O'Reilly - Practical UNIX & Internet Sec... 7015KB

[Appendix A] UNIX Security Checklist
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
Disable or replace the finger service with something that provides less information.
If you are using POP or IMAP, configure your system to use APOP or Kerberos for authentication.
Consider running the authd daemon for all machines in the local net.
Configure your NNTP or INND server to restrict who can post articles or transfer Usenet news.
Make sure that you have the most recent version of the software.
Block NTP connections from outside your organization.
Block SNMP connections from outside your organization.
Disable rexec service unless needed.
Routinely scan your system for suspicious .rhosts files. Make sure that all existing .rhosts files are
protected to mode 600.
Consider not allowing users to have .rhosts files on your system.
If you have a plus sign (+) in your /etc/hosts.equiv file, remove it.
Do not place usernames in your /etc/hosts.equiv file.
Restrict access to your printing software via the /etc/hosts.lpd file.
Make your list of trusted hosts as small as possible.
Block incoming RIP packets; use static routes where possible and practical.
Disable UUCP over IP unless needed.
Set up your logindevperm or fbtab files to restrict permissions on frame buffers and devices, if this
is possible on your system.
If your X11 Server blocks on null connections, get an updated version.
Enable the best X11 authentication possible in your configuration (e.g., Kerberos, Secure RPC,
"magic cookies") instead of using xhost.
Disable the rexd RPC service.
Be very cautious about installing MUDS, IRCS, or other servers.
Scan your network connections regularly with netstat.
Scan your network with tools such as SATAN and ISS to determine if you have uncorrected
vulnerabilities - before an attacker does the same.
Re-evaluate why you are connected to the network at all, and disconnect machines that do not
really need to be connected.
A.1.1.17 Chapter 18: WWW Security
file:///C|/Oreilly Unix etc/O'Reilly Reference Library/networking/puis/appa_01.htm (14 of 21) [2002-04-12 10:44:34]