O'Reilly - Practical UNIX & Internet Sec... 7015KB

[Chapter 17] 17.4 Security Implications of Network Services
Bringing Up an Internet Server Machine: Step-by-Step
Although every site is unique, you may find the following step-by-step list helpful in bringing up new
servers as securely as possible:
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
●
Don't physically connect to the network before you perform all of the following steps. Because
some network access may be needed to FTP patches, for example, you may need to connect as
briefly as possible in single-user mode (so there are no daemons running), fetch what you need,
disconnect physically, and then follow steps 2-12.
Erase your computer's hard disk and load a fresh copy of your operating system.
Locate and load all security-related patches. To find the patches, check with both your vendor and
with CERT's FTP server, ftp.cert.org.
Modify your computer's /etc/syslog.conf file so that logs are stored both locally and on your
organization's logging host.
Configure as few user accounts as necessary. Ideally, users should avoid logging into your Internet
server.
If your server is a mail server, then you may wish to have your users read their mail with POP.
You will need to create user accounts, but give each user a /bin/nologin (or a shell script that
simply prints a "no logins allowed" message) as their shell to prevent logins.
Check all /etc/rc* and other system initialization files, and remove daemons you don't want
running. (Use netstat to see what services are running.)
Look through /etc/inetd.conf and disable all unneeded services. Protect the remaining services with
tcpwrapper or a similar program.
Add your own server programs to the system. Make sure that each one is based on the most
up-to-date code.
Get and install Tripwire, so you can tell if any files have been modified as the result of a
compromise. (See Chapter 9, Integrity Management, for details.)
Get and run Tiger to look for other problems.
Monitor your system. Make sure that log files aren't growing out of control. Use the last command
to see if people have logged in. Be curious.
Disable all services that you are not sure you need, and put wrappers around the rest to log
connections and restrict connectivity.
17.3 Primary UNIX Network
Services
file:///C|/Oreilly Unix etc/O'Reilly Reference Library/networking/puis/ch17_04.htm (2 of 3) [2002-04-12 10:45:36]
17.5 Monitoring Your
Network with netstat