Written by Jeffrey Denton <dentonj@gmail.com>
2 September 2006
Version - 0.7.1
This is written for:
$ cat /etc/slackware-version
Slackware 10.2.0
This is a list of some of the steps I take to improve the security on my
Slackware systems. It is by no means a complete list of everything that is
possible. You can either do all of the things listed here, or you can choose
the ones you feel would help secure your system.
WARNING: Hardening a system is a compromise between security
and usability. Some of the things I do would adversely
affect the usability of your system and may very well
break things. Please have one of the following on hand
just in case you lock yourself out of your system:
The "Live" CD that comes with the official
version of Slackware
The Slackware Install CDs
You should make a backup of anything that you feel is
important, would be hard to replace, or that you simply
could not do without BEFORE implementing anything listed
here.
If you don't understand what a setting or configuration
is doing, don't use it on your system.
The contents of this document is only meant to be used
on Slackware Linux.
Some of the settings are redundant (defense in depth) or
may conflict.
You have been warned.
Notes:
- The settings assume that only one user is on the system, "dentonj",
adjust as necessary.
- Associated man pages are listed for further information
- I will comment this document if I ever get around to it
- This is still a draft as there are many TODO items.
The "-r" options enables the system to receive syslog messages from the
remote hosts. The "-h" option allows syslog to forward messages it
receives from remote hosts. The allows syslog messages to be logged on
several systems for redundancy. Syslog messages that are sent over the
network are not encrypted and can be easily captured. Watch out for syslog forwarding loops when using both "-r" and "-h".
Opens UDP port 514.
man syslogd
man klogd
/etc/syslog.conf
# Log everything to a file
*.* - /var/log/messages
# Log everything to a tty (Ctrl-Alt-F12)
*.* /dev/tty12
# Log everything to a log host
*.* @192.168.1.2
# Display emergencies to everyone using wall
*.=emerg *
# Send alerts directly to the user's terminals
*.=alert root,dentonj
root@darkstar:~# /etc/rc.d/rc.syslog restart
man syslogd
man syslog.conf
/etc/logrotate.conf:
weekly
rotate 26
compress
Make sure you have enough hard drive space to store 6 months worth of logs.
You really should be moving the logs off of the system.
/etc/rc.d/rc.S:
# Setup the /etc/motd to reflect the current kernel level:
# THIS WIPES ANY CHANGES YOU MAKE TO /ETC/MOTD WITH EACH BOOT.
# COMMENT THIS OUT IF YOU WANT TO MAKE A CUSTOM VERSION.
# echo "$(/bin/uname -sr)." > /etc/motd
Unauthorized access prohibited; all access and activities not
explicitly authorized by the administrator are unauthorized.
All activities are monitored and logged. There is no privacy
on this system. Unauthorized access and activities or any
criminal activity will be reported to appropriate authorities.
"You seem to be lost. Please return to your little corner of the Internet."
root@darkstar:~# lilo -v -p
If lilo returns an error, try to determine what the problem is and rerun
lilo before you reboot the system. Otherwise, you may end up with a
system that doesn't boot properly.
/etc/rc.d/rc.inet2:
Most of the rc.scripts are started here. From the script:
"Uncomment or comment out sections depending on which
services you site requires."
There are two ways to stop daemons and services from being started. The
first way is to make the script starting the daemon or service non-
executable:
chmod 600 /etc/rc.d/rc.bind
The second way is to comment out the sections of this script that starts
the daemon or service:
Lines 100-103:
# Start the BIND name server daemon:
# if [ -x /etc/rc.d/rc.bind ]; then
# /etc/rc.d/rc.bind start
# fi
Or you can do both. Using both methods is redundant. However, using both
methods would keep daemons from accidentally being started at the next
reboot if you happen to get sloppy with a chmod command. Some daemons will
not start by default because their configuration files are either not
present or not setup properly.
Closes TCP ports 37 and 113 (by default).
Closes UDP ports 37 and 512 (be default).
/etc/rc.d/rc.mysqld:
The MySQL server daemon
By default, mysqld will not start. Read the /etc/rc.d/rc.mysqld file for
details on how to start the daemon.
The script prevents incoming network connections by default with the
"--skip-networking" option. If this option is commented out, TCP port
3306 will be opened.
This daemon doesn't open any ports by default.
root@darkstar:~# chmod go-rwx /etc/rc.d/rc.mysqld
/etc/rc.d/rc.nfsd:
The kfnsd NFS daemon
By default, the deamon will not start because the file /etc/exports is not
configured properly.
root@darkstar:~# chmod go-rwx /etc/rc.d/rc.nfsd
/etc/rc.d/rc.portmap:
The RPC portmapper
This script is started by /etc/rc.d/rc.nfsd. Since the file /etc/exports
is not configured properly by default, this damon will not start.
Unless you have installed a daemon that requires the use of SystemV
style startup scripts, there is no need for it to be executable.
root@darkstar:~# chmod 600 /etc/rc.d/rc.sysvinit
/etc/rc.d/rc.udev:
"udev provides a dynamic device directory containing only the files for
actually present devices. It creates and removes device node files
usually located in the /dev directory."
This is part of the hotplug subsystem.
This daemon doesn't open any ports.
root@darkstar:~# chmod 600 /etc/rc.d/rc.udev
man udev
/etc/rc.d/rc.wireless.conf:
This file holds the configuration settings used by /etc/rc.d/rc.wireless.
The file may hold encryption keys in plain text. Make sure that users
are not able read this file (the default setting).
The contents of this file is commented out by default.
root@darkstar:~# chmod 600 /etc/rc.d/rc.yp
----[ Limit Access ]----
/etc/rc.d/rc.M:
chmod 1733 /tmp /var/tmp
Prevents users for looking at the contents of those directories. It still
allows them to create, access, and modify files in those directories if
they know the actual file name. This does not stop users from running
executables in /tmp.
/etc/lilo.conf:
# mandatory - enter a password with every boot
# restricted - enter a password only when a boot time parameter
# is used (e.g. - "linux single")
# Pick one
mandatory
#restricted
# Use the "-p" option with the lilo command to store the hashed password
# in a separate file
password=""
root@darkstar:~# lilo -v -p
root@darkstar:~# chmod go-rwx /etc/lilo.conf
Using the setting 'password=""' and then the '-p' option with lilo will
prompt you to enter a pass phrase while lilo is running. The pass phrase
is hashed and stored in /etc/lilo.conf.shs. The man page for lilo claims
that the hashed pass phrase is stored in /etc/lilo.conf.crc. Either way,
it's better than having the password listed in /etc/lilo.conf in plain
text. The configuration options above will require the password to be
entered whenever the system boots. You may not want to use the "mandatory"
setting if uptime is important or when you normally only access the system
remotely. In these cases, use "restricted" instead.
man lilo
man lilo.conf
/etc/login.access:
+:root dentonj:LOCAL
-:ALL:ALL
Only root and dentonj can login locally. This does not affect logging in
via ssh.
The third field specifies when someone can login. If the field is empty,
then the user is not able to login. The "*:*:" entry is a default deny
rule to catch everyone not already listed. The third field lists the times
that a user is allowed to login. If that field is empty, the user is not
allowed to login.
The daemon logoutd is normally run to enforce the login time restrictions
listed in /etc/porttime.
Error generated: "Invalid login time"
man porttime
/etc/rc.d/rc.local:
# Enforce login time restrictions set in /etc/porttime
if [ -x /usr/sbin/logoutd ]; then
/usr/sbin/logoutd
fi
man logoutd
/etc/limits:
dentonj C0L1
* L0
root@darkstar:~# chmod go-rwx /etc/limits
The setting "* L0" is a default rule for anyone not previously listed. The
number of logins permitted is set to zero, which means anyone not
previously listed is not allowed to login. This does not affect root.
Error generated: "Too many logins."
man limits
/etc/shells:
Allowing users to run different shells allows them to bypass any security
restrictions set on their login shell.
Delete the following:
/bin/ash
/bin/csh
/bin/ksh
/bin/tcsh
/bin/zsh
/usr/sbin/faillog:
root@darkstar:~# faillog -u dentonj -m 10
root@darkstar:~# faillog -a
Don't set faillog for root. This is one of the few settings that can
actually stop root from logging in. Using faillog can cause a denial of
service if the maximum number of logins is reached. Use faillog with
caution.
Repeat for the following:
adm
games
gdm
lp
news
operator
pop
rpc
uucp
The accounts "halt" and "shutdown" don't work by default. The account
"sync" isn't needed.
root@darkstar:~# su halt
halt: must be superuser.
root@darkstar:~# su shutdown
shutdown: you must be root to do that!
root@darkstar:~# userdel halt
root@darkstar:~# userdel shutdown
root@darkstar:~# userdel sync
Add /bin/false as the shell to the following:
bin:x:1:1:bin:/bin:/bin/false
daemon:x:2:2:daemon:/sbin:/bin/false
mail:x:8:12:mail:/:/bin/false
ftp:x:14:50::/home/ftp:/bin/false
smmsp:x:25:25:smmsp:/var/spool/clientmqueue:/bin/false
sshd:x:33:33:sshd:/:/bin/false
nobody:x:99:99:nobody:/:/bin/false
Error generated: darkstar login: test
Password: *************************
Linux 2.4.32
Last login: Wed Jun 27 20:23:42 -0700 2001 on tty2
No mail.
Welcome to Linux 2.4.32 (tty2)
darkstar login:
Password aging:
Note: Don't use this if you like to make the /etc/passwd and the
/etc/shadow files immutable (chattr +i ...). It gets ugly... If you
let the password expire, you will not be able to login until you reset
the password. But if the /etc/shadow file is immutable and cannot be
changed, then you will not be able to login. To fix the problem, you
would have to boot tomsrtbt or a Linux boot CD, mount the hard drive
partition where /etc is located, and remove the immutable attribute
from /mnt/etc/shadow (chattr -i ...).
root@darkstar:~# groups dentonj
root@darkstar:~# usermod -g users -G wheel dentonj
There are a number a security concerns when allowing users to use sudo.
Make sure you completely read the man pages for sudo and sudoers.
There are generally two approaches when configuring sudo. The first is to
allow the user to run any command. This is essentially giving them su
access to root. If you are going to use the first approach, you should
require the user to enter the root password every time they use sudo.
Two passwords would need to be entered to gain root access.
The second approach is to configuring sudo is to only allow a limited
number of commands to be run. If you are going to use the second approach,
there are a few commands that you don't want to allow the user to run.
These commands can be abused to give the user full access to the system.
Make sure you don't add the following or those listed in the Shell Escapes
section below to the /etc/sudoers file:
man sudo
man sudoers
man visudo
man groups
man usermod
/etc/ftpusers:
This file is used to deny anyone listed from being able to log into the
local ftp server. Add the following:
bin
daemon
mail
smmsp
mysql
sshd
nobody
Add all system accounts that are present in /etc/passwd.
man ftpusers
/etc/host.conf:
nospoof on
spoofalert on
spoof warn
From `man hosts_options`:
banners /some/directory
Look for a file in `/some/directory` with the same
name as the daemon process (for example in.telnetd
for the telnet service), and copy its contents to
the client.
If you are using any of the services listed below, make sure you add an
allow rule for it. If you want a different banner for a particular
service, delete the symlink and create a text file with the same name.
/etc/X11/xdm/Xstartup:
#!/bin/sh
#
# Xstartup
# This program is run as root after the user is verified
#
# man xdm
#
if [ -f /etc/nologin ]; then
xmessage -file /etc/nologin -timeout 30 -center
exit 1
fi
sessreg -a -l $DISPLAY -x /usr/X11R6/lib/X11/xdm/Xserver $LOGNAME
/usr/X11R6/lib/X11/xdm/GiveConsole
exit 0
root@darkstar:~# chmod a+x /etc/X11/xdm/Xstartup
/etc/X11/xdm/Xreset:
#!/bin/sh
#
# Xreset
#
# This program is run as root after the session ends
#
# man xdm
#
sessreg -d -l $DISPLAY -x /usr/X11R6/lib/X11/xdm/Xservers $LOGNAME
/usr/X11R6/lib/X11/xdm/TakeConsole
exit0
/etc/X11/xserver/SecurityPolicy:
Comment the following lines:
# If you are using Motif, you probably want these.
#property _MOTIF_DEFAULT_BINDINGS root ar iw
#property _MOTIF_DRAG_WINDOW root ar iw
#property _MOTIF_DRAG_TARGETS any ar iw
#property _MOTIF_DRAG_ATOMS any ar iw
#property _MOTIF_DRAG_ATOM_PAIRS any ar iw
# If you are running CDE you also need these
#property _MOTIF_WM_INFO root arw
#property TT_SESSION root irw
#property WM_ICON_SIZE root irw
#property "SDT Pixel Set" any irw
# The next two rules let xwininfo -tree work when untrusted.
#property WM_NAME any ar
# Allow read of WM_CLASS, but only for windows with WM_NAME.
# This might be more restrictive than necessary, but demonstrates
# the <required property> facility, and is also an attempt to
# say "top level windows only."
#property WM_CLASS WM_NAME ar
# These next three let xlsclients work untrusted. Think carefully
# before including these; giving away the client machine name and command
# may be exposing too much.
#property WM_STATE WM_NAME ar
#property WM_CLIENT_MACHINE WM_NAME ar
#property WM_COMMAND WM_NAME ar
# To let untrusted clients use the standard colormaps created by
# xstdcmap, include these lines.
#property RGB_DEFAULT_MAP root ar
#property RGB_BEST_MAP root ar
#property RGB_RED_MAP root ar
#property RGB_GREEN_MAP root ar
#property RGB_BLUE_MAP root ar
#property RGB_GRAY_MAP root ar
# To let untrusted clients use the color management database created
# by xcmsdb, include these lines.
#property XDCCC_LINEAR_RGB_CORRECTION root ar
#property XDCCC_LINEAR_RGB_MATRICES root ar
#property XDCCC_GRAY_SCREENWHITEPOINT root ar
#property XDCCC_GRAY_CORRECTION root ar
# To let untrusted clients use the overlay visuals that many vendors
# support, include this line.
#property SERVER_OVERLAY_VISUALS root ar
man Xserver
xhost:
dentonj@darkstar:~$ xhost
access control enabled, only authorized clients can connect
dentonj@darkstar:~$
/opt/kde/share/config/kdm/Xaccess:
Comment out the following lines:
#* #any host can get a login window
#* CHOOSER BROADCAST #any indirect host can get a chooser
Access Control Lists:
TODO
man acl
man setfacl
man getfacl
/etc/inittab:
Comment out the following line:
#ca::ctraltdel:/sbin/shutdown -t5 -r now
root@darkstar:~# telinit q
[rant]
I actually don't think this is necessary. But I'm including it because
just about every security document on Linux recommends it. It stops anyone
from being able to reboot the system by doing a three finger salute.
Pressing Ctrl-Alt-Del to reboot the system only works if you have physical
access to the system. Even if you disable this feature, it doesn't stop
someone from pulling the power cord or pressing the reset switch to force a
reboot. Most window managers trap Ctrl-Alt-Del anyways.
The only time that I see disabling the above line as being useful is when
you have a Windows admin using Linux. You don't want them rebooting the
system every time they want to lock the system or go to the Task Manager.
Or you can use /etc/shutdown.allow to control when (not exactly by who) the
system can be rebooted with Ctrl-Alt-Del. There are security concerns with
using this method. Check the man page for shutdown for details.
[/rant]
Add "-a" to the following line in /etc/inittab to use
/etc/shutdown.allow:
ca::ctraltdel:/sbin/shutdown -t5 -r now -a
root@darkstar:~# telinit q
I like to use dumb terminals. Uncomment the following line:
s1:12345:respawn:/sbin/agetty -L ttyS0 9600 vt100
root@darkstar:~# telinit q
man init
man inittab
man initscript
man shutdown
man telinit
/etc/shutdown.allow:
dentonj
man shutdown
/etc/securetty:
Make sure only the following are uncommented:
console
tty1
tty2
tty3
tty4
tty5
tty6
man securetty
umask:
There are several ways to set umask:
/etc/login.defs:
UMASK 077
/etc/limits:
* K077
/etc/profile:
umask 077
Umask controls what the initial permissions are for newly created files and
directories. With a umask of 022, new files have the permissions of 644
and new directories have the permissions of 755. Setting the umask to 077
will result in new files being created with the permissions of 600 and new
directories will have the permissions of 700.
Using the umask of 077 will keep others from being able to access users
files. Using a umask of 022 will allow others access to the users files
unless the users takes the time to change the permissions. You can use
cron to periodically remove permissions from the user's home directories.
Setting a restrictive umask can cause problems when you commonly edit
or create files that need to be read accessable to everyone. An example
of files that everyone needs to be able to read are web server pages
located in /var/www/htdocs.
/sbin/tune2fs:
Stop fsck from running every 22 boots. The new setting means fsck only
runs every 6 months. If you would like to fsck more often, then adjust
as necessary.
root@darkstar:~# tune2fs -l /dev/hdb5
root@darkstar:~# for i in hdb5 hdb6 hdb7 hdb8 hdb9; do
> tune2fs -c 0 /dev/$i
> done
root@darkstar:~# tune2fs -l /dev/hdb5
man tune2fs
man fsck
/usr/bin/chattr:
Make these files immutable:
- init/rc scripts
- shell, environment, login config files
- passwd files
- server config files
- suid/sgid executables
- commonly trojaned executables
for i in `ls /etc/rc.d`; do
chattr +i /etc/rc.d/$i
done
for i in `ls /etc/apache`; do
chattr +i /etc/apache/$i
done
for i in `ls /etc/mail`; do
chattr +i /etc/mail/$i
done
lcap:
TODO - list where is can be found and how to compile it.
Remove the CAP_LINUX_IMMUTABLE kernel capability. This prevents the +i
attribute from being removed. I run `lcap` from rc.local. This file is
sourced from the file rc.M. To remove the +i attribute from a file, you'll
have to reboot the system and go into single user mode. This is one of the
few times when you really have to reboot Linux.
If you only access and manage the system remotely, using lcap may cause
problems.
Note: Do this after you are finished with configuring your system.
The following files should be empty if they exist:
/etc/X0.hosts
/etc/d_passwd
/etc/dialups
/etc/environment
/etc/exports
/etc/hosts.lpd
/etc/hosts.equiv
/etc/ssh/shosts.equiv
~/.forward
~/.netrc
~/.rhosts
~/.shosts
Find world and group writable files and directories:
root@darkstar:~# find / -type f \( -perm -2 -o -perm -20 \) \
> -ls > write_files.out
root@darkstar:~# find / -type d \( -perm -2 -o -perm -20 \) \
> -ls > write_dirs.out
SUID/SGID:
Remove the SUID or SGID bit from the following files:
chmod u-s /usr/bin/at
chmod u-s /usr/bin/chage
chmod u-s /usr/bin/chfn
chmod u-s /usr/bin/chsh
chmod u-s /usr/bin/crontab
chmod u-s /usr/bin/expiry
chmod u-s /usr/bin/gpasswd
chmod u-s /usr/bin/lppasswd
chmod u-s /usr/bin/newgrp
chmod u-s /usr/bin/rcp
chmod u-s /usr/bin/rlogin
chmod u-s /usr/bin/rsh
chmod u-s /usr/libexec/ssh-keysign
man chmod
Shell Escapes:
The following is a list of programs that can escape to a shell. This can
either be done by directly starting a new shell, executing shell commands
(which is used to start a shell), or by opening an text editor that can be
used to start a shell.
These programs are not a security concern by themselves. However, if they
are set SUID root or used with sudo, the programs can allow users access to
a root shell.
/etc/sudoers:
dentonj ALL = (ALL) /usr/bin/less /var/log/messages
Start a new shell:
dentonj@darkstar:~$ sudo /usr/bin/less /var/log/messages
Password:
<contents of /var/log/messages>
!
bash-3.00#
Open an editor that can start a new shell:
dentonj@darkstar:~$ sudo /usr/bin/less /var/log/messages
Password:
<contents of /var/log/messages>
v
:sh
bash-3.00#
Make sure these are not SUID and owned by root. Also make sure they don't
end up in /etc/sudoers. This list is not complete.
A couple of the things that I used to figure out which commands allow shell
escapes.
root@darkstar:~# cd /usr/bin && for i in `ls | grep -v "@$"`; do
> echo " $i"
> strings $i | grep -e "VISUAL|EDITOR"
> done | less
root@darkstar:~# cd /usr/man/man1 && zgrep -E \
> "\!.*command|execute.*command" *
Find and delete dead symlinks:
find / -type l -print | perl -nle '-e || print'
----[ Network ]----
/etc/rc.d/rc.local:
# Stop arp spoofing used to sniff switched networks
# Set a static ARP entry for the default gateway
arp -s 192.168.1.1 00:00:FE:ED:FA:CE
# Set a static ARP entry for the log host
arp -s 192.168.1.2 00:00:DE:AD:BE:EF
/etc/rc.d/rc.firewall:
The file /etc/rc.d/rc.inet2 check for the existance and then runs
rc.firewall. Create a firewall script and place it here.
Remove support for kernel modules:
From Phrack 25-5, "Unix Cracking Tips":
"After you gain superuser privileges and you wish to stay root,
here are a few suggestions for installing backdoors:
. . .
- Install new system calls
. . ."
Then read Phrack 52-8, "Weakening the Linux Kernel". Then compile your
kernel to remove supports for modules.
CONFIG_MODULES=n
----[ Misc Stuff ]----
/etc/inputrc:
set bell-style none
set mark-directories on
set mark-modified-lines on
set match-hidden-files on
set show-all-if-ambiguous on
set visible-stats on
man bash
man readline
Stuff to remove:
root@darkstar:~# removepkg nn
root@darkstar:~# removepkg slrn
root@darkstar:~# removepkg uucp
root@darkstar:~# removepkg strace
root@darkstar:~# removepkg gdb
root@darkstar:~# removepkg nc
root@darkstar:~# removepkg nmap
root@darkstar:~# removepkg at
This list should be much longer.
/etc/rc.d/rc.local:
# This is hard drive specific, your settings will vary
/usr/sbin/hdparm -c3 -a16 -W1 -u1 /dev/hdb
# Turn on NumLock
/usr/bin/setleds -D +num
Make a backup of commonly trojaned commands:
Only do this after a fresh install. Making copies of already trojaned
commands will just ruin your day. If you don't have a fresh install, copy
the commands from the "Live" CD that comes with the official version of
Slackware.
root@darkstar:~# cd bin
root@darkstar:~/bin# md5sum * >> md5sum
root@darkstar:~/bin# cd
root@darkstar:~# tar zcvf bin.tar.gz ./bin
root@darkstar:~# cp bin.tar.gz /mnt/thumb
It would be a good idea to run `chattr +i ...` on all of the original files.
Passwords in logs and history files:
It's not uncommon for someone to make a mistake while logging in or
switching users and type the password in the wrong place. Be aware that
"dumpster diving" in system logs and other users history files is a common
practice by evil doers to obtain passwords. Keep this in mind when
deciding to store 6 months worth of logs or when setting HISTFILESIZE to a
$LARGENUMBER.
root@darkstar:~# lastb
P@ssw0rd1! Fri Jun 23 19:04 - 19:04 (00:00)
dentonj Fri Jun 23 19:03 - 19:03 (00:00)
root@darkstar:~# less /home/dentonj/.bash_history
<contents of .bash_history>
/us <-- type this to search for "us"
. . .
us -
!QAZzaq1
. . .
/etc/wgetrc:
Ignore the robots.txt file on web servers.
robots = off
----[ Program Hardening ]----
/usr/sbin/atalkd:
TODO
/etc/netatalk/atalkd.conf:
/etc/netatalk/afpd.conf:
/etc/netatalk/AppleVolumes.default:
/etc/netatalk/AppleVolumes.system:
/etc/netatalk/netatalk.conf:
/etc/netatalk/papd.conf:
man afpd
man afpd.conf
man AppleVolumes.default
man atalkd
man atalkd.conf
man netatalk.conf
man papd
root@darkstar:~# rndc-confgen -b 512
To check the configuration:
root@darkstar:~# named-checkconf -z
zone localhost/IN: loaded serial 42
zone 0.0.127.in-addr.arpa/IN: loaded serial 1997022700
root@darkstar:~# named-checkzone localhost \
/var/named/caching-example/localhost.zone
zone localhost/IN: loaded serial 42
OK
root@darkstar:~# named-checkzone 0.0.127.in-addr.arpa \
/var/named/caching-example/named.local
zone 0.0.127.in-addr.arpa/IN: loaded serial 1997022700
OK
root@darkstar:~# named-checkzone . /var/named/caching-example/named.ca
zone ./IN: has 0 SOA records
root@darkstar:~# chmod 700 /etc/rc.d/rc.bind
root@darkstar:~# /etc/rc.d/rc.bind start
root@darkstar:~# rndc status
man named
man named-checkconf
man named-checkzone
man rndc
man rndc.conf
man rndc-confgen
man lwresd
TODO - Chroot
/usr/sbin/sendmail:
/etc/mail/sendmail.cf:
#O DontBlameSendmail=Safe
O MaxHopCount=25
O HelpFile=/etc/issue.net
O ForwardPath=/etc/forward
O LogLevel=15
#O DaemonPortOptions=Name=MTA
#O DaemonPortOptions=Port=587,Name=MSA,M=E
O DaemonPortOptions=Address=127.0.0.1
O ClientPortOptions=Family=inet,Address=127.0.0.1
O PrivacyOptions=goaway,noreceipts,restrictmailq,restrictqrun,
restrictexpand,noetrn,nobodyreturn
O Timeout.ident=0
O SmtpGreetingMessage=$j Unauthorized Access Prohibited.
O AllowBogusHELO=False
O UnsafeGroupWrites=True
O RrtImpliesDSN=False
$.by $j with id $i$?{tls_version}
root@darkstar:~# touch /etc/forward
$HOME/.forward:
The .forward file allows users to easily forward email. However, the
file can also be used to run a program every time an email is received.
There are several ways to disable use of the .forward file.
Set the ForwardPath option so that it points to something other than
the default. The option has to be set to something, otherwise sendmail
sets ForwardPath to $HOME/.forward.
O ForwardPath=/etc/forward
You can allow programs to be run, but restrict which ones can be run by
using smrsh.
You can disable forwarding in sendmail all together. However, the bat
book warns that Bad Things(TM) can happen is you completely disable
forwarding. Remove the "w" flag from the line located in
/etc/mail/sendmail.cf:
You can try to have root create and own the .forward file in each of
the user's home directories. But the user can move the .forward file
and create a new file.
Fortunately, PHP is disabled by default. But if you insist on letting the
script kiddies have free reign of your system, there are a few things you
can do to slow them down.
/etc/apache/httpd.conf:
Include /etc/apache/mod_php.conf
/etc/apache/php.ini:
display_errors = Off
log_errors = On
error_log = /var/log/apache/php_errors
register_globals = Off
variables_order = "ES"
expose_php = Off
all_url_fopen = Off
open_basdir = /var/www
disable_functions = system,exec,shell_exec,eval,include,require,include_once,require_once,preg_replace
safe_mode = On
safe_mode_include_dir = /usr/php/include
safe_mode_exec_dir = /usr/php/bin
safe_mode_gid = On
safe_mode_allowed_env_vars = PHP_
safe_mode_protected_env_vars = LD_LIBRARY_PATH
Compression yes
HashKnownHosts yes
EnableSSHKeysign no
LogLevel DEBUG
PubkeyAuthenticaton yes
ServerAliveInterval 60
ServerAliveCountMax 10
TCPKeepAlive no
UserKnownHostsFile ~/.ssh/known_hosts
/etc/ssh/sshd_config
Port 22
Protocol 2
AddressFamily inet
ListenAddress 192.168.1.2
# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 1h
#ServerKeyBits 768
LoginGraceTime 2m
PermitRootLogin no
StrictModes yes
MaxAuthTries 6
AllowUsers dentonj@trustedhost
AllowGroups wheel
RSAAuthentication no
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication no
PermitEmptyPasswords no
# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no
# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
#UsePAM no
AllowTcpForwarding yes
GatewayPorts no
X11Forwarding no
X11DisplayOffset 10
X11UseLocalhost yes
PrintMotd yes
PrintLastLog yes
TCPKeepAlive no
UseLogin no
UsePrivilegeSeparation yes
PermitUserEnvironment no
Compression delayed
ClientAliveInterval 60
ClientAliveCountMax 10
UseDNS yes
PidFile /var/run/sshd.pid
#MaxStartups 10
# no default banner path
Banner /etc/issue.net
# override default of no subsystems
#Subsystem sftp /usr/libexec/sftp-server
# Ciphers aes256-cbc,aes256-ctr
# login.conf(5) is not used in Slackware
ChallengeResponseAuthentication no
root@darkstar:~# cp sxid_4.0.5.tar.gz src
root@darkstar:~# cd src
root@darkstar:~/src# gzip -cd sxid_4.0.5.tar.gz | tar xvf -
root@darkstar:~/src# cd sxid-4.0.5
root@darkstar:~/src/sxid-4.0.5# less README
root@darkstar:~/src/sxid-4.0.5# make install
root@darkstar:~# cp chkrootkit_0.46a.tar.gz src/
root@darkstar:~# cd src
root@darkstar:~/src# gzip -cd chkrootkit_0.46a.tar.gz | tar xvf -
root@darkstar:~/src# cd chkrootkit-0.46a
root@darkstar:~/src/chkrootkit-0.46a# less README
root@darkstar:~/src/chkrootkit-0.46a# make sense
Copy the following to /usr/local/sbin:
check_wtmpx
chkdirs
chklastlog
chkproc
chkrootkit
chkutmp
chkwtmp
ifpromisc
strings-static
root@darkstar:~# crontab -e
# Chkrootkit, results are mailed to root
10 4 * * * ( cd /usr/local/sbin && ./chkrootkit 2>&1)
root@darkstar:~# killall -HUP crond
root@darkstar:~# cp lcap_0.0.6.orig.tar.gz src/
root@darkstar:~# cd src
root@darkstar:~/src# gzip -cd lcap_0.0.6.orig.tar.gz | tar xvf -
root@darkstar:~/src/# cd lcap-0.0.6/
root@darkstar:~/src/lcap-0.0.6# less README
root@darkstar:~/src/lcap-0.0.6# make
root@darkstar:~/src/lcap-0.0.6# strip lcap
root@darkstar:~/src/lcap-0.0.6# cp lcap /usr/local/sbin
----[ Usibility/Reducing Security ]----
Run X applications as root:
The Linux Security Cookbook contains a short script that will set DISPLAY
and XAUTHORITY to allow root to run X apps. Or you can cheat by setting
DISPLAY and HOME to accomplish the same thing.
root@darkstar:~# xv
xv: Can't open display
root@darkstar:~# DISPLAY=:0.0
root@darkstar:~# xv
Xlib: connection to ":0.0" refused by server
Xlib: Invalid MIT-MAGIC-COOKIE-1 key
xv: Can't open display
root@darkstar:~# HOME=/home/dentonj
root@darkstar:~# xv
A better way is to use xauth and set the MIT-MAGIC-COOKIE:
You still have to set DISPLAY for root. Be aware that setting DISPLAY in a
shell config file (e.g. - /etc/profile) may cause problems with X
forwarding in ssh.
man xauth
man Xsecurity
/usr/bin/lessopen.sh:
I like to dig around inside of binaries. Uncomment the following lines:
*) FILE=`file -L "$1"` ; # Check to see if binary, if so -- view with 'strings'
FILE1=`echo $FILE | cut -d ' ' -f 2`
FILE2=`echo $FILE | cut -d ' ' -f 3`
if [ "$FILE1" = "Linux/i386" -o "$FILE2" = "Linux/i386" \
-o "$FILE1" = "ELF" -o "$FILE2" = "ELF" ]; then
strings "$1"
fi ;;
Error Beep:
I make extensive use of tab completion in bash. However, the error beeps
tend to annoy those around me. Here are three ways to turn off the error
beep.
cd /bin && for i in `ls | grep -v "@$"`; do
file $i | grep "not stripped"
done
for i in /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin \
/usr/X11R6/bin; do echo $i; cd $i && for j in `ls | grep "@$"`; do file $j \
| grep "not stripped"; done; done
which kill
type -a kill
stat /bin/login
touch example
stat example
touch -r /bin/login example
stat example
strace -p 19148 -f -e trace=network,read,write -o ssh_trace.out -e write=4 \
-e read=6 # Where 19148 is the PID of sshd
ifconfig eth0 hw ether 00:00:DE:AD:BE:EF
ifconfig eth0 0.0.0.0 up -arp
ln -s /usr/bin/write /bin/write
kibitz dentonj
----[ /etc/profile ]----
# If the following variables are not set, exit with an error message
: ${USER:?Who are you?}
: ${LOGNAME:?Who are you?}
: ${HOME:?The homeless need help}
# If a user doesn't have a home directory listed in /etc/passwd,
# login is nice enough to set "/" as $HOME
if [ ${HOME} = "/" ]; then
logout
fi
# Kick and lockout users that are UID 0 but are not root
if [ `id -u` = "0" -a `echo $USER` != "root" ]; then
# Lock the user out
passwd -l $USER
# Save some info
date >> /root/SHIT
netstat -peanut >> /root/SHIT
ps auxww >> /root/SHIT
w >> /root/SHIT
w | mail -s "$USER has gained ROOT access on $HOSTNAME" dentonj@gmail.com
# This works for single user systems if the luzer who breaks into your
# system uses an interactive shell
if [ `id -u` != "0" -o `id -u` != "1000" ]; then
passwd -l $USER
logout
fi
# Set these and make them read only to keep users from setting them
export HISTCONTROL=""
export HISTIGNORE=""
# Disable builtin shell commands
# TODO
# Set shell variables as read only, this should be last:
typeset -r HISTCONTROL
typeset -r HISTFILE
typeset -r HISTFILESIZE
typeset -r HISTIGNORE
typeset -r HISTNAME
typeset -r HISTSIZE
typeset -r LESSSECURE
typeset -r LOGNAME
typeset -r USER
-- When You Are Done --
Join the irc channel #slackware on irc.oftc.net and talk about everything
but Slackware.
-- Todo --
KDE:
Look into it
/etc/shells:
Lock down the other shells.
/bin/login:
Modify so a different encryption hashing algorithms is used.
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
Forum FAQ
Search
Usergroups
Profile
Log in to check your private messages
Log in
CAP_SETPCAP 9) CAP_LINUX_IMMUTABLE
