1. Linux Security

2. What is a Secure System? Secure system is an abstract concept
Defined as “Robust”, it depends on what you need, how much time you are willing to put in, and what resources are at your disposal

3. P.C. vs. Server Close all services
Don’t open accounts to everyone. Only to good and trusted people
Close as much services as possible
Make sure users have good passwords - use crack-lib. Demand periodical password changes

4. P.C. vs. Server (cont.) Don’t install what you don’t know its origin
Download only from known places ( etc.)
Remove Suid’s if you are not the only user
Don’t install what you don’t know its origin
Download only from known places ( etc.)
Remove as more Suid’s as possible

5. Securing Passwords
Crack-lib them. Ensure passwords are not too short, and not too easy to crack
Shadow them. Don’t put them in /etc/passwd but in /etc/shadow (today’s default in RH 6.1 installation)
Connect to remote system using SSH and SCP (FTP over SSH channel) to prevent passwords from being sent as cleartext

6. S vs. R SSH require password or a RSA phrase (SSH agent)
SCP require password (no one will sent files without authorization)
Several Authentication method are available
RSH doesn’t require any password
RCP - no passwords needed
Work with Kreberos solely

7. S vs. R Use Compression Plain Connection
Don’t require password at all - no password is moved, if one of the encryption functions has been broken - no one get the password!

8. Authentication
Prevents IP spoofing (claiming to be other IP then you are)
Sometimes the algorithm allows also setting up a key for the rest of the session (Kreberos for example)
Slow a little bit the connection (in the beginning)
Known (and used) algorithms - Kreberos, RSA Challenges.

9. Dangerous Permissions
Suid/Sgid - Check very carefully. Especially when the file is owned by root/wheel
Write to all (xx2)
Nouser/Nogroup
.rhosts file (open R-services)
Use “find” to find the files

10. Example - How to remove Suid’s?
First find them - find -perm 4000 /
Then check if you need them - login, wanted deamons (Qmail, telnet, SSH, FTP)
Close services not needed in the /etc/inetd.conf
Use TCP Wrappers to the rest of the ports (Those you usually get nuked - 139)

11. Monitor your Computer!
Be the hacker yourself. Check for scripts and exploits which might be used against you
Port scan your machine once in a while - ensure no ports and services are open (unless you opened them)
Put Firewall. Hiding behind a firewall might help in reducing hackability (though those who pass it, are likely to hack better)

12. Security HOWTO Restrict physical approach (locks etc.)
Consider BIOS and LILO passwords
Lock workstation when you’re not near (vlock/xlock)
Try to reduce root access to one of tty declared in /etc/securetty
Try to use “su -” instead of login as root

13. Security HOWTO - Files
When you need to allow root-like access minimize it using sudo
Don’t allow Suid/Sgid where non-root users write to hard drive (mount as nosuid)
Umask the right access permissions
Limit resources in the machine (Nproc, CPUtime, etc.)
Set /var/log/wtmp /var/run/utmp permissions to 644

14. Security HOWTO (cont.)
Use chattr to set special permission (disable deleting, creating symbolic links etc.)
Run Integrity Checker (like Tripwire) routinely (find changed files)
Install PGP for users
Install PAM (Plugable Authentication Module)
Secure X connections (ssh for example)

15. Security HOWTO (cont.) Backup!
Don’t use NFS/NIS without really needing it (and secure it when you does, those things are really not secure)
Look at your logs once in awhile (/vat/log/)
Look at the system log file

16. Auditing Audit your system
Check Network once in awhile (Denial of Service attacks can be identified using this)
Check who log on and from where. Check if it make sense

17. Virtual Machine Concept
Use the VM (like VMWare) to be the machine which the rest of the world access
Make sure the VM has privileges to change only where it should (no access to write to root partition, etc.)
Check the VM is secure (!) your counting on that the VM can’t access what it’s not allowed

18. Basic Concepts Check permissions before actions
Check overflow/underflow. Be as Robust as you can
If you are writing a deamon double check everything (and quad check it again).

19. Basic Concepts (cont.)
Use available security tools - PGP (mail), SSH (telnet connections), SCP (ftp connections), Kreberos (Authenticate), IPSec (Network), etc.
Enable Verbose mode - help users find problems which might affect them and their security

20. Basic Concepts (cont.)
Check if you can hack the thing (be a malicious user)
Treat carefully any file, before overwrite backup. Before delete check if the file is a system one.
Log all actions (in case someone use your program to hack and cause damage, for tracing purpose)