Linux Security

Patrick J Cush, PhD

Senior Architect

Novell, Inc.

Base Security for the Linux System

Partitioning

Loading Services

User/Group Access

Program/Service Access

Loading the Linux System

Partitioning Disk

Base Partition Scheme provided not adequate

Partition disk to stop DOS attacks on system

Partition each functional area based on usage of system

For example:

Linux Swap

/dev/hda1

Root File System

/root[/dev/hda2]

Shared Binaries

/usr[/dev/hda3]

Userpartition

/home[/dev/hda4]

Loading Services for the System

What Services to Load?

What is the system use going to be?

More Services equal higher administrative cost

More Services equal higher possibility of attack

Remember Services are a privilege not a right. Only load what you will use on the system.

Setting Up User and Group Security

Set User Accounts

Delete unneeded default accounts

Set user name, password and access

Set Password Aging (change /etc/login.def)

PASS_MAX_DAYS & PASS_MIN_DAYS

For system accounts lock them by assigning an invalid shell

Set Group Accounts

Set up Groups to contain User Accounts

Only give group enough rights as needed

Designing Program and Services Access

Use Groups for access to Services and Programs

This allows for better administration of Server

No single account should need to be without a group

Follows good design by establishing roles based on rules

Easier to fit into an identity management architecture

Additional Security Steps

Modify of initial files which were loaded

Disable CTS-ALT-Delete

Disallow Remote Root Login

Create Security Banners

Apply Updates and Patches

System Logging

1

2

3

4

5

6

Web Security

Web Security steps

Review Modules

Harden Main Configuration Files

Check Permissions of Files

Encrypt Sensitive Traffic with HTTPS

E-Mail Security

E-Mail Security

Disable Sendmail Daemon on Workstations

Define SMTP Server for Mail Clients

Define Hosts Allowed to Relay Mail

Set Domain Name Masquerading

Configure Sendmail to Use RBL Support

Install an Alternative MTA

Secure POP and IMAP daemons

Tripwire

Open Source Integrity Checker

Tripwire works by creating a hash for all files that you have chosen to monitor on your system. These hashes are then stored in a database. Once the database is created you can schedule tripwire to run on a regular basis to compare the hashes of the files you are monitoring to the hashes stored in the database.

If your system is compromised and/or files replaced or changed Tripwire will know if the files are in the snapshot of changes in size, inode number, permissions, or other attributes. Even a single character change by verifying its checksum.

Tripwire Setup

Install Tripwire then do:

cd /etc/tripwire

./twinstall.sh

tripwire --init

rm twcfg.txt twpol.txt

The script twinstall.sh performs the following:

Creates site key and local key, you enter the passphrases.

signs the default configuration file (twcfg.txt) with the site key creating tw.cfg

Signs the default policy file twpol.txt with the site key creating tw.pol

tripwire –init (builds the database)

rm twcfg.txt twpol.txt (This step deletes the unencrypted policy and configuration files.)

Displaying the binary Policy and Configuration Files for Tripwire

Now you wish to view Tripwire's Policy and Configuration files which are encrypted:

Generate the active Configuration File:

cd /etc/tripwire

twadmin –print-cfgfile > twcfg.txt

Generate the Active Policy File:

cd /etc/tripwire

twadmin –print-polfile > twpol.txt

Modifying Tripwire's policy and Configuration

So you want to change the set of files and directories Tripwire examines:

Modify the policy file, twpol.txt, and/or the configuration file, twcfg.txt, with any text editor.

Extract the Policy and Configuration

1

2

reinitialize the database:

tripwire –init

rm twcfg.txt twpol.txt

4

3

Re-sign the modified files:

twadmin --create-cfgfile –cfgfile /etc/tripwire/tw.cfg \

--site-keyfile site_key etc/tripewire/twcfg.txt

twadmin --create-cfgfile –cfgfile /etc/tripwire/tw.cfg \

--site-keyfile site_key etc/tripewire/twpol.txt

Tripwire Integrity Checking

Run:

tripwire –check

This compares the filesystem against the database according to the rules of the active policy. The results are written to standard output and also stored as a timestamped signed Tripwire Report.

Nessus

A Freeware Vulnerability Assessment Tool

Works on a client/server based technology

Server side contains the vulnerability database and the engine that actually performs the vulnerability assessment

The Client connects to the server to configure the settings for the vulnerability assessment

Nessus can provide reports in a number of different formats including its native GUI format, HTML and ASCII

2

1

3

Installing and Running Nessus

Download the latest Distribution of Nessus

Start the nessus server by running

./nessusd located in bin directory

Four components must be installed in the order:

nessus-libraries

libnasl

nessus-core

nessus-plugins

unarchive the source code with tar zxvf

cd to source directory

./configure

compile using make

install make with install

4

6

7

8

Installing and Running Nessus (cont.d)

Use nessus-adduser to add a new user to the system

Go to an X-term window type nessus and enter the password for the user you created in step 4

Use the Plugin Tab for the exploits you wish to check.

Next click the Target selection tab and enter the comma-delimited hosts to check.

Click Start

5

Nessus

A Freeware Vulnerability Assessment Tool

Works on a client/server based technology

Server side contains the vulnerability database and the engine that actually performs the vulnerability assessment

The Client connects to the server to configure the settings for the vulnerability assessment

Nessus can provide reports in a number of different formats including its native GUI format, HTML and ASCII

2003-12-08T12:43:39