22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Support for ipchains should also be enabled, even if this is a server in the DMZ,<br />

because ipchains provides additional layers of security, and allows the server to<br />

be protected from traffic should the firewall fail for some reason.<br />

Additionally, security and errata/updates lists should be read and monitored from<br />

the GNU/Linux distribution vendor. With Debian, it is extremely easy to<br />

automatically install security updates using the apt-get utility. For Red Hat<br />

installations starting with the 6.0 release, there is the up2date utility to retrieve<br />

updated packages for your release. Consult the GNU/Linux distribution vendor’s<br />

site for their implementation of such a tool, if it exists.<br />

For those people who choose to install Red Hat Linux, there is a security-related<br />

project called Bastille Linux, whose aim is not just to harden your Linux<br />

installation, but to educate the administrators on how to harden the system.<br />

Bastille Linux supports Red Hat and Mandrake Linux distributions, with project<br />

goals to become distribution, and UNIX flavor, agnostic. The Bastille Linux<br />

product is a set of scripts that asks a series of questions and then allows the<br />

installer (or administrator, which are not always the same person) to apply those<br />

modifications to the IT system. The questions describe what needs to be done,<br />

why it should be done, and why it might not be desirable to do it. It is very<br />

educational, especially for those administrators just getting familiar with Linux.<br />

Bastille Linux can be found at the following URL:<br />

http://www.bastille-linux.org/<br />

Another excellent source of information for administrators is the Linux<br />

Administrator's Security Guide. It <strong>cover</strong>s an extremely wide array of topics<br />

related to Linux and security. The Linux Administrator's Security Guide can be<br />

found online at the following URL:<br />

http://www.securityportal.com/lasg/<br />

9.4.7 Solaris-specific tasks<br />

Solaris has four default install-sets: Core, End-User, Developer, and Entire<br />

Distribution. Installing any install-set higher than the Core installation will enable<br />

more services than are required for hardened servers. In reality, it is often<br />

possible to remove a significant percentage of the default Core install-set,<br />

depending on the server's application requirements.<br />

For Solaris-based servers, there are several excellent documents from Sun in its<br />

Blueprints Online archive, which is available at the following URL:<br />

http://www.sun.com/software/solutions/blueprints/online.html<br />

Chapter 9. Server hardening 395

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!