Linux quick reference
0 likes1,704 views
This document provides a quick reference guide for improving Linux system security. It includes a glossary of common security terms like buffer overflow, cryptography, and denial of service. It also offers general security tips, such as using package managers to update software and installing nmap to scan systems. Finally, it lists resources for further security information, like the Apache directory protection guide and the Introduction to Linux Security book.
Linux quick reference
- 1. http://www.LinuxSecurity.com info@LinuxSecurity.com Linux Security Quick Reference Guide Security Glossary: General Security Tips: Linux Security Resources: • Buffer Overflow: A condition that occurs when a user or process attempts to place • AutoRPM on Red Hat and apt-get on Debian can be used to download and install • Apache directory and password protection more data into a program’s storage buffer in memory and then overwrites the actual any packages on your system for which there are updates. Use care when http://www.apacheweek.com/features/userauth program data with instructions that typically provide a shell owned by root on the automatically updating production servers. • IP Masquerading enables a Linux box with multiple interfaces to act as a gateway to • Bastille Linux Project server. Accounted for more than 50 percent of all major security bugs leading to security advisories published by CERT. Typically associated with set-user-ID root http://www.bastille-linux.org binaries. remote networks for hosts connected to the Linux box on the internal network interface. See the IP Masquerading HOWTO for implementation information. • Cryptography: The mathematical science that deals with transforming data to render • BugTraq Full Disclosure Mailing List its meaning unintelligible, prevent its undetected alteration, or prevent its unauthorized • Install nmap to determine potential communication channels. Can determine remote http://www.securityfocus.com/forums/bugtraq/intro.html use. OS version, perform “stealth” scans by manipulating ICMP, TCP and UDP, and even potentially determine the remote username running the service. Start with something • Building Internet Firewalls, Second Edition • Denial of Service: Occurs when a resource is targeted by an intruder to prevent simple like: Introduction: legitimate users from using that resource. They are a threat to the availability of data O’Reilly & Assoc, ISBN 1565928717 # nmap 192.168.1.1 The intent of this Quick Reference Guide is to provide a starting point for improving the security of your to all others trying to use that resource. Range from unplugging the network connection • CERT Security Improvement Modules system, to serve as a pointer to more in-depth security information, and to increase security awareness to consuming all the available network bandwidth. • Password-protect LILO for servers in public environments to require authorization http://www.cert.org/security-improvement and methods that can be used to improve security. It is not a substitute for reading any of the vast • IP Spoofing: An attack in which one host masquerades as another. This can be when passing LILO command-line kernel parameters at boot time. Add the password amounts of Linux security documentation that already exists. used to route data destined for one host to antoher, thereby allowing attackers to and restricted arguments to /etc/lilo.conf, then be sure to re-run • Introduction to Linux Security intercept data not originally intended for them. It is typically a one-way attack. /sbin/lilo: http://www.linux-mag.com/1999-10/security_01.html In the ever-changing world of global data communications, inexpensive Internet connections, and fast- paced software development, security is becoming more and more of an issue. Security is now a basic • Port Scanning: The process of determining which ports are active on a machine. By image = /boot/vmlinuz-2.2.17 requirement because global computing is inherently insecure. As your data goes from point A to point B probing as many hosts as possible, means to exploit the ones that respond can be label = Linux • Linux Intrusion Detection Resources read-only on the Internet, it may pass through several other points along the way, giving other users the opportu- developed. It is typically the precursor to an attack. restricted http://www.linuxsecurity.com/intrusion-detection nity to intercept, and even alter, your data. Even other users on your system may maliciously transform password = your-password your data into something you did not intend. Unauthorized access to your system may be obtained by • Packet Filtering: A method of filtering network traffic as it passes between the firewall’s interfaces at the network level. The network data is then analyzed according • The OpenWall kernel patch is a useful set of kernel security improvements that • John the Ripper Password Cracker intruders, also known as “crackers”, who then use advanced knowledge to impersonate you, steal infor- http://www.openwall.com/john to the information available in the data packet, and access is granted or denied based helps to prevent buffer overflows, restrict information in /proc available to normal mation from you, or even deny you access to your own resources. on the firewall security policy. Usually requires an intimate knowledge of how network users, and other changes. Requires compiling the kernel, and not for newbies. Security involves defense in depth. Approaching security a step at a time, with consistency and vigi- protocols work. • Linux and Open Source Security Advisories lance, you can mitigate the security threats, and keep the crackers at bay. Keep your system up to date • Proxy Gateway: Also called Application Gateways, act on behalf of another • Ensure system clocks are accurate. The time stamps on log files must be accurate http://www.linuxsecurity.com/advisories by making sure you have installed the current versions of software and are aware of all security alerts. so security events can be correlated with remote systems. Inaccurate records make it program. A host with a proxy server installed becomes both a server and a client, and impossible to build a timeline. For workstations, it is enough to add a crontab entry: Doing this alone will help make your system markedly more secure. • LinuxSecurity.com Security Reference Info acts as a choke between the final destination and the client. Proxy servers are typically 0-59/30 * * * * root /usr/sbin/ntpdate -su time.timehost.com http://www.linuxsecurity.com/docs The more secure your system is the more intrusive your security becomes. You need to decide where in small, carefully-written single-purpose programs that only permit specific services to this balancing act your system will still be usable yet secure for your purposes. pass through it. Typically combined with packet filters. • Install and execute the Bastille Linux hardening tool. Bastille is a suite of shell • LinuxSecurity.com Security Discussion Lists If you have more than one person logging on to your machine, or machines, you should establish a • Set User-ID (setuid) / Set Group-ID (setgid): Files that everyone can execute as scripts that eliminates many of the vulnerabilities that are common on default Linux http://www.linuxsecurity.com/mailing-lists.html “Security Policy” stating how much security is required by your site and what auditing is in place to either it's owner or group privileges. Typically, you'll find root-owned setuid files, which installations. It enables users to make educated choices to improve security by asking monitor it. means that regardless of who executes them, they obtain root permission for the questions as it interactively steps through securing the host. Features include basic • LinuxSecurity.com Tip of the Day period of time the program is running (or until that program intentionally relinquishes packet filtering, deactivating unnecessary network services, auditing file permissions, http://www.linuxsecurity.com/tips these privileges). These are the types of files that are most often attacked by intruders, and more. Try the non-intrusive test mode first. Controlling File Permissions & Attributes: because of the potential for obtaining root privileges. Commonly associated with buffer overflows. • Configure sudo (superuser do) to execute privileged commands as a normal user • LinuxSecurity.com Weekly Security Newsletter Monitoring the permissions on system files is crucial to maintain host integrity. http://www.linuxsecurity.com/newsletter.html instead of using su. The administrator supplies his own password to execute specific • Trojan Horse: A program that masquerades itself as a benign program, when in fact commands that would otherwise require root access. The file /etc/sudoers file • Regularly audit your systems for any unauthorized and unnecessary use of the setuid or setgid it is not. A program can be modified by a malicious programmer that purports to do permissions. “Set-user-ID root” programs run as the root user, regardless of who is executing them, controls which users may execute which programs. To permit Dave to only manipulate • OpenSSH secure remote access tool something useful, but in fact contains a malicious program containing hidden functions, the printer on magneto: http://www.openssh.com and are a frequent cause of buffer overflows. Many programs are setuid and setgid to enable a exploiting the privileges of the user executing it. A modified version of /bin/ps, for normal user to perform operations that would otherwise require root, and can be removed if your Cmnd_Alias LPCMDS = /usr/sbin/lpc, /usr/bin/lprm example, may be used to hide the presence of other programs running on the system. • OpenWall Security Project users do not need such permission. Find all setuid and setgid programs on your host and dave magneto = LPCMDS descriminately remove the setuid or setgid permissions on a suspicious program with chmod: • Vulnerability: A condition that has the potential for allowing security to be http://www.openwall.com compromised. Many different types of network and local vulnerabilities exist and are Dave executes sudo with the authorized command and enters his own password root# find / -type f -perm +6000 -ls widely known, and frequently occur on computers regardless of their level of network when prompted: • Network Time Protocol information 59520 30 -rwsr-xr-x 1 root root 30560 Apr 15 1999 /usr/bin/chage connectivity, processing speed, or profile. dave$ sudo /usr/sbin/lpc http://www.ntp.org 59560 16 -r-sr-sr-x 1 root lp 15816 Jan 6 2000 /usr/bin/lpq Password: <password> root# chmod -s /usr/bin/chage /usr/bin/lpq Kernel Security: lpc> • nmap Port Scanner root# ls -l /usr/bin/lpq /usr/bin/chage http://www.insecure.org/nmap -rwxr-xr-x 1 root root 30560 Apr 15 1999 /usr/bin/chage Several kernel configuration options are available to improve security through the • Password security is the most basic means of authentication, yet the most critical -r-xr-xr-x 1 root lp 15816 Jan 6 2000 /usr/bin/lpq /proc pseudo-filesystem. Quite a few of the files in /proc/sys are directly related to means to protect your system from compromise. It is also one of the most overlooked security. Enabled if contains a 1 and disabled if it contains a 0. Many of the options means. Without an effective well-chosen password, your system is sure to be • Practical UNIX & Internet Security, Second Ed. • World-writable files are easily altered or removed. Locate all world-writable files on your system: available in /proc/sys/net/ipv4 include: compromised. Obtaining access to any user account on the system is the tough part. O’Reilly & Assoc, ISBN 1565921488 root# find / -perm -2 ! -type l -ls From there, root access is only a step away. Run password-cracking programs such as • icmp_echo_ignore_all: Ignore all ICMP ECHO requests. Enabling this option will John the Ripper or Crack regularly on systems for which you’re responsible to ensure • rsync Incremental File Transfer Utility In the normal course of operation, several files will be world-writable, including some from /dev and prevent this host from responding to ping requests. password security is maintained. Disable unused accounts using /usr/bin/passwd http://rsync.samba.org the /tmp directory itself. • icmp_echo_ignore_broadcasts: Ignore ICMP echo requests with a broadcast/ -l. Use the MD5 password during install if your distribution supports it. • Secure Shell FAQ • Locate and identify all files that do not have an owner or belong to a group. Unowned files may also multicast destination address. Your network may be used as an exploder for denial of • Packet filtering isn’t just for firewalls. Using ipchains, you can provide a significant http://www.employees.org/~satch/ssh/faq/ service packet flooding attacks to other hosts. amount of protection from external threats on any Linux box. Blocking access to a be an indication an intruder has accessed your system. particular service from connecting outside of your local network you might try: • ip_forward: Enable or disable the forwarding of IP packets between interfaces. • Security-related HOWTOs and FAQs root# find / -nouser -o -nogroup # ipchains -I input -p TCP -s 192.168.1.11 telnet -j DENY -l Default value is dependent on whether the kernel is configured as host or router. http://www.linuxsecurity.com/docs • Using the lsattr and chattr commands, administrators can modify characteristics of files and This will prevent incoming access to the telnet port on your local machine if the • ip_masq_debug: Enable or disable debugging of IP masquerading. directories, including the ability to control deletion and modification above what normal chmod connection originates from 192.168.1.11. This is a very simple example. Be sure • Site Security Handbook (RFC2196) provides. The use of “append-only” and “immutable” attributes can be particularly effective in • tcp_syncookies: Protection from the “SYN Attack”. Send syncookies when the SYN to read the IP Chains HOWTO before implementing any firewalling. http://www.linuxsecurity.com/docs/rfcs/rfc2196.txt preventing log files from being deleted, or Trojan Horses from being placed on top of trusted backlog queue of a socket overflows. binaries. While not a guarantee a system file or log won’t be modified, only root has the ability to Network Intrusion Detection: • sudo root access control tool remove this protection. The chattr command is used to add or remove these properties, while the • rp_filter: Determines if source address verification is enabled. Enable this option on http://www.courtesan.com/sudo lsattr can be used to list them. all routers to prevent IP spoofing attacks against the internal network. Intrusion detection devices are an integral part of any network. The Internet is constantly evolving, and new vulnerabilities and exploits are found regularly. They Log files can be protected by only permitting appending to them. Once the data has been written, it • secure_redirects: Accept ICMP redirect messages only for gateways listed in default provide an additional level of protection to detect the presence of an intruder, and help • Snort Network Intrusion Detection System cannot be removed. While this will require modifications to your log rotation scripts, this can provide gateway list. to provide accoutability for the attacker's actions. http://www.snort.org additional protection from a cracker attempting to remove his tracks. Once rotated, they should be • log_martians: Log packets with impossible addresses to kernel log. The snort network intrusion detection tool performs real-time traffic analysis, changed to immutable. Files suitable for these modifications include /bin/login, /bin/rpm, • Tripwire file integrity tool watching for anamolous events that may be considered a potential intrusion attempt. /etc/shadow, and others that should not change frequently. • accept_source_route: Determines whether source routed packets are accepted or http://www.tripwiresecurity.com Based on the contents of the network traffic, at either the IP or application level, an # chattr +i /bin/login declined. Should be disabled unless specific reason requires it. alert is generated. It is easily configured, utilizes familiar methods for rule # chattr +a /var/log/messages development, and takes only a few minutes to install. Snort currently includes the • Using Snort # lsattr /bin/login /var/log/messages The file /etc/sysctl.conf on recent Red Hat contains a few default settings and is ----i--- /bin/login processed at system startup. The /sbin/sysctl program can be used to control these ability to detect more than 1100 potential vulnerabilities. It is quite feature-packed out http://www.linuxsecurity.com/using-snort.html -----a-- /var/log/messages parameters. It is also possible to configure their values using /bin/echo. For example, of the box: to disable IP forwarding, as root run: • Detect and alert based on pattern matching for threats including buffer overflows, Implementation By Dave Wreski • There should never be a reason for user’s to be able to run setuid programs from their home stealth port scans, CGI attacks, SMB probes and NetBIOS queries, NMAP and Concept By Benjamin Thomas directories. Use the nosuid option in /etc/fstab for partitions that are writable by others than echo “0” > /proc/sys/net/ipv4/ip_forward other portscanners, well-known backdoors and system vulnerabilities, DDoS Permission to distribute granted root. You may also wish to use the nodev and noexec on user’s home partitions, as well as /var, This must written to a system startup file or /etc/sysctl.conf on Red Hat to occur clients, and many more; which prohibits execution of programs, and creation of character or block devices, which should © 2000 Guardian Digital, Inc. never be necessary anyway. See the mount man page for more information. after each reboot. More information is available in proc.txt file in the kernel • Can be used on an existing workstation to monitor a home DSL connection, or on Documentation/ directory. a dedicated server to monitor a corporate web site. http://www.GuardianDigital.com v1.1
- 2. Disable Unnecessary Services: Apache Security: Using RPM and dpkg: DNS Security: Disabling or removing unused programs and services from your host is the most • Limit Apache to listen only on local interface by configuring The /bin/rpm program on Red Hat and derivitives and the /usr/bin/dpkg on • Zone transfers should only be permitted by master name servers to update the zone effective way to limit threats originating from a remote host. Use your distributions /etc/httpd/conf/httpd.conf to read: Debian and derivitives are used to control the management of packages. (domain) information in their slave servers. Failure to do so may result in IP numbers and package management tools to scan the list of installed packages, then remove hostnames being revealed to unauthorized users. Restrict queries to only public domains. those that are unnecessary. Listen 127.0.0.1:80 • Remove a package Suitable for name servers with both public and private zones. # rpm -e <package-name> • Many of the services running from inetd are legacy programs, which are hardly • Use the following to disable access to the entire filesystem by default, unless # dpkg -r <package-name> // Allow transfer only to our slave name server. Allow queries explicitly permitted. This will disable printing of indexes if no index.html // only by hosts in the 192.168.1.0 network. ever required, yet typically enabled by default. The file /etc/inetd.conf is used to specify which services are offered. Disable all services that you do not exists, server-side includes, and following symbolic links. Disabling symlinks • List contents of entire package zone “mydomain.com” { # rpm -qvl <package-name.rpm> type master; want to provide by commenting them out using the # character in the first column may impact performance for large sites. file “master/db.mydomain.com”; of the line. # dpkg -c <package-name.deb> allow-transfer { 192.168.1.6; }; <Directory /> allow-query { 192.168.1.0/24; }; • List all installed packages with info about each }; • The /etc/rc*.d or /etc/rc.d/rc* directories contains shell scripts that Options None AllowOverride None # rpm -qvia control the execution of network and system services during runlevels. Rename or Order deny,allow # dpkg -l • Deny and log queries for our version number except from the local host. The ability to otherwise disable any that are not required or remove the package entirely. Red Deny from all determine the bind version enables an attacker to find the corresponding exploit for that Hat users can use /sbin/chkconfig --list to list which services run in which • List contents of a package </Directory> version. runlevel, and /sbin/chkconfig --del <name> to disable a service. # rpm -qvpl <package-name.rpm> # dpkg -c <package-name.deb> // Disable the ability to determine the version of BIND running If you don’t understand what a particular service does, disable it until you find out. • Use the following to control access to the server from limited zone “bind” chaos { Use netstat and ps to confirm they have not been started after a reboot. Use addresses in /etc/httpd/conf/access.conf to read: • Print information about a package type master; /bin/netstat -a -p --inet to determine which are available and the # rpm -qpi <package-name.rpm> file “master/bind”; process ID associated with them. A port scanner should also be used to get a view allow-query { localhost; }; <Directory /home/httpd/html> # dpkg -I <package-name.deb> }; of what remote hosts see. # Deny all accesses by default • Verify package characteristics (basic integrity check) The ./master/bind file should then contain: Order deny,allow Checking Package Integrity: # Allow access to local machine # rpm -Va # debsums -a $TTL 1d The md5sum command is used to compute a 128-bit fingerprint that is strongly Allow from 127.0.0.1 @ CHAOS SOA localhost. root.localhost. ( dependant upon the contents of the file to which it is applied. It can be used to # Allow access to entire local network • Determine to which package a file belongs 1 ; serial compare against a previously-generated sum to determine whether the file has Allow from 192.168.1. # rpm -qf </path/to/file> 3H ; refresh changed. It is commonly used to ensure the integrity of updated packages # Allow access to single remote host # dpkg -S </path/to/file> 15M ; retry Allow from 192.168.5.3 1W ; expire distributed by a vendor: # Deny from everyone else • Install new package 1D ) ; minimum # md5sum package-name # rpm -Uvh <package-name.rpm> NS localhost. Deny from all 995d4f40cda13eacd2beaf35c1c4d5c2 package-name </Directory> # dpkg -i <package-name.deb> • Control which interfaces named listens on. Restricting the interfaces on which named The string of numbers can then be compared against the MD5 checksum runs can limit the exposure to only the necessary networks. published by the packager. While it does not take into account the possibility that • Use the following to require password authentication when attempting to Configuring Syslog: access a specific directory in /etc/httpd/conf/access.conf: listen-on { 192.168.1.1; }; the same person that may have modified a package also may have modified the The syslogd is responsible for capturing logging information generated by published checksum, it is especially useful for establishing a great deal of system processes. The klogd is responsible for capturing logging information • Use Access Control Lists to classify groups of hosts with differing degrees of trust. The assurance in the integrity of a package before installing it. <Directory /home/httpd/html/protected> Order Deny,Allow generated by the kernel. System logs provide the primary indication of a potential “internal” ACL label might be used to describe internal hosts that are permitted a greater Deny from All problem. degree of access to the information than other hosts might be. Before it can be used it Install and Configure OpenSSH: Allow from 192.168.1.11 must be defined: AuthName “Private Information” • Fine-tune the default /etc/syslog.conf to send log information to specific OpenSSH is a replacement for telnet and ftp that eliminates eavesdropping, AuthType Basic acl “internal” { connection hijacking, and encrypts all communication between hosts. One of the AuthUserFile /etc/httpd/conf/private-users files for easier analysis. { 192.168.1.0/24; 192.168.2.11; }; most indepensible free security tools in existence. AuthGroupFile /etc/httpd/conf/private-groups }; require group <group-name> # Monitor authentication attempts • Install the OpenSSH and OpenSSL Packages: </Directory> auth.*;authpriv.* /var/log/authlog It can then be used in “zone” statements or the main “options” statement: openssh-<current-version>.rpm Create the private-groups file using the following format: # Monitor all kernel messages zone “inside.mynet.com” { openssh-server-<current-version>.rpm kern.* /var/log/kernlog type master; openssh-clients-<current-version>.rpm group-name: user1 user2 user... file “master/inside.mynet.com”; openssl-<current-version>.rpm # Monitor all warning and error messages allow-query { “internal”; }; • Generate Public/Private Key Pair: Create password entries for each user in the above list: *.warn;*.err /var/log/syslog }; OpenSSH uses public key cryptography to provide secure authorization. # htpasswd -cm /etc/httpd/conf/private-users user1 # Send a copy to remote loghost. Configure syslogd init • Configure BIND to run as a normal user. Once BIND has been started, it has the ability Generating the public key, which is shared with remote systems, and the private New password: <password> to relinquish its privileges, and run as a user with limited abilities instead of root. # script to run with -r -s domain.com options on log key which is kept on the local system, is done first to configure OpenSSH. Re-type new password: <password> # server. Ensure a high level of security on the log # useradd -M -r -d /var/named -s /bin/false named Adding password for user user1 orion$ ssh-keygen # server! # groupadd -r named Generating RSA keys: ...ooooooO....ooooooO Be sure to restart apache and test it. This will result in the enabling of double *.info @loghost Key generation complete. auth.*;authpriv.* @loghost This account should be used for nothing other than running the name server. Ensure the Enter file in which to save the key (/home/dave/.ssh/identity): reverse lookups to verify the identity of the remote host. Remove the -c zone files are readable by the named user. It is then necessary to modify the default Created directory '/home/dave/.ssh'. option to htpasswd after the first user has been added. Be sure the password • Restrict access to log directory and syslog files for normal users using: named init script, typically found in /etc/rc.d/init.d/named on Red Hat or Enter passphrase (empty for no passphrase): <passphrase> file you create is not located within the DocumentRoot to prevent it from Enter same passphrase again: <passphrase> /etc/init.d/named on Debian: being downloaded. # chmod 751 /var/log /etc/logrotate.d Your identification has been saved in /home/dave/.ssh/identity. Your public key has been saved in /home/dave/.ssh/identity.pub. # chmod 640 /etc/syslog.conf /etc/logrotate.conf /usr/sbin/named -u named -g named The key fingerprint is: Configuring TCP Wrappers: # chmod 640 /var/log/*log ac:42:11:c8:0d:b6:7e:b4:06:6a:a3:a7:e8:2c:b0:12 dave@orion It is also possible to run named in a “chroot jail” which helps to restrict the damage that Frequently used to monitor and control access to services listed in can be done should named be subverted. • Copy Public Key to Remote Host: /etc/inetd.conf. The in.ftpd service might be wrapped using: Install and Configure Tripwire: host2$ mkdir -m 700 ~dave/.ssh Tripwire is a program that monitors file integrity by maintaining a database of Critical System Files: host2$ cp /mnt/floppy/identity.pub ~dave/.ssh/authorized_keys ftp stream tcp nowait root /usr/sbin/tcpd in.ftpd -l -L -i -o cryptographic signatures for programs and configuration files installed on the File/Directory Perms Description • Log in to Remote Host: system, and reports changes in any of these files. Before the in.telnetd daemon is spawned, tcpd first determines if the /var/log 751 Directory containing all log files source is a permitted host. Connection attempts are sent to syslogd. All A database of checksums and other characteristics for the files listed in the /var/log/messages 644 System messages The SSH client (/usr/bin/ssh) is a drop-in replacement for rlogin and rsh. It services should be disabled by default in /etc/hosts.deny using the configuration file is created. Each subsequent run compares any differences to /etc/crontab 600 System-wide crontab file can be used to securely login to a remote host: following: the reference database, and the administrator is notified. /etc/syslog.conf 640 Syslog daemon configuration file ALL: ALL /etc/logrotate.conf 640 Controls rotating of system log files orion$ ssh host2 The greatest level of assurance that can be provided occurs if Tripwire is run /var/log/wtmp 660 Who is logged in now. Use who to view Enter passphrase for RSA key 'dave@orion': <passphrase> To send an email to the admin and report failed connection attempt: immediately after Linux has been installed and security updates applied, and /var/log/lastlog 640 Who has logged in before. Use last to view Last login: Sat Aug 15 17:13:01 2000 from orion before it is connected to a network. ALL: ALL: /bin/mail /etc/ftpusers 600 List of users that cannot FTP No mail. -s “%s connection attempt from %c” admin@mydom.com /etc/passwd 644 List of the system’s user accounts host2$ A text configuration file, called a policy file, is used to define the characteristics for /etc/shadow 600 Contains encrypted account passwords each file that are tracked. Your level of paranoia determines the frequency in Enable specific services in /etc/hosts.allow using the service name /etc/pam.d 750 PAM configuration files • Copy Files to Remote Host: which the integrity of the files are checked. Administration requires constant followed by the host: /etc/hosts.allow 600 Access control file attention to the system changes, and can be time-consuming if used for many The OpenSSH package also includes scp, a secure and improved replacement for sshd: magneto.mydom.com, juggernaut.mydom.com /etc/hosts.deny 600 Access control file systems. Available in unsupported commercial binary for Red Hat and similar. rcp. This allows you to securely copy files over a network. in.ftpd: 192.168.1. /etc/lilo.conf 600 Boot loader configuration file # Create policy file from text file /etc/securetty 600 TTY interfaces that allow root logins orion$ scp /tmp/file.tar.gz host2:/tmp Trailing period indicates entire network should be permitted. Use tcpdchk to /usr/TSS/bin/twadmin -m P policy.txt /etc/shutdown.allow 400 Users permitted to ctrl-alt-del Enter passphrase for RSA key 'dave@orion: verify your access files. A syslog entry will be created for failed attempts. # Initialize database according to policy file /etc/security 700 System access security policy files file.tar.gz 100% |***************************| 98304 00:00 Access control is performed in the following order: /usr/TSS/bin/tripwire —init /etc/rc.d/init.d 750 Program start-up files on Red Hat systems It is also possible to encapsulate ordinarily insecure protocols such as IMAP and • Access will be granted when a daemon/client pair matches an entry in # Print database /etc/init.d 750 Program start-up files on Debian systems POP within SSH to prevent transmitting clear text passwords to your mail server. the /etc/hosts.allow file. /usr/TSS/bin/twprint -m d /etc/sysconfig 751 System and network config files on Red Hat Additionally, the rsync incremental file transfer utility can use SSH to securely • Otherwise, access will be denied when a daemon/client pair matches /etc/inetd.conf 600 Internet SuperServer configuration file synchronize two hosts or backup data to a log server securely. SSH can even be # Generate daily report file /etc/cron.allow 400 List of users permitted to use cron an entry in the /etc/hosts.deny file. /usr/TSS/bin/tripwire -m c -t 1 -M used to securely connect two subnets across the Internet, effectively creating a /etc/cron.deny 400 List of users denied access to cron • Otherwise, access will be granted. virtual private network. Disable remote root logins and emtpy password ability. # Update database according to policy file and report file /etc/ssh 750 Secure Shell configuration files A non-existing access control file is treated as if it were an empty file. Thus, /usr/TSS/bin/tripwire --update --polfile policy/tw.pol /etc/sysctl.conf 400 Contains kernel tunable options on recent Red Hat © 2000 Guardian Digital, Inc. http://www.guardiandigital.com access control will be turned off if no access control files are present! --twrfile report/<hostname>-<date>.twr