This book is intended for a target audience of technical and system administrators who manage Linux servers, but it also includes enough material for home users and others. It discusses how to install and setup a Red Hat Linux Server with all the necessary security and optimization for a high performance Linux specific machine. Since we speak of optimization and security configuration, we have used only source distribution (tar.gz) programs; the most available type for critical server software, like Apache, BIND/DNS, Samba, Squid, OpenSSL etc. Source packages give us fast upgrades, security updates when necessary, and a better compilation, customization, and optimization option for our specific machines that often we can't have with RPM packages.

Depending of your level of knowledge in Linux, you can read this book from the start to finish or each chapter which may be of interest to you. Each chapter and section of this book appears in a manner that let you read only the relevant parts of your interest without the need to schedule a couple of day's reading.

Too many books available as of now take two pages to explain something that can be explained in two lines, I'm sure that many of you agree with my opinion. This book attempts a different path, in the sense, only the essential and important information that the readers are interested in knowing are explained in detail thereby eliminating all the nonsense. Though the fact that you can read this book in any order you want, there is a particular order that you could follow if something seem to be confusing for you. The steps shown below is what I recommend to facilitate a smooth reading.

Chapter 2 through Chapter 4 will guide you to do these steps:

Chapter 5 through Chapter 7 will guide you with these additional steps:

Now for this step you will need to go through the book section wise to choose what you want.

These installation instructions assume that: You have a CD-ROM drive on your computer and the Official Red Hat Linux CD-ROM. Installations were tested on the Official Red Hat Linux version 6.1 and 6.2. You should understand the hardware system on which the operating system will be installed. After examining the hardware, the rest of this document guides you, step-by-step, though the installation process.

Securing and Optimizing Linux: RedHat Edition is now also available to download around the most popular Linux web sites. Free formatted versions of this book can be found on the Internet via the following addresses listed below. From the original web site

On the other hand you like the nice feel of paper and would like to browse through the pages at your convenience, you will have to purchase it.

It also comes with an accompanying CD filled with some nice goodies and all the example configuration files.

Other related web sites may exist without my knowledge. If you host this book Securing and Optimizing Linux: RedHat Edition and want to be included in the list of the next release, please send me a message with your intentions. If you receive this as part of a printed distribution or on a CD-ROM, please check out the Linux Documentation home page www.linuxdoc.org/ or the original website at www.openna.com to see if there is a more recent version. This could potentially save you a lot of trouble. If you want to translate this book, please notify me so I can keep track of what languages I have been published in.

4.1. Example Configuration files

The example configuration files in this book are available electronically via http from this website www.openna.com/books/floppy.tgz. In either case, be it from CDROM or if you have downloaded from the website extract the files from the archive by typing:

    
                   [root@deep ]/tmp#tar xzpf floppy.tgz
                  

this is assuming you have stored the floppy.tgz in a directory called tmp/ .

Errata

As i was giving the final look over on this book, Gerhard Mourani has released an errata for all firewall scripts and it is available here http://www.openna.com/books/errata.htm

If you cannot get the examples directly over the Internet, please contact the author at these email addresses:

<gmourani@openna.com>

<gmourani@netscape.net>

I would like to thank Michel Méral who has drawn all the beautiful animal drawing in my book, Robert L. Ziegler for allowing me to include his Firewall software and all Linux users around the world for their comments and suggestions.

Linux is an Operating System that was first created at the University of Helsinki in Finland by a young student named Linus Torvalds. At this time the student was working on a UNIX system that was running on an expensive platform. Because of his low budget, and his need to work at home, he decided to create a copy of the UNIX system in order to run it on a less expensive platform, such as an IBM PC. He began his work in 1991 when he released version 0.02 and worked steadily until 1994 when version 1.0 of the Linux Kernel was released. The current full-featured version at this time is 2.2.X; released January 25, 1999, and development continues.

There are no royalty or licensing fees for using Linux, and the source code can be modified to fit your needs. The results can be sold for profit, but original authors retain copyright and you must provide the source to your modifications.

Because it comes with source code to the kernel, it is quite portable. Linux runs on more CPUs and platforms than any other computer operating system. The recent direction of the software and hardware industry is to push consumers to purchase faster computers with more system memory and hard drive storage. Linux systems are not affected by those industries orientation because of it capacity to run on any kind of computers, even aging x486-based computers with limited amounts of RAM.

Linux is a true multi-tasking operating system similar to its brother UNIX. It uses sophisticated, state-of-the-art memory management to control all system processes. That means that if a program crashes you can kill it and continue working with confidence.

Another benefit is that Linux is practically immunized against all kinds of viruses that we find in other operating systems. To date we have found only two viruses that were effective on Linux systems.

Let's dispel some of the fear, uncertainty, and doubt about Linux:

It's a toy operating system.  Fortune 500 companies, governments, and consumers; more and more use, Linux as a cost-effective computing solution. It has been used and is still used by big companies like IBM, Amtrak, NASA, and others.

There's no support.  Every Linux distribution comes with more than 12,000 pages of documentation. Commercial Linux distributions such as Red Hat Linux, Caldera, SuSE, and OpenLinux offer initial support for registered users, and small business and corporate accounts can get 24/7 supports through a number of commercial support companies. As an Open Source operating system, there's no six-months to wait for a service release, and the online Linux community fixes many serious bugs within hours.

Understanding the hardware of your computer is essential for a successful installation of Red Hat Linux. Therefore, you should take a moment now and familiarize yourself with your computer hardware. Be prepared to answer the following questions:

The first thing to do is to create an installation diskette also known as a boot disk. If you have purchased the official Red Hat Linux CD-ROM, you will find this floppy disk named Boot Diskette in the Red Hat Linux box and you don't need to create it. From time to time, you may find that the installation will fail with the standard diskette image that comes with the official Red Hat Linux CD-ROM. If this happens, a revised diskette is required in order for the installation to work properly. In these cases, special images are available via the Red Hat Linux Errata web page to solve the problem www.redhat.com/errata. Since this, is a relatively rare occurrence, you will save time if you try to use the standard diskette images first, and then review the Errata only if you experience any problem completing the installation.

Step 1.  Before you make the boot disk, insert the Official Red Hat Linux™ CD-ROM Part 1 in your computer that runs the Windows© operating system. When the program asks for the filename, enter boot.img for the boot disk. To make the floppies under MS-DOS©, you need to use these commands assuming your CD-ROM is drive D: and contain the Official Red Hat Linux© CD-ROM.

Open the Command Prompt under Windows: Start | Programs | Command Prompt

             C:\> d:
             D:\> cd \dosutils
             D:\dosutils> rawrite
             Enter disk image source file name: ..\images\boot.img
             Enter target diskette drive: a:
             Please insert a formatted diskette into drive A: and press --ENTER-- :

             D:\dosutils>             
             

The rawrite.exe program asks for the filename of the disk image: Enter boot.img and insert a floppy into drive A. It will then ask for a disk to write to: Enter a:, and when complete, label the disk; for example, Red Hat boot disk.

Step 2.  Since we'd start the installation directly off the CD-ROM, boot with the boot disk. Insert the boot diskette you create into the drive A: on the computer where you want to install Linux and reboot the computer. At the boot:, press Enter to continue booting and follow the three simple steps below:

Red Hat Linux 6.1 and 6.2 include four different classes, or type of installation. They are:

The first three classes GNOME Workstation, KDE Workstation, and Server give you the option of simplifying the installation process with a significant loss of configuration flexibility that we don't want to lose. For this reason we highly recommend Custom installation, as this allows you to choose what services are added and how the system is partitioned.The idea is to load the minimum number of packages, while maintaining maximum efficiency. The less software that resides on the box, the fewer potential security exploits or holes may appear.Select Custom and click Next

We assume that you are installing your new Linux server to a new hard drive, with no other existing file system or operating system previously installed. A good partition strategy is to create a separate partition for each major file system. This enhances security and prevents accidental denial of service or exploit of SUID programs.

Creating multiple partitions offers you the following advantages:

Step 1.  For performance, stability and security reasons you must create something like the following partitions listed below on your computer. We suppose for this partition configuration the fact that you have a SCSI hard drive of 3.2 GB. Of course you will need to adjust partition sizes according to your own needs and disk size. Partitions that must be created on your system:

                      /boot	   5MB		
                      /usr	 512MB		
                      /home	1146MB		
                      /chroot	 256MB		
                      /cache	 256MB		
                      /var	 256MB		
                   <Swap>	 128MB		
                      /tmp	 256MB		
                      /		 256MB		
                      

We have made two more special partitions:

If you are not intending to install Squid Proxy server you don't need to create the /cache partition.

Keeping /tmp and /home on separate partitions is pretty much mandatory if users have shell access to the server- protection against SUID programs; splitting these off into separate partitions also prevent users from filling up any critical file system -denial of service attack. The same applies to /var, and /usr on separate partitions is also a very good idea. By isolating the /var partition, you protect your root partition from overfilling -denial of service attack.

In our partition configuration we'll reserve 256 MB of disk space for chrooted programs like Apache, DNS and other software. This is necessary because Apache DocumentRoot files and other binaries, programs related to Apache will be installed in this partition if you decide to run Apache web server in a chrooted jail.

Take note that the size of the Apache chrooted directory on the chrooted partition is proportional to the size of your DocumentRoot files. If you're not intending to install and use Apache on your server, you can reduce the size of this partition to something like 10 MB for DNS server that you always need in a chrooted jail environment for security reasons.

Minimum size of partitions

For information purposes only, this is the minimum size in megabytes, which a Linux installation must have to function properly. The sizes of partitions listed below are really small. This configuration can fit into a very old hard disk of 512MB in size that you might find in old x486 computers. We show you this partition just to get an idea of the minimum requirements.

              /	         35MB
              /boot	  5MB
              /chroot	 10MB
              /home	100MB
              /tmp	 30MB
              /usr	232MB
              /var	 25MB
              

Disk Druid Partitions is a program that partitions your hard drive for you. Choose Add to add a new partition, Edit to edit a partition, Delete to delete a partition and Reset to reset the partitions to the original state. When you add a new partition, a new window appears on your screen and gives you parameters to choose. Different parameters are:

If you have a SCSI disk the device name will be /dev/sda and if you have an IDE disk it will be /dev/hda. If you're looking for high performance and stability, a SCSI disk is highly recommended. Linux refers to disk partitions using a combination of letters and numbers. It uses a naming scheme that is more flexible and conveys more information than the approach used by other operating systems.

Here is a summary:

Disk naming convention

First Two Letters

The first two letters of the partition name indicate the type of device on which the partition resides. You'll normally see either hd (for IDE disks), or sd (for SCSI disks).

The Next Letter

This letter indicates which device the partition is on. For example: /dev/hda (the first IDE hard disk) and /dev/hdb (the second IDE disk).

Keep this information in mind, it will make things easier to understand when you're setting up the partitions Linux requires.

Swap partitions are used to support virtual memory. If your computer has 16 MB of RAM or less, you must create a swap partition. Even if you have more memory, a swap partition is still recommended. The minimum size of your swap partition should be equal to your computer's RAM or 16 MB (whichever is larger). The largest useable swap partition is roughly 1 GB, since 2.2 kernel, 1 GB swap file are supported so making a swap partition larger than that will result in wasted space. Note, however, that you can create and use more than one swap partition although this is usually only necessary for very large server installations.

Try to put your swap partitions near the beginning of your drive. The beginning of the drive is physically located on the outer portion of the cylinder, so the read/write head can cover much more ground per revolution.

representation of linux partition

To make the partitions listed below on your system; this is the partition we'll need for our server installation example; the command will be under Disk Druid:

After the partitions of your hard disk has been completed, you must see something like the following information on your screen. Our mount points will look like this:

Now that you are partitioning and choosing the mount point of your directories, select Next to continue. After your partitions are created, the installation program will ask you to choose partitions to format. Choose the partitions you want to initialize, check the (Check for bad blocks during format) box, and press Next. This formats the partitions and makes them active so Linux can use them.

On the next screen you will see the LILO Configuration where you have the choice to install LILO boot record on:

Or

Usually if Linux is the only OS on your machine you should choose the Master Boot Record (MBR) option. After that, you need to configure your Network and Clock. After you finish configuring the clock, you need to give your system a root password and authentication configuration. For Authentication Configuration don't forget to select:

Enable NIS doesn't need to be selected since we are not configuring NIS services on this server.

After your partitions have been configured and selected for formatting, you are ready to select packages for installation. By default, Linux is a powerful operating system that executes many useful services. However, many of these services are unneeded and pose potential security risks.

Ideally, each network service should be on a dedicated, single-purpose host. Many Linux operating systems are configured by default to provide a wider set of services and applications than are required to provide a particular network service, so you may need to configure the server to eliminate unneeded services. Offering only essential services on a particular host can enhance your network security in several ways:

By reducing services, the number of logs and log entries is reduced so detecting unexpected behavior becomes easier.

A proper installation of your Linux server is the first step to a stable, secure system. You first have to choose which system components you want to install. Choose the components, and then you can go through and select or deselect each individual package of each component by selecting Select individual packages option on your Red Hat setup screen. Since we are configuring a Linux Server, we don't need to install a graphical interface XFree86 on our system, a graphical interface on a server means less processes, less CPU availability, less memory, security risks, and so on. Graphical interfaces are usually used on workstations only.

Select the following packages for installation:

After selecting the components you wish to install, you may select or deselect packages.

The installation program presents a list of the package groups available. Select a group to examine. The components listed below must be deselected from the Menu Group for security; optimization and other reasons described below:

Applications/File: 

Applications/Internet: 

Applications/Publishing: 

Applications/System: 

Documentation: 

System Environment/Base: 

System Environment/Daemons: . 

System Environment/Libraries: 

User Interface/X: 

This section contains an overview of principal modes using with RPM for installing, uninstalling, upgrading, querying, listing, and checking RPM packages on your Linux system. You must be familiar with these RPM commands now because we'll use them often in the continuation of this book. To install a RPM package, use the command:

                 [root@deep] /#rpm -ivh foo-1.0-2.i386.rpm
                 

Take a note that RPM packages have a file of names like foo-1.0-2.i386.rpm, which include the package name (foo), version (1.0), release (2), and architecture (i386).

To uninstall a RPM package, use the command:

                 [root@deep] /#rpm -e foo
                 

Notice that we used the package name foo, not the name of the original package file foo-1.0-2.i386.rpm.

To upgrade a RPM package, use the command:

                 [root@deep] /#rpm -Uvh foo-1.0-2.i386.rpm
                 

With this command, RPM automatically uninstall the old version of foo package and install the new one. Always use rpm -Uvh to install packages, since it works fine even when there are no previous versions of the package installed.

To query a RPM package, use the command:

                 [root@deep] /#rpm -q foo
                 

This command will print the package name, version, and release number of installed package foo. Use this command to verify that a package is or is not installed on your system.

To display package information, use the command:

                 [root@deep] /#rpm -qi foo
                 

This command display package information; includes name, version, and description of the installed program. Use this command to get information about the installed package.

To list files in package, use the command:

                 [root@deep] /#rpm -qlfoo
                 

This command will list all files in a installed RPM package. It works only when the package is already installed on your system.

To check a RPM signature package, use the command:

                 [root@deep] /#rpm  --checksig foo
                 

This command checks the PGP signature of specified package to ensure its integrity and origin. Always use this command first before installing new RPM package on your system. Also, GnuPG or Pgp software must be already installed on your system before you can use this command.

The init program of Linux -also known as process control initialization, is in charge of starting all the normal and authorized processes that need to run at boot time on your system. These may include the APACHE daemons, NETWORK daemons, and anything else that must be running when your machine boots. Each of these processes has a script under /etc/rc.d/init.d/ directory written to accept an argument, which can be start, stop and restart. You can execute those scripts by hand in fact with a command:

         [root@deep] /# /etc/rc.d/init.d/httpd start
         

         [root@deep] /# /etc/rc.d/init.d/httpd stop
         

         [root@deep] /# /etc/rc.d/init.d/httpd restart
         

Red Hat Linux installs other pre-compiled binaries of programs on your system by default and doesn't give you the choice to uninstall them during the install setup. For this reason, you must uninstall the following software on your system after the installation of your server.We must uninstall them for better security and to make space in our server.

For more information and explanation of their capabilities and uses, please see your Red Hat manual or install the package and make an rpm -qi foo command to query and get a detailed description of the program, and then uninstall it again. Below is the list of programs and a short description of their utilizations.

The command to uninstall software is:

         [root@deep] /#rpm -e <softwarename(s)>
         

Where <softwarename> is the name of the software you want to uninstall e.g. (foo).

Since Programs like apmd, kudzu, and sendmail are daemons that run as process. It is better to stop those processes before uninstalling them from the system.To stop those processes, use the following commands:

         [root@deep] /# /etc/rc.d/init.d/apmd stop
         [root@deep] /# /etc/rc.d/init.d/sendmail stop
         [root@deep] /# /etc/rc.d/init.d/kudzu stop
         

The program hdparm is needed by IDE hard disk but not SCSI hard disks. If you have an IDE disk on your system you must keep this program (hdparm), but if you don't have an IDE hard disk you can remove it safely from your system. To remove hdparm from your system, use the following command:

         [root@deep] /# rpm -e hdparm
         

Use the programs kbdconfig, mouseconfig, timeconfig, authconfig, ntsysv, and setuptool in order to set your keyboard language and type, your mouse type, your default time zone, your NIS and shadow passwords, your numerous symbolic links in /etc/rc.d directory, and text mode menu utility which allow you to access all of these features. After those configurations have been set during the installation stage of your Linux server it's rare that you would need to change them again. So, you can uninstall them, and if in future you need to change your keyboard, mouse, default time, etc again via test mode menu, all you have to do is to install the program with the RPM from your original CD-ROM. To remove all the above programs from your system, use the following command:

         [root@deep] /# rpm -e kbdconfig mouseconfig timeconfig authconfig ntsysv setuptool
         

Even if you are not intending to install a mail server on your Linux system, the program Sendmail is always needed on your servers for potential messages sent to the root user by different software services installed on your machine.

Sendmail is a Mail Transport Agent -MTA program that sends mail from one machine to another. It can be configured in different manners; it can serve as an internal delivery mail system to a Mail Hub Server, or can be configured to be a Central Mail Hub Server for all Sendmail machines on your network. So depending on what you want to do with Sendmail, you must configure it to respond to your specific needs. For this reason you must uninstall Sendmail and see the relevant sections in this book that is related to Sendmail configuration and installation.

To remove Sendmail from your system, use the following command:

         [root@deep] /# rpm -e sendmail
         

There are certain programs required to be able to compile programs on your server, hence you must install the following RPM packages. This part of the installation is very important and requires that you install all related packages described below. These are on your Red Hat Part 1 CD-ROM under RedHat/RPMS directory and represent the base necessary software needed on Linux to compile and install programs.

The RPM package has many options, for example we have used the following sytax:

you might be curious to know what these arguments -Uvh means, why should it be given at all etc.Here is a brief description:

So, when you use rpm -Uvh, whether it is Redhat ver 6.1 or ver 6.2, what you see on your console is shown below,Notice in the display that the name of the package is seen but not the version number. Infact we have mentioned this earlier in this book that when you install or upgrade you have to enter the package name with version name, for example rpm -ivh mnt-1.0.4.rpm but while querying the same package using rpm command the syntax is as follows: rpm -qi mnt, Please do keep this mind. Given below is a graphical representation of your screen when you install the above mentioned rpm's :

              m4                          	##################################################              
              dev86                      	##################################################
              bison                       	##################################################
              byacc                       	##################################################
              cdecl                       	##################################################
              cpp                         	##################################################
              cproto                      	##################################################
              ctags                       	##################################################
              egcs                        	##################################################
              ElectricFence               	##################################################
              flex                        	##################################################
              gdb                         	##################################################
              kernel-headers                    ##################################################
              glibc-devel                 	##################################################
              make                        	##################################################
              patch                       	##################################################
            

You must exit and re-login for all the change to take effect. To exit from your console, use the command:

          [root@deep] /# exit 
          

After installation and compilation of all programs you need on your server, it's a good idea to remove all unnecessary programs (compilers, etc) described above unless needed it is obsolutely needed by the system. Few reasons are:

If you have followed each step exactly as described till now, Since we have chosen to customize the installation of our Linux system, this is the list of all installed programs that you must have on your server after the complete installation of the Linux Server. This list must match exactly the install.log file located in your /tmp directory or you could run into a problem. Don't forget to install all programs listed above in Software that must be installed after installation of the Server to be able to compile programd properly on your Server.

After we have uninstalled all the software that must be uninstalled after the installation of our Linux server see Software that must be uninstalled after installation of the Server and after the addition of the necessary RPM packages, so that we will able to compile programs on our server, we must verify the list of all installed RPM programs again but this time with the following command:

To verify the list of all installed RPM package on your system, use the command:

           [root@deep] /#rpm -qa > installed_rpm
           

The -qa option will query all installed RPM packages on your system and the symbol > will redirect the output to the file named installed_rpm.

The content of the installed_rpm file must match exactly this:

The content of the installed_rpm file must look exactly like this:

This step is required to make sure we have not forgotten to remove some unnecessary RPM or to add some important packages that permit us to compile programs on the system. If the result looks as our installed_rpm file above, we are ready to play with our new Linux server.

Putting some colors on your terminal can help you to distinguish folders, files, archives, devices, symbolic links and executable file from others. My opinion is that colors help to make less errors and fast navigation on your system. It's important to note that this hack is necessary only for Red Hat Linux version 6.1 (Cartman) and older, since the new Red Hat Linux version 6.2 (Zoot) now enables and includes this feature by default. Edit the profile file vi /etc/profile and add the following lines:

         # Enable Colour ls
         eval `dircolors /etc/DIR_COLORS -b`
         export LS_OPTIONS='-s -F -T 0 --color=yes'
         

Edit the bashrc file vi /etc/bashrc and add the line:

         alias ls='ls --color=auto' 
         

Then log in and out. The new COLORS-environment variable should now be set, and your system will recognize that.

Keep and update all software especially network software up to date with the latest versions. Check the errata pages for the Red Hat Linux distribution, available at www.redhat.com/corp/support/errata/index.html. The errata pages are perhaps the best resource for fixing 90% of the common problems with Red Hat Linux. In addition, security holes for which a solution exists are generally on the errata page 24 hours after Red Hat has been notified. You should always check there first. Software that must be updated at this time for your Red Hat Linux server are:

You can verify that the RPM software above is installed on your system before make an update with the following command:

         [root@deep] /#rpm -q <softwarename>
         

Where <softwarename> is the name of the software you want to verify like groff, sysklogd, etc.

It is recommended that you set a Boot password to disallow booting from floppy drives and set passwords on BIOS features. You can check your BIOS manual or look it over thoroughly the next time you boot up your system to know how to do this. Disallowing the possibility to boot from floppy drives and being able to set a password to access the BIOS features will improve the security of your system. This will block undesired people from trying to boot your Linux system with a special boot disk and will protect you from people trying to change BIOS feature like allowing boot from floppy drive or booting the server without prompt password.

It is important to point out that you cannot implement security if you have not decided what needs to be protected, and from whom. You need a security policy; a kind of list of what you consider allowable and not allowable, upon which to base any decisions regarding security. The policy should also determine your response to security violations. What you should consider while compiling a security policy will depend entirely on your definition of security. The answers to the following questions should provide some general guidelines:

This list is not very comprehensive, and your policy will probably encompass a lot more before it is completed. Any security policy must be based on some degree of paranoia; deciding how much you trust people, both inside and outside your organization. The policy must, however, provide a balance between allowing your users reasonable access to the information they require to do their work and totally disallowing access to your information. The point where this line is drawn will determine your policy.

The starting point of our Linux General Security tour is the password. Many people keep their valuable information and files on a computer, and the only thing preventing others from seeing it is the eight-character string called a password. An unbreakable password, contrary to popular belief, does not exist. Given time and resources all passwords can be guessed either by social engineering or by brute force.

Social engineering of server passwords and other access methods are still the easiest and most popular way to gain access to accounts and servers. Often, something as simple as acting as a superior or executive in a company and yelling at the right person at the right time of the day yields terrific results.

Running a password cracker on a weekly basis on your system is a good idea. This helps to find and replace passwords that are easily guessed or weak. Also, a password checking mechanism should be present to reject a weak password when first choosing a password or changing an old one. Character strings that are plain dictionary words, or are all in the same case, or do not contain numbers or special characters should not be accepted as a new password. We recommend the following rules to make passwords effective:

The minimum acceptable password length by default when you install your Linux system is 5. This mean that when a new user is allowed to have a access on the server, his/her password length will be at minimum 5 mixes of character strings, letter, number, special character etc. This is not enough and must be 8.

To prevent non-security-minded people or administrators from being able to enter just 5 characters for the valuable password, edit the rather important /etc/login.defs file and change the value of 5 to 8. Edit the login.defs file vi /etc/login.defs and change the line that read:

            PASS_MIN_LEN    5
            

To read:

            PASS_MIN_LEN    8
            

The login.defs is the configuration file for the login program. You should review or make changes to this file for your particular system. This is where you set other security policy settings like password expiration defaults or minimum acceptable password length.

The root account is the most privileged account on a Unix system. The root account has no security restrictions imposed upon it. This means the system assumes you know what you are doing, and will do exactly what you request -- no questions asked. Therefore it is easy, with a mistyped command, to wipe out crucial system files. When using this account it is important to be as careful as possible. For security reasons, never log in on your server as root unless it is absolutely an instance that necessitates root access. Also, if you are not on your server, never sign in and leave yourself on as root --this is Very, Very, Very BAD practice.

Set login time out for the root account. Despite the notice to never, if they are not on the server sign in as root and leave it unattended, administrators still stay on as root or forget to logout after finishing their work and leave their terminals unattended. The answer to solve this problem is to make the bash shell automatically logout after not being used for a period of time. To do that, you must set the special variable of Linux named TMOUT to the time in seconds of no input before logout. Edit your profile file /etc/profile and add the following line somewhere after the line that read HISTFILESIZE= on this file:

            TMOUT=7200
            

The value we enter for the variable TMOUT= is in second and represent 2 hours (60 * 60 = 3600 * 2 = 7200 seconds). It is important to note that if you decide to put the above line in your /etc/profile file, then the automatic logout after two hours of inactivity will apply for all users on the system. So, instead, if your prefer to control which users will be automatically logged out and which ones not, you can set this variable in their individual .bashrc file. After this parameter has been set on your system, you must logout and login again as root for the change to take effect.

If you are exporting file systems using NFS service, be sure to configure the /etc/exports file with the most restrictive access possible. This means not using wildcards, not allowing root write access, and mounting read-only wherever possible.

            /dir/to/export host1.mydomain.com(ro,root_squash)
            /dir/to/export host2.mydomain.com(ro,root_squash)
            

For this change to take effect you will need to run the following command on your terminal:

            [root@deep]# /usr/sbin/exportfs -a
            

In a safe environment where we are sure that console is secured because passwords for BIOS and LILO are set and all physical power and reset switches on the system are disabled it may be advantageous to entirely disable all console-equivalent access to programs like shutdown, reboot, and halt for regular users on your server. To do this, run the following command:

             [root@deep] /#rm -f /etc/security/console.apps/<servicename>
             

Where <servicename> is the name of the program to which you wish to disable console-equivalent access. Unless you use xdm, however, be careful not to remove the xserver file or no one but root will be able to start the X server. If you always use xdm to start the X server, root is the only user that needs to start X, in which case you might actually want to remove the xserver file.

             
             [root@deep] /# rm -f  /etc/security/console.apps/halt
             [root@deep] /# rm -f  /etc/security/console.apps/poweroff
             [root@deep] /# rm -f  /etc/security/console.apps/reboot
             [root@deep] /# rm -f  /etc/security/console.apps/shutdown
             [root@deep] /# rm -f  /etc/security/console.apps/xserver    
             

The Linux-PAM library installed by default on your system allows the system administrator to choose how applications authenticate users, such as for console access, program and file access. In order to disable all these accesses for the users, you must comment out all lines that refer to pam_console.so in the /etc/pam.d/ directory. This step is a continuation of the above hack Disable console program access. The following script will do the trick automatically for you. As root creates the disabling.sh script file, touch disabling.sh and add the following lines inside:

               # !/bin/sh
               cd /etc/pam.d
               for i in * ; do
               sed '/[^#].*pam_console.so/s/^/#/' < $i > foo && mv foo $i
               done
               

Make this script executable with the following command and execute it:

               [root@deep] /# chmod  700  disabling.sh
               [root@deep] /# ./disabling.sh
               

This will comment out all lines that refer to pam_console.so for all files located under /etc/pam.d directory. Once the script has been executed, you can remove it from your system.

inetd, called also the super server, will load a network program based upon a request from the network. The inetd.conf file tells inetd which ports to listen to and what server to start for each port.

The first thing to look at as soon as you put your Linux system on ANY network is what services you need to offer. Services that you do not need to offer should be disabled and uninstalled so that you have one less thing to worry about, and attackers have one less place to look for a hole. Look at your /etc/inetd.conf file to see what services are being offered by your inetd program. Disable what you do not need by commenting them out by adding a # at the beginning of the line, and then sending your inetd process a SIGHUP command to update it to the current inetd.conf file.

By default Red Hat Linux allows all service requests. Using TCP_WRAPPERS makes securing your servers against outside intrusion is a lot simpler and painless then you would expect. Deny all hosts by putting ALL: ALL@ALL, PARANOID in the /etc/hosts.deny file and explicitly list trusted hosts who are allowed to your machine in the /etc/hosts.allow file. This is the safest and the best configuration. TCP_WRAPPERS is controlled from two files and the search stops at the first match.

Access will be granted when a daemon, client pair matches an entry in the /etc/hosts.allow file. Otherwise, access will be denied when a daemon, client pair matches an entry in the /etc/hosts.deny file. Otherwise, access will be granted.

             warning: /etc/hosts.allow, 
             line 6: can't verify hostname: gethostbyname(win.openna.com) failed.              
             
             

               telnet  stream  tcp     nowait  root    /usr/sbin/tcpd  in.telnetd -h
               

Linux uses a resolver library to obtain the IP address corresponding to a host name. The /etc/host.conf file specifies how names are resolved. The entries in the etc/host.conf file tell the resolver library what services to use, and in what order, to resolve names. Edit the host.conf file vi /etc/host.conf and add the following lines:

           # Lookup names via DNS first then fall back to /etc/hosts.
           order bind,hosts
           # We have machines with multiple IP addresses.
           multi on
           # Check for IP address spoofing.
           nospoof on
           

The order option indicates the order of services. The sample entry specifies that the resolver library should first consult the name server to resolve a name and then check the /etc/hosts file. It is recommended to set the resolver library to first check the name server, bind and then the hosts file (hosts) for better performance and security on all your servers. Of course you must have the DNS/BIND software installed or this configuration will not work.

The multi option determines whether a host in the /etc/hosts file can have multiple IP addresses i.e.multiple interface ethN. Hosts that have more than one IP address are said to be multiomed, because the presence of multiple IP addresses implies that host has several network interfaces. As an example, a Gateway Server will always have multiple IP address and must have this option set to ON.

The nospoof option indicates to take care of not permitting spoofing on this machine. IP-Spoofing is a security exploit that works by tricking computers in a trust relationship that you are someone that you really aren't. In this type of attack, a machine is set up to look like a legitimate server and then issue connections and other types of network activities to legitimate end systems, other servers or large data repository systems. This option must be set ON for all types of servers.

The port numbers on which certain standard services are offered are defined in the RFC 1700 Assigned Numbers. The /etc/services file enables server and client programs to convert service names to these numbers -ports. The list is kept on each host and it is stored in the file /etc/services. Only the "root" user is allowed to make modification in this file and it is rare to edit the /etc/services file to make change since it already contains the more common service names to port numbers. To improve security, we can immunize this file to prevent unauthorized deletion or addition of services. To immunize the /etc/services file, use the command:

           [root@deep] /#chattr  +i /etc/services
           

The /etc/securetty file allows you to specify which TTY devices the root user is allowed to login on. The /etc/securetty file is read by the login program usually /bin/login. Its format is a list of the tty devices names allowed, and for all others that are commented out or do not appear in this file, root login is disallowed. Disable any tty that you do not need by commenting them out # at the beginning of the line. Edit the securetty file vi, /etc/securetty and comment out the following lines:

             tty1
             #tty2
             #tty3
             #tty4
             #tty5
             #tty6
             #tty7
             #tty8
             

Which means only root is allowed to login on tty1. This is my recommendation, allowing root to log in only on one tty device and use the su command to switch to root if you need more. devices to log in as root.

It is important to DISABLE ALL default vendor accounts that you don't use on your system, some accounts exist by default even if you have not installed the related services on your server. This should be checked after each upgrade or new software installation. Linux provides these accounts for various system activities, which you may not need if the services are not installed on your server. If you do not need the accounts, remove them. The more accounts you have, the easier it is to access your system.

We assume you are using the Shadow password suite on your Linux system. If you are not, you should consider doing so, as it helps to tighten up security somewhat. This must already be set if you've followed our instructions till now and selected under the Authentication Configuration the option to Enable Shadow Passwords see Post Partitioning for more information. To delete user on your system, use the command:

               [root@deep] /# userdel username
               

To delete group on your system, use the command:

               [root@deep] /# groupdel username
               

The su Substitute User command allows you to become other existing users on the system. For example you can temporarily become root and execute commands as the super-user root. If you don't want anyone to su to root or restrict su command to certain users then add the following two lines to the top of your su configuration file in the /etc/pam.d/ directory. We highly recommend that you limit the person allowed to su to the root account.

The limits.conf file located under the /etc/security directory can be used to control and limit resources for the users on your system. It is important to set resource limits on all your users so they can't perform denial of service attacks number of processes, amount of memory, etc). These limits will have to be set up for the user when he or she logs in. For example, limits for all users on your system might look like this.

You can have more control on mounting a file system like /home and /tmp partitions with some nifty options like noexec, nodev, and nosuid. This can be setup in the /etc/fstab text file. The fstab file contains descriptive information about the various file systems mount options; each line addresses one file system. Details regarding to security options in the fstab text file are:

For more information on options that you can set in this file fstab, see the man pages about mount(8).

Edit the fstab file vi /etc/fstab and change it depending on your needs. For example:

             /dev/sda11	        /tmp		ext2	defaults        1 2
             /dev/sda6		/home		ext2	defaults        1 2
             

To read:

             /dev/sda11 	/tmp 		ext2 	defaults,rw,nosuid,nodev,noexec	1 2
             /dev/sda6 	        /home 		ext2 	defaults,rw,nosuid,nodev	1 2
             

Take a note that we have added the rw option to the modified lines above. This is because the default options for these lines are defaults, which means to set quota, read-write, and suid, so we must add the rw option to continue having read-write access on these modified file systems. For our example above, the /dev/sda11 represent our /tmp directory partition on the system, and /dev/sda6 the /home directory partition. Of course this will be not the same for you, depending on how you have partitioned your hard disk and what kind of disks are installed on your system, IDE -hda, hdb, etc or SCSI -sda, sdb, etc.

Once you have made the necessary adjustments to the /etc/fstab file, it is time to makethe Linux system aware about the modification. This can be accomplished with the following commands:

             [root@deep] /#mount -oremount /home/
             [root@deep] /#mount -oremount /tmp/
             

Each file system that has been modified must be remounted with the command show above. In our example we have modified the /home/, and /tmp/ file system and it is for this reason that we remount these file system with the above commands.

Once you have installed all the software that you need on yo42ur Linux server with the RPM command, it's a good idea for better security to move it to a safe place like a floppy disk or other safe place of your choice. With this method if some one accesses your server and has the intention to install software like trojan horses, password thieves etc. with RPM command, he shouldn't be able to do so. Of course, if in the future you want to install or upgrade new software via RPM, all you have to do is to replace the RPM binary to its original directory again. To move the RPM binary on the floppy disk, use the command:

             [root@deep] /# mount /dev/fd0 /mnt/floppy/
             [root@deep] /# mv /bin/rpm /mnt/floppy/
             [root@deep] /# umount /mnt/floppy
             

Never uninstall the RPM program completely from your system or you will be unable to reinstall it again later, since to install RPM or other software you need to have RPM commands available. Another thing you can do is change the default permission of the rpm command from 755 to 700. With this modification, non-root users can't use the rpm program to query, install etc; in case you forget to move it to a safe place after installation of new programs. To change the default permission of /bin/rpm, use the command:

             [root@deep] /# chmod 700  /bin/rpm
             

To make it easy for you to repeat long commands, the bash shell stores up to 500 old commands in the ~/.bash_history file where ~/ is your home directory. Each user that has an account on the system will have this file .bash_history in their home directory. Reducing the number of old commands the .bash_history files can hold may protect users on the server who enter by mistake their password on the screen in plain text and have their password stored for a long time in the .bash_history file.

The above hack will only work for future users you'll add in the server. If you already have existing users in the /etc/passwd file, you must edit and add the above line into their .bash_logout files manually.

LILO is the most commonly used boot loader for Linux. It manages the boot process and can boot Linux kernel images from floppy disks, hard disks or can even act as a boot manager for other operating systems. LILO is very important in the Linux system and for this reason, we must protect it the best we can. The most important configuration file of LILO is the lilo.conf file, which resides under the /etc directory. It is with this file that we can configure and improve the security of our LILO program and Linux system. Following are three important options that will improve the security of our valuable LILO program.

Commenting out the line with a # listed below in your /etc/inittab file will disable the possibility of using the Ctrl-Alt-Delete command to shutdown your computer. This is pretty important if you don't have the best physical security on the box. To do this, edit the inittab file vi /etc/inittab and change the line:

            ca::ctrlaltdel:/sbin/shutdown -t3 -r now
            

To read:

            #ca::ctrlaltdel:/sbin/shutdown -t3 -r now
            

Now, for the change to take effect type in the following at a prompt:

            [root@deep] /#/sbin/init q
            

One of the most important security considerations is the integrity of the different log files under the /var/log directory on your server. If despite each of the security functions put in place on our server a cracker can gain access to it, our last defense is the log file system, so it is very important to consider a method of being sure of the integrity of our log files.

If you have a printer installed on your server, or on a machine on your network, a good idea would be to have actual physical hard copies of all-important logs. This can be easily accomplished by using a continuous feed printer and having the syslog program sending all logs you seem important out to /dev/lp0 the printer device. Cracker can change the files, programs, etc on your server, but can do nothing when you have a printer that prints a real paper copy of all of your important logs.

            authpriv.*;mail.*;local7.*;auth.*;daemon.info /dev/lp0
            

            [root@deep] /# /etc/rc.d/init.d/syslog restart
            

            authpriv.*;mail.*;local7.*;auth.*;daemon.info /dev/lp0
            

            
            daemon syslogd -m 0
            
            

            daemon syslogd -r -m 0
            

            [root@mail /]# /etc/rc.d/init.d/syslog restart
            

Now, if we have a firewall on the remote server you are supposed to have one), we must add or verify the existence of the following lines:

            ipchains -A input  -i $EXTERNAL_INTERFACE -p udp \ 
            -s $SYSLOG_CLIENT \     
            -d $IPADDR 514 -j ACCEPT 
             

Now restart your firewall on the remote host for the change to take effect:

            [root@mail /]# /etc/rc.d/init.d/firewall restart
            

This firewall rule will allow incoming UDP packet on port 514 (syslog port) on the remote server that come from our internal client to be accepted. For more information on Firewall see Chapter 7 Networking firewall.

Finally, edit the syslog.conf file vi /etc/syslog.conf on the local server, and add at the end of this file the following line:

            authpriv.*;mail.*;local7.*;auth.*;daemon.info @mail
             

Where mail is the hostname of the remote server. Now if anyone ever hacks your box and menaces to erase vital system logs, you still have a hard copy of everything. It should then be fairly simple to trace where they came from and deal with it accordingly. Now restart your syslog daemon for the change to take effect:

            [root@deep] /# /etc/rc.d/init.d/syslog restart
            

Same as on the remote host, we must add or verify the existence of the following lines in our firewall script file on the local host:

            ipchains -A output -i $EXTERNAL_INTERFACE -p udp \ 
            -s $IPADDR 514 \   
            -d $SYSLOG_SERVER 514 -j ACCEPT  
            

Now restart your firewall for the change to take effect:

            [root@deep] /# /etc/rc.d/init.d/firewall restart
            

This firewall rule will allow outgoing UDP packet on port 514 syslog port on the local server destined to the remote syslog server to be accepted. For more information on Firewall see chapter 7 Networking firewall.

Fix the permissions of the script files that are responsible for starting and stopping all your normal processes that need to run at boot time.

            [root@deep] /# chmod -R 700  /etc/rc.d/init.d/*
            

Which means just root is allowed to Read, Write, and Execute scripts files on this directory. I don't think regular users need to know what is inside those script files.

A regular user will be able to run a program as root if it is set to SUID root. All programs and files on your computer with the s bits appearing on its mode, have the SUID -rwsr-xr-x or SGID -r-xr-sr-x bit enabled. Because these programs grant special privileges to the user who is executing them, it is important to remove the s bits from root-owned programs that won't absolutely require such privilege. This can be accomplished by executing the command chmod a-s with the name(s) of the SUID/SGID files as its arguments. Such programs include, but aren't limited to:

We've placed an asterisk * next to each program we personally might disable and consider to be not absolutely required for the working of our server. Remember that your system needs some suid root programs to work properly, so be careful. make your choices based on your requirements. To find all files with the s bits from root-owned programs, use the command:

            [root@deep]#find / -type f \( -perm -04000 -o -perm -02000 \) \-exec ls 'lg {} \;
             

            *-rwsr-xr-x	1 root     root	35168	Sep	22	23:35	/usr/bin/chage
            *-rwsr-xr-x	1 root     root	36756	Sep	22	23:35	/usr/bin/gpasswd
            *-r-xr-sr-x	1 root     tty	6788	Sep 	6	18:17	/usr/bin/wall
            -rwsr-xr-x	1 root     root	33152	Aug	16	16:35	/usr/bin/at
            -rwxr-sr-x	1 root     man	34656	Sep	13	20:26	/usr/bin/man
            -r-s--x--x	1 root     root	22312	Sep	25	11:52	/usr/bin/passwd
            -rws--x--x	2 root     root	518140 	Aug	30	23:12	/usr/bin/suidperl
            -rws--x--x	2 root     root	518140 	Aug	30	23:12	/usr/bin/sperl5.00503
            -rwxr-sr-x	1 root     slocate	24744	Sep	20	10:29	/usr/bin/slocate
            *-rws--x--x	1 root     root	14024	Sep 	9	01:01	/usr/bin/chfn
            *-rws--x--x	1 root     root	13768	Sep	9	01:01	/usr/bin/chsh
            *-rws--x--x	1 root     root	5576	Sep	9	01:01	/usr/bin/newgrp
            *-rwxr-sr-x	1 root     tty	8328	Sep	9	01:01	/usr/bin/write
            -rwsr-xr-x	1 root     root	21816	Sep	10	16:03	/usr/bin/crontab
            *-rwsr-xr-x	1 root     root	5896	Nov	23	21:59	/usr/sbin/usernetctl
            *-rwsr-xr-x	1 root     bin	16488	Jul	2	10:21	/usr/sbin/traceroute
            -rwxr-sr-x	1 root     utmp	6096	Sep	13	20:11	/usr/sbin/utempter
            -rwsr-xr-x	1 root     root	14124	Aug	17	22:31	/bin/su
            *-rwsr-xr-x	1 root     root	53620	Sep	13	20:26	/bin/mount
            *-rwsr-xr-x	1 root     root	26700	Sep	13	20:26	/bin/umount
            *-rwsr-xr-x	1 root     root	18228	Sep	10	16:04	/bin/ping
            *-rwxr-sr-x	1 root     root	3860	Nov	23	21:59	/sbin/netreport
            -r-sr-xr-x	1 root     root	26309	Oct	11	20:48	/sbin/pwdb_chkpwd
            

To disable the suid bits on selected programs above, type the following commands:

            [root@deep] /# chmod a-s /usr/bin/chage
            [root@deep] /# chmod a-s /usr/bin/gpasswd
            [root@deep] /# chmod a-s /usr/bin/wall
            [root@deep] /# chmod a-s /usr/bin/chfn
            [root@deep] /# chmod a-s /usr/bin/chsh
            [root@deep] /# chmod a-s /usr/bin/newgrp
            [root@deep] /# chmod a-s /usr/bin/write
            [root@deep] /# chmod a-s /usr/sbin/usernetctl
            [root@deep] /# chmod a-s /usr/sbin/traceroute
            [root@deep] /# chmod a-s /bin/mount
            [root@deep] /# chmod a-s /bin/umount
            [root@deep] /# chmod a-s /bin/ping
            [root@deep] /# chmod a-s /sbin/netreport

          
            [root@deep] /# man netreport
            

With the new version of Red Hat Linux 6.2 all kernel parameters available under the /proc/sys subdirectory of Linux can be configured at runtime. You can now use the new /etc/sysctl.conf file under Red Hat Linux 6.2 to modify and set kernel parameters at runtime. The sysctl.conf file is read and loaded each time the system reboots. All settings are now stored in the /etc/sysctl.conf file. All modifications to /proc/sys should be made through /etc/sysctl.conf, because they offer better for control, and are executed before rc.local or any other users scripts. We have shown you the networking security options that you must configure on your server for both Red Hat Linux version 6.1 and 6.2 below.

24.1. Prevent your system responding to Ping

Preventing your system for responding to ping request can be a big improvement in your network security since no one can ping on your server and receive an answer. The TCP/IP protocol suite has a number of loopholes that allows an attacker to leverage techniques in the form of covert channels to surreptitiously pass data in otherwise benign packets. Preventing your server from responding to ping requests can help to minimize this problem. An...

            [root@deep] /#echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
            

... should do the job such that your system won't respond to ping on any interface. You can add this line in your /etc/rc.d/rc.local file so the command will be automatically set if your system reboots. Not responding to pings would at least keep most "crackers" out because they would never even know it's there. To turn it backs on, simply do this:

            [root@deep] /#echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all
            

You can add this line in your /etc/rc.d/rc.local file so the command will be automatically set if your system reboots.

Edit the /etc/sysctl.conf file and add the following line:

            # Enable ignoring ping request
            net.ipv4.icmp_echo_ignore_all = 1
            

You must restart your network for the change to take effect. The command to restart the network is the following: To restart all network devices manually on your system, use the following command:

            [root@deep] /# /etc/rc.d/init.d/network restart
            


            Setting network parameters [  OK  ]
            Bringing up interface lo [  OK  ]
            Bringing up interface eth0         [  OK  ]
            Bringing up interface eth1         [  OK  ]
            

As for the ping request, it's also important to disable broadcast request. When a packet is sent to an IP broadcast address (i.e. 192.168.1.255) from a machine on the local network, that packet is delivered to all machines on that network. Then all the machines on a network respond to this ICMP echo request and the result can be severe network congestion or outages -denial-of-service attacks. See the RFC 2644 for more information.

              [root@deep] /# echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
              

You can add this line in your /etc/rc.d/rc.local file so the command will be automatically set if your system reboots.

Edit the /etc/sysctl.conf file and add the following line:

              # Enable ignoring broadcasts request
              net.ipv4.icmp_echo_ignore_broadcasts = 1
              

You must restart your network for the change to take effect. The command to restart the network is the following:

To restart all networks devices manually on your system, use the following command:

              [root@deep] /# /etc/rc.d/init.d/network restart
              

Routing and routing protocols can create several problems. The IP source routing, where an IP packet contains details of the path to its intended destination, is dangerous because according to RFC 1122 the destination host must respond along the same path. If an attacker was able to send a source routed packet into your network, then he would be able to intercept the replies and fool your host into thinking it is communicating with a trusted host. I strongly recommend that you disable IP source routing to protect your server from this hole.

To disable IP source routing on your server, type the following command in your terminal:

              [root@deep] /# for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do
              > echo 0 > $f
              > done
              

              [root@deep] /#
              

Add the above commands to the /etc/rc.d/rc.local script file and you'll not have to type it again the next time you reboot your system.

Edit the /etc/sysctl.conf file and add the following line:

              # Disables IP source routing
              net.ipv4.conf.all.accept_source_route = 0
              

You must restart your network for the change to take effect. The command to restart the network is the following:

              [root@deep] /# /etc/rc.d/init.d/network restart
              

Take Note that the above command for Red Hat Linux 6.1 or 6.2 will disable Source Routed Packets on all your interfaces lo, ethN, pppN etc.

A SYN Attack is a denial of service DoS attack that consumes all the resources on your machine, forcing you to reboot. Denial of service attacks -attacks which incapacitate a server due to high traffic volume or ones that tie-up system resources enough that the server cannot respond to a legitimate connection request from a remote system) are easily achievable from internal resources or external connections via extranets and Internet. To enable it, you have to do:

            [root@deep] /# echo 1 > /proc/sys/net/ipv4/tcp_syncookies
            

Add the above commands to the /etc/rc.d/rc.local script file and you'll not have to type it again the next time you reboot your system.

Edit the /etc/sysctl.conf file and add the following line:

            # Enable TCP SYN Cookie Protection
            net.ipv4.tcp_syncookies = 1
            

You must restart your network for the change to take effect. The command to restart the network is the following:

            [root@deep] /# /etc/rc.d/init.d/network restart
            Setting network parameters		[  OK  ]
            Bringing up interface lo		[  OK  ]
            Bringing up interface eth0	        [  OK  ]
            Bringing up interface eth1	        [  OK  ]
            

If you receive an error message during execution of the above command, check that you have enabled the TCP syncookies option in your kernel configuration: IP: TCP syncookie support not enabled per default CONFIG_SYN_COOKIES Y/n/?.

When hosts use a non-optimal or defunct route to a particular destination, an ICMP redirect packet is used by routers to inform the hosts what the correct route should be. If an attacker is able to forge ICMP redirect packets, he or she can alter the routing tables on the host and possibly subvert the security of the host by causing traffic to flow via a path you didn't intend. It's strongly recommended to disable ICMP Redirect Acceptance to protect your server from this hole.

              [root@deep] /# for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do
              > echo 0 > $f
              > done
              

              [root@deep] /#
              

Add the above commands to the /etc/rc.d/rc.local script file and you'll not have to type it again the next time you reboot your system.

Edit the /etc/sysctl.conf file and add the following line:

              # Disable ICMP Redirect Acceptance
              net.ipv4.conf.all.accept_redirects = 0
              

You must restart your network for the change to take effect. The command to restart manually the network is the following:

              [root@deep] /# /etc/rc.d/init.d/network restart
              Setting network parameters	[  OK  ]
              Bringing up interface lo		[  OK  ]
              Bringing up interface eth0	[  OK  ]
              Bringing up interface eth1	[  OK  ]
              

Take Note that the above command for Red Hat Linux 6.1 or 6.2 will disable Redirect Acceptance Packets on all your interfaces lo, ethN, pppN etc.

This protection must be enabled if you use your Linux server as a gateway to masquerade internal traffic to the Internet IP Masquerading.

            [root@deep] /#echo 1 > /proc/sys/net/ipv4/ip_always_defrag
            

Add the above commands to the /etc/rc.d/rc.local script file and you'll not have to type it again the next time you reboot your system.

Edit the /etc/sysctl.conf file and add the following line:

            # Enable always defragging Protection
            net.ipv4.ip_always_defrag = 1
            

You must restart your network for the change to take effect. The command to manually restart the network is the following:

            [root@deep] /# /etc/rc.d/init.d/network restart
            Setting network parameters	  [  OK  ]
            Bringing up interface lo	  [  OK  ]
            Bringing up interface eth0	  [  OK  ]
            Bringing up interface eth1	  [  OK  ]
            

This option will alert you to all bad error messages in your network.

              [root@deep] /#echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
              

Add the above commands to the /etc/rc.d/rc.local script file and you'll not have to type it again the next time you reboot your system.

Edit the /etc/sysctl.conf file and add the following line:

              # Enable bad error message Protection
              net.ipv4.icmp_ignore_bogus_error_responses = 1
              

You must restart your network for the change to take effect. The command to manually restart the network is the following:

              [root@deep] /# /etc/rc.d/init.d/network restart
              Setting network parameters 	[  OK  ]
              Bringing up interface lo		[  OK  ]
              Bringing up interface eth0	[  OK  ]
              Bringing up interface eth1	[  OK  ]
              

The spoofing protection prevents your network from being the source of spoofed i.e. forged communications that are often used in DoS attacks.

              [root@deep] /# for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
              > echo 1 > $f
              > done
              

              [root@deep] /#
              

Add the above commands to the /etc/rc.d/rc.local script file and you'll not have to type it again the next time you reboot your system.

Edit the /etc/sysctl.conf file and add the following line:

              # Enable IP spoofing protection, turn on Source Address Verification
              net.ipv4.conf.all.rp_filter = 1
              

You must restart your network for the change to take effect. The command to manually restart the network is the following:

              [root@deep] /# /etc/rc.d/init.d/network restart
              Setting network parameters	[  OK  ]
              Bringing up interface lo		[  OK  ]
              Bringing up interface eth0	[  OK  ]
              Bringing up interface eth1	[  OK  ]
              

This protection will log all Spoofed Packets, Source Routed Packets, and Redirect Packets to your log files.

            [root@deep] /# for f in /proc/sys/net/ipv4/conf/*/log_martians; do
            > echo 1 > $f
            > done
            

            [root@deep] /#
            

Add the above commands to the /etc/rc.d/rc.local script file and you'll not have to type it again the next time you reboot your system.

Edit the /etc/sysctl.conf file and add the following line:

            # Log Spoofed Packets, Source Routed Packets, Redirect Packets
            net.ipv4.conf.all.log_martians = 1
            

You must restart your network for the change to take effect. The command to manually restart the network is the following:

            [root@deep] /# /etc/rc.d/init.d/network restart
            Setting network parameters	     [  OK  ]
            Bringing up interface lo	     [  OK  ]
            Bringing up interface eth0	     [  OK  ]
            Bringing up interface eth1	     [  OK  ]
            

It is important to not forget to look everywhere on the system for unusual or hidden files -files that start with a period and are normally not shown by the ls command, as these can be used to hide tools and information password cracking programs, password files from other systems, etc.. A common technique on UNIX systems is to put a hidden directory or file in a user's account with an unusual name, something like '...' or '.. ' -dot dot space or ..+^G -dot dot ctrl-G. The find program can be used to look for hidden files.

            [root@deep] /# find / -name ".. " -print -xdev
            [root@deep] /# find / -name ".*" -print -xdev | cat -v
            

All SUID and SGID files that still exist on your system after we have removed those that won't absolutely require such privilege are a potential security risk, and should be monitored closely. Because these programs grant special privileges to the user who is executing them, it is necessary to ensure that insecure programs are not installed.

A favorite trick of crackers is to exploit SUID root programs, and leave a SUID program as a backdoor to get in the next time. Find all SUID and SGID programs on your system, and keep track of what they are so that you are aware of any changes, which could indicate a potential intruder. Use the following command to find all SUID/SGID programs on your system:

            [root@deep] /# find / -type f \( -perm -04000 -o -perm -02000 \) \-exec ls -lg {} \;
            

Group and world writable files and directories particularly system files partitions, can be a security hole if a cracker gains access to your system and modifies them. Additionally, world-writable directories are dangerous, since they allow a cracker to add or delete files as he or she wishes in these directories. In the normal course of operation, several files will be writable, including some from the /dev, /var/catman directories, and all symbolic links on your system. To locate all group & world-writable files on your system, use the command:

            [root@deep] /# find / -type f \( -perm -2 -o -perm -20 \) -exec ls -lg {} \;
            

To locate all group & world-writable directories on your system, use the command:

            [root@deep] /# find / -type d \( -perm -2 -o -perm -20 \) -exec ls -ldg {} \;
            

Don't permit any unowned file. Unowned files may also be an indication that an intruder has accessed your system. If you find unowned file or directory on your system, verify its integrity, and if all looks fine, give it an owner name. Some time you may uninstall a program and get an unowned file or directory related to this software; in this case you can remove the file or directory safely. To locate files on your system that do not have an owner, use the following command:

            [root@deep] /#find / -nouser -o -nogroup
            

Please Note Once again, files reported under /dev directory don't count.

Finding all the .rhosts files that could exist on your server should be a part of your regular system administration duties, as these files should not be permitted on your system. Remember that a cracker only needs one insecure account to potentially gain access to your entire network. You can locate all .rhosts files on your system with the following command:

            [root@deep] /#find /home -name .rhosts
            

You can also use a cron job to periodically check for, report the contents of, and delete $HOME/.rhosts files. Also, users should be made aware that you regularly perform this type of audit, as directed by policy.

To use a cron job to periodically check and report via mail all .rhosts files, do the following: Create as root the find_rhosts_files script file under /etc/cron.daily directory touch /etc/cron.daily/find_rhosts_files and add the following lines in this script file:

            #!/bin/sh
            /usr/bin/find /home -name .rhosts | (cat <<EOF
            This is an automated report of possible existent .rhosts files on the server
            deep.openna.com, generated by the find utility command.

            New detected .rhosts files under the /home directory include:
            EOF
            cat
            ) | /bin/mail -s "Content of .rhosts file audit report" root
            

Now make this script file executable, verify the owner, and change the group to root.

            [root@deep] /#chmod 755 /etc/cron.daily/find_rhosts_files
            [root@deep] /#chown 0.0 /etc/cron.daily/find_rhosts_files
            

Each day mail will be sent to root with a subject: Content of .rhosts file audit report containing potential new .rhosts files.

If you believe that your system has been compromised, contact CERT Coordination Center or your representative in FIRST -Forum of Incident Response and Security Teams.

CERT/CC personnel answer 8:00 a.m. to 8:00 p.m. EST (GMT 5)/EDT (GMT 4)) on working days; they are on call for emergencies during other hours and on weekends and holidays.

The /etc/profile file contains system wide environment stuff and startup programs. All customizations that you put in this file will apply for the entire environment variable on your system, so putting optimization flags in this file is a good choice. To squeeze the most performance from your x86 programs, you can use full optimization when compiling with the -O9 flag. Many programs contain -O2 in the Makefile. -O9 is the highest level of optimization. It will increase the size of what it produces, but it runs faster.

Please Note it is not always true that the -O9 flag will make the best performance for your processor. If you have an x686 and above processor, surely, but below x686, not necessarily.

When compiling, use the -fomit-frame-pointer switch for any kind of processor you may have. This will use the stack for accessing variables. Unfortunately, debugging is almost impossible with this option. You can also use the -mcpu=cpu_type and -march=cpu_type switch to optimize the program for the CPU listed to the best of GCC's ability. However, the resulting code will only be run able on the indicated CPU or higher.

The optimization options apply only when we compile and install a new program in our server. These optimizations don't play any role in our Linux base system; it just tells our compiler to optimize the new programs that we will install with the optimization flags we have specified in the /etc/profile file.

Below are the optimization flags that we recommend you put in your /etc/profile file depending on your CPU architecture.

Below is the explanation of the different optimization options we use: