Table of Contents
None
Overview of local and network security issues
Understand the secure shell
Configure a NTP server
If anyone has access to a rescue disks or a linux disk that boots from a floppy or a CDROM it is extremely easy to gain read access to any files on the system. To prevent this the BIOS should be set to boot only off the hard drive. Once this is done set a password on the BIOS.
LILO can be given options at boot time. In particular some Linux distributions will not ask for a password when starting the system in single user mode or runlevel 1.
There are two options that should be added to the
/etc/lilo.conf:
the restricted option prompts the user for
a password
the password="" option, set
the password string.
Restricted means that LILO cannot be given any parameters without the
password specified in lilo.conf.
boot=/dev/hda install=/boot/boot.b prompt timeout=50 password="password" restricted
To prevent attackers causing too much damage it is recommended to take the following steps.
Make vital system tools immutable, or logfiles append-only
chattr +i /bin/login chattr +i /bin/ps chattr +a /var/log/messages
Make directories /tmp/ and
/home/
nosuid
or noexec, as in the following
/etc/fstab:
/tmp /tmp ext2 nosuid 1 2 /home /home ext2 noexec 1 2
Find all files on the system that don't belong to a user or a group:
find / -nouser o nogroup find / -perm +4000
The main logs are
/var/log/messages, which contains
information logged by the syslogd daemon
/var/log/secure which contains
information on failed logins, added users, etc.
The last tool lists all successful
logins and reboots. The information is read from the
/var/log/wtmp file.
The who and w tools
list all users currently logged onto the system using the
/var/run/utmp file.
When the /etc/nologin file is present
(can be
empty) it will prevent all users from login in to the system (except user
root). If the nologin file
contains a message this will be displayed after a successful
authentication.
In the /etc/security/ directory are a collection
of files that allow administrators to limit user CPU time, maximum file size,
maximum number of connections, etc
/etc/security/access.conf disallows logins for
groups and users from specific locations.
/etc/security/limits.conf. The format of this
file is
domain type item value
a user name, a group name (with @group)
hard or soft
corelimits the core file size (KB)
datamax data size (KB)
fsizemaximum filesize (KB)
memlockmax locked-in-memory address space (KB)
nofilemax number of open files
cpumax CPU time (MIN)
procmax number of processes
asaddress space limit
maxloginsmax number of simultaneous logins for this user
prioritythe priority to run user process with
locksmax number of file locks the user can hold