Basic Security

Rob

Administrator
Staff member
Basic Security

Fortunately, Linux has a lot of built in security that it inherits from its Unix forebears. User accounts are clearly separate from each other. It's easy to configure a Linux system so that normal users have zero rights outside their own user space. The administrator or 'root' account is virtually untouchable if one doesn't have physical access to the machine and proper password and login policies are in place.


User Account Security

Root is the number one user on the system. Fortunately, root's privileges can only be shared explicitly through the use of programs like 'sudo'. Other than that, there's no way a normal user under normal circumstances can do what root can. But user accounts can also be a source of compromise and they need to be made secure. We can start by making sure that user directories are accessible only to the owner of the account. To do this, directories should be created with read, write and execute permissions only for the user:

Code:
drwx------ 101 bsmith bsmith 8192 Nov 9 17:53 bsmith
In the event that somebody was able to get a password for a user account, this would make it extremely difficult to browse other users' files for possible information like passwords. It will also keep legitimate users from poking around in other people's directories. Of course, one user account may be all that's needed in order to gain root privileges. This can be done by exploiting known bugs. Remember, we're trying to make it more difficult, but 100% secure is never possible.

If It Isn't Permitted, It's Prohibited

Running a Linux system should never be compared with a democracy. The root user is the dictator. What he or she permits, is allowed. What isn't allowed doesn't come up for debate. It's prohibited. If you're the root user and you've just set up a system, the first thing you should do is go over to /etc and open up the hosts.deny file. Place the following line in it, if it isn't in there already. This should probably be the only line in the file, apart from comments:

Code:
ALL : ALL
This establishes from the outset that nobody can do anything. That is, we're denying ALL to ALL. Now we can start to give access to certain hosts and users via hosts.allow

Giving access to services in hosts.allow can be service based, host/ip based or both. For example, if you wanted to permit logins to pickup mail via IMAP, you could add this to your hosts.allow:

Code:
imapd: ALL
Since you may have roaming users, it would be impossible to know where they might be at any given moment. They may be getting their connection from a hotel or an public wireless point at an airport, for example. This would let anybody from anywhere login (or at least try to login) to the IMAP daemon. Since mail passwords are often sent in the clear, this is potentially a security breach if your users had the same password for mail pickup as they do for their accounts. Their password could be sniffed and an attacker could gain a foothold in the system via a user account. This, of course, doesn't have to happen. We could, for example, set up a mail system that uses virtual accounts instead of real ones, keeping the user accounts and the mail accounts separate. Virtual mail accounts would also keep you from having to give user accounts on the system altogether. A mail system with virtual accounts can be very useful and is something we'll deal with in a separate section of this advanced course.

There are also measures that we can take in the hosts.allow file itself that would slow at attacker down. We could limit access by hostname or IP to other services by adding the following lines to your hosts.allow.


Code:
# acmeisp.com = Bob's ISP
# 333.444.555.666 = Janet's home IP
# 987.654.321.001 = Dave the outside consultant
ALL : 192.168., .acmeisp.com, 333.444.555.666, 987.654.321.001


I always find it a good idea to add little comments about who belongs to these IPs and hosts. If you ended up up, say, ending your contract with Dave, the outside consultant, you don't really want him having access to the machine anymore. With these comments you can more easily keep track of what people should be accessing and who should be removed. Sure, it's a little bit more work, but security is only as good as the work you put into it. Believe me, attackers have more time on their hands than you, so any extra work is worth the trouble.

We've secured our machine as best we can with the default tools and files available, but it still isn't good enough. What we can do now, other than un-plugging our machine when we're not using it, is to set up a top-notch firewall.
 


Trenix25

New Member
Does su still ignore the wheel group?
It did years ago in the version of Linux that I was using. This made it possible for anyone knowing the root password to become root, and without using a securetty. So I used chown root:wheel su, and chmod 4110 su to fix this.
 

Pratham

New Member
In linux, an external anti-virus software can stop attack of virus or other malwares ?

Or

Linux in-built security is enough for them ?
 

atanere

Well-Known Member
In linux, an external anti-virus software can stop attack of virus or other malwares ?

Or

Linux in-built security is enough for them ?
Some people have different views on this, but most folks I know do not use any anti-virus programs on Linux. Most viruses are written specifically for Windows, and those cannot infect Linux. If you run your own email server, or Samba file server, you might be more likely to use an anti-virus app to identify those Windows viruses that might pass through your system.

If you are really paranoid about this, one of the safest ways to surf the web is to boot up a Linux live DVD and run from that. The DVD is "closed" after burning, so nothing can infect it (don't mount any physical hard drives or they could be exposed).

If you want to run anti-virus on an installed Linux, then ClamAV is probably a pretty good choice. You might consider RKHunter also to protect against root kits.

Cheers
 

Pratham

New Member
Some people have different views on this, but most folks I know do not use any anti-virus programs on Linux. Most viruses are written specifically for Windows, and those cannot infect Linux. If you run your own email server, or Samba file server, you might be more likely to use an anti-virus app to identify those Windows viruses that might pass through your system.

If you are really paranoid about this, one of the safest ways to surf the web is to boot up a Linux live DVD and run from that. The DVD is "closed" after burning, so nothing can infect it (don't mount any physical hard drives or they could be exposed).

If you want to run anti-virus on an installed Linux, then ClamAV is probably a pretty good choice. You might consider RKHunter also to protect against root kits.

Cheers
OK , boss !!!!:):):)
 

Members online

No members online now.

Latest posts

Top