Date: Sat, 24 Nov 2002 9:16:59 EDT
From: John Weber
To: Sam Gooding
Subject: Re: Securing RH
There are a few things you can do make RH a little more secure than 
it is with its default configuration. Here's just a quick list of 
things I check for:

(1) Portmap.  Portmap is a service for mapping incoming remote 
procedure calls to ports.  Aside from the usual security issues 
related to RPC, this daemon is basically an advertisement of all open 
ports on your machine.  The only major service which uses RPC 
is NFS, so, if you aren't using NFS on your lan, you can safely 
stop the portmap daemon.

(2) Inetd.  The internet daemon is basically a dispatcher for all 
internet services (simplistic view of it I'm sure, but suitable for 
our purposes).  Inetd can manage internet services like ftp, http but 
it can also manage services like telnet, finger, scp, and other useless daemons. 
Make sure that you configure inetd to disable all unneeded services. 
The more open ports you have on your machine, the easier it is for an 
interested hacker to mess with.  I disable inetd all together.

(3) Telnet.  Kill it!  Aside from being a very antiquated (some say 
retarded) protocol, the openbsd ssh server is a more secure 
alternative if you need to provide users with shell access.

(4) Mail Services.  POP3, IMAP, SMTP, and most other mail protocols 
were invented a long, long time ago in a galaxy far,far away.  They 
are all simple socket/text-based protocols.  For example, a typical 
POP3 sessions goes as follows:

USER myuser
PASS mypass

As you can see, this is a very simple protocol and all of the 
information is sent in clear text via port 110.  It doesn't take 
a rocket scientist to grab a whole crap load of passwords.  
If you have to provide mail service to users, think about providing 
web access to mail (via HTTPS which is encrypted) or shell access 
(via SSH which is encrypted).

(5) TCP_WRAPPERS.  Use tcp_wrapper to make  your server  secure 
against outside intrusion.  The best policy is to deny all hosts 
by putting "ALL: ALL@ALL, PARANOID" (this denies access to all 
services from all locations) in the "/etc/hosts.deny" file 
and then explicitly list  trusted hosts who are allowed to access 
your machine in the "/etc/hosts.allow" file (add for example, the 
line "ftp:" where is the ip address 
and the host name of client allowed to use the service ftp).
You can run the tcpdchk program to check for potential issues. 

(6) Block root.  You can and should restrict "su" to certain users. 
To do this, edit the "su" file in the "/etc/pam.d/" directory. 
For example, to restrict access to "su" to only the members of 
the wheel group, you can add the following two lines:

auth sufficient /lib/security/ debug
auth required /lib/security/ group=wheel

I disable access to "su" in this way, and then configure sudo to 
grant other admins lower-level priviledges.

(7) Devices.  I like to chmod the entire /dev directory so 
that only root has read/write access.  If users need access to 
certain devices, I grant them access via fstab and mount.

(8) SUID. Disable unused SUID/SGID programs.  To find all files 
with the `s' bits from root-owned programs, use the command:

[root@boolean]# find / -type f \( -perm -04000 -o -perm -02000 \) \-exec ls ­lg {} \;

(9) Special accounts.  Almost everyone knows the special accounts 
that are create by UNIX systems.  For example, accounts like "lp" 
or "lpr" for print services, etc.  Remove all special accounts 
or rename them if you want to run certain services with those accounts.

(10) IPTABLES.  This is by far the best way of securing your Linux 
system.  If you are just using RH as your desktop, then the best 
policy is:

## Create chain which blocks new connections, except if coming from inside.
# iptables -N block
# iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT
# iptables -A block -m state --state NEW -i ! eth0 -j ACCEPT
# iptables -A block -j DROP

## Jump to that chain from INPUT and FORWARD chains.
# iptables -A INPUT -j block
# iptables -A FORWARD -j block

This basically rejects all new connections from the outside, but allows 
all connections established by you or related to a previously established 
connection.  For more complicated setups, you should read the documentation 

There are lots of other things you can do, but it all depends on how you 
intend to use your system.  I've tried to include a lot of different options 
so that you could choose which combination is right for you.  And, of course, 
I can't go in much depth when it comes to things like "iptables" or 
"tcp_wrappers", etc so treat this email as a reading list NOT a real 

Good luck with linux,