|
|
SLAC Computer Security | ||
| SLAC Home | Computing Home | Computing Outages | Help | |||
Cyber Security Awareness Month
These tips are part of a month long effort to distribute useful computer security information to the SLAC community.
- Day 19 - Linux Tips
The Internet Storm Center staff and community provided lots of info for today's article:
If your system isn't centrally managed set up regular updates for your particular Linux distribution:
- Debian: http://www.debian.org/doc/manuals/debian-faq/ch-uptodate.en.html
- Fedora: http://docs.fedoraproject.org/yum/en/sn-updating-your-system.html
- SuSE: http://itg.chem.indiana.edu/inc/wiki/os/linex/148.html- Lock your system when you step away from it.
All require the password of the logged-in user to continue work.
- To lock the Gnome graphical desktop, run the following command, part of the "gnome-screensaver" package: gnome-screensaver-command --lock
- From a text console, run this, part of the vlock package: vlock -a
- For KDE, right click on the desktop and select "Lock Session".
- In Ubuntu, press Ctrl-Alt-l (the letter "Ell", configurable in System/Preferences/Keyboard shortcuts).
- Do your day-to-day work with a non-root account. When you need to do root-level tasks, become root with "sudo" or "su" long enough to do the task (alternately, log in as root on a text console for this task).
http://www.stearns.org/doc/sudo.current.html- Kevin Fenzi and David Wreski wrote the Linux Security HOWTO: http://tldp.org/HOWTO/Security-HOWTO/. It's a good coverage of security issues, and good background on many of the hints we cover here. The document hasn't been updated since 2004; even though some of the solutions may be a little outdated, the issues have largely not changed.
- Run Bastille Unix to clean up some vulnerable configuration choices in your Linux distribution. It's a great learning tool; it explains _why_ it wants to make a configuration change, and lets you decide which ones to make. http://www.bastille-unix.org/
- From the web site: "The Bastille Hardening program "locks down" an operating system, proactively configuring the system for increased security and decreasing its susceptibility to compromise. Bastille can also assess a system's current state of hardening, granularly reporting on each of the security settings with which it works. Bastille currently supports the Red Hat (Fedora Core, Enterprise, and Numbered/Classic), SUSE, Debian, Gentoo, and Mandrake distributions, along with HP-UX. Full Mac OS X is ready for download today."
Some of these start to get slightly more advanced, but I'll include them so you know where to look for more information.
- Set up a firewall, IDS, tripwire/AIDE right after install (store database off-system, update database after patching system)
- Shorewall: http://www.shorewall.net
- Firestarter: http://www.fs-security.com
- Snort IDS: http://www.snort.org
- Tripwire: http://sourceforge.net/projects/tripwire/
- AIDE: http://www.cs.tut.fi/~rammer/aide.html
- Turn on Selinux if included in your distribution to limit applications to just the system calls they're supposed to make.
http://www.nsa.gov/selinux/- Use Clamav and Spamassassin to filter viruses and spam from incoming mail.
- Use fail2ban to block ssh and Apache dictionary attacks.
- Run a rootkit detector (chkrootkit, others) before connecting to a network, and regularly.
- Turn off - or completely remove - unneeded services. Identify with "netstat -pant". Disable with chkconfig. Check that the services are actually closed by running nmap (included in most Linux distributions) on a second system, scanning the first.
http://www.linuxjournal.com/article/4445
To check for open ports, run:
nmap -n -sV -p 1-65535 ip.of.system.to.check
nmap -n -sU -sV -p 1-65535 ip.of.system.to.check
The second command will take a _long_ time to run - good for letting run over a weekend.- Set up regular backups. Using a raid array will drastically reduce your exposure if a hard drive dies, but will do nothing for intentionally deleted files.
- Remove, or restrict access to, compilers and other development tools on the system. This won't stop a determined human attacker, but can stop an automated tool or worm.
- Always use encrypted connections between machines (ssh, https, scp, rsync over ssh, sftp, imaps, pop3s, stunnel, cryptcat). Move to ssh keys when you can. Disable direct root login: /etc/ssh/sshd_config, "PermitRootLogin no". Disable ssh1 ("Protocol 2" in that same file). Running ssh on a port other than 22 will stop SSH dictionary scanners.
- Install new software from your OS vendor, or additional repositories available for your distribution if they have the features you need. If you need a custom feature that you can only get from custom compiling, do so, but remove the vendor package, and keep track of these as you need to update them manually. Only download software from trusted sources, and check the signatures on packages from your vendor.
- Physical security; lock system to something that can't be removed from the room. Lock the case. Password protect BIOS and boot loader so people can't boot into single-user mode.
- Encrypt any partitions that have sensitive data. dm-crypt, LUKS, and fuse-encfs can all encrypt individual files or entire partitions.
- Linuxquestions.com has a good collection of past questions and answers and is a great place to ask new questions.
http://www.linuxquestions.org/questions/linux-security-4/, in particular, deals with security questions.
Owner: SLAC Computer Security |