR EXPLOITS AND ROOT KITS TESTING YOUR PASSWORD SECURITY AUTOMATED SECURITY HARDENING WITH BASTILLE LINUX OUTER LAYER NMAP NESSUS OTHER METHODS OF DETECTING A PENETRATION RECOVERING FROM A PENETRATION ADDITIONAL SECURITY TOOLS DSNIFF ETHEREAL ETTERCAP LIDS NETCAT SARA SNORT TCPDUMP TITAN SECURING YOUR MAIL SERVER WHICH MAIL SERVER TO CHOOSE? HOW IS YOUR MAIL SERVER AT RISK? PROTECTING YOUR MAIL SERVER CHROOTING A SENDMAIL SMTP GATEWAY OR RELAY CHROOTING POSTFIX SECURING YOUR SMTP SERVER OBFUSCATING THE MTA BANNER AND VERSION DISABLING DANGEROUS AND LEGACY SMTP COMMANDS SOME ADDITIONAL SENDMAIL PRIVACY FLAGS SENDMAIL AND SMRSH WRITING TO FILES SAFELY LIMITING THE RISK OF (DISTRIBUTED) DOS ATTACKS RELAYING, SPAM, AND VIRUSES RELAYING ANTISPAM ANTIVIRUS SCANNING YOUR E-MAIL SERVER AUTHENTICATING AND SECURING YOUR MAIL TLS CREATING CERTIFICATES FOR TLS TLS WITH SENDMAIL TLS WITH POSTFIX SMTP AUTH USING CYRUS SASL COMPILING CYRUS SASL CONFIGURING SASL SASLAUTHD SMTP AUTH USING CYRUS SASL FOR SENDMAIL COMPILING CYRUS SASL INTO SENDMAIL CONFIGURING CYRUS SASL FOR SENDMAIL USING SMTP SERVER AUTHENTICATION WITH SENDMAIL USING SMTP CLIENT AUTHENTICATION WITH SENDMAIL SMTP AUTH USING CYRUS SASL FOR POSTFIX COMPILING CYRUS SASL INTO POSTFIX CONFIGURING CYRUS SASL FOR POSTFIX USING SMTP SERVER AUTHENTICATION WITH POSTFIX USING SMTP CLIENT AUTHENTICATION WITH POSTFIX TESTING SMTP AUTH WITH OUTLOOK EXPRESS HARDENING REMOTE ACCESS TO E-MAIL IMAP POP CHOOSING IMAP OR POP SERVERS HOW IS YOUR IMAP OR POP SERVER AT RISK? CYRUS IMAP INSTALLING AND COMPILING CYRUS IMAP INSTALLING CYRUS IMAP INTO A CHROOT JAIL CONFIGURING CYRUS IMAP CYRUS IMAP AUTHENTICATION WITH SASL CYRUS IMAP ACCESS CONTROL AND AUTHORIZATION TESTING CYRUS IMAP WITH IMTEST/POP3TEST FETCHMAIL INSTALLING FETCHMAIL CONFIGURING AND RUNNING FETCHMAIL SECURING AN FTP SERVER HOW DOES FTP WORK? FIREWALLING YOUR FTP SERVER WHAT FTP SERVER TO USE? INSTALLING VSFTPD CONFIGURING VSFTPD FOR ANONYMOUS FTP GENERAL CONFIGURATION MODE AND ACCESS RIGHTS GENERAL SECURITY PREVENTING DENIAL OF SERVICE ATTACKS CONFIGURING VSFTPD WITH LOCAL USERS ADDING SSL/TLS SUPPORT STARTING AND STOPPING VSFTPD HARDENING DNS AND BIND YOUR DNS SERVER AT RISK MAN-IN-THE-MIDDLE ATTACKS CACHE POISONING DENIAL OF SERVICE ATTACKS DATA CORRUPTION AND ALTERATION OTHER RISKS WHAT DNS SERVER SHOULD YOU CHOOSE? SECURE BIND DESIGN INSTALLING BIND CHROOTING BIND PERMISSIONS IN THE CHROOT JAIL STARTING AND RUNNING NAMED CONFIGURING BIND ACCESS CONTROL LISTS LOGGING OPTIONS VIEWS AND ZONES ZONES TSIG THE RNDC COMMAND RNDCCONF ADDING RNDC SUPPORT TO NAMEDCONF USING RNDC INFORMATION ABOUT ZONE FILES