Basic Security

Rob

Administrator
Staff member
Joined
Oct 27, 2011
Messages
867
Reaction score
1,667
Credits
821
Basic Security

Fortunately, Linux has a lot of built in security that it inherits from its Unix forebears. User accounts are clearly separate from each other. It's easy to configure a Linux system so that normal users have zero rights outside their own user space. The administrator or 'root' account is virtually untouchable if one doesn't have physical access to the machine and proper password and login policies are in place.


User Account Security

Root is the number one user on the system. Fortunately, root's privileges can only be shared explicitly through the use of programs like 'sudo'. Other than that, there's no way a normal user under normal circumstances can do what root can. But user accounts can also be a source of compromise and they need to be made secure. We can start by making sure that user directories are accessible only to the owner of the account. To do this, directories should be created with read, write and execute permissions only for the user:

Code:
drwx------ 101 bsmith bsmith 8192 Nov 9 17:53 bsmith

In the event that somebody was able to get a password for a user account, this would make it extremely difficult to browse other users' files for possible information like passwords. It will also keep legitimate users from poking around in other people's directories. Of course, one user account may be all that's needed in order to gain root privileges. This can be done by exploiting known bugs. Remember, we're trying to make it more difficult, but 100% secure is never possible.

If It Isn't Permitted, It's Prohibited

Running a Linux system should never be compared with a democracy. The root user is the dictator. What he or she permits, is allowed. What isn't allowed doesn't come up for debate. It's prohibited. If you're the root user and you've just set up a system, the first thing you should do is go over to /etc and open up the hosts.deny file. Place the following line in it, if it isn't in there already. This should probably be the only line in the file, apart from comments:

Code:
ALL : ALL

This establishes from the outset that nobody can do anything. That is, we're denying ALL to ALL. Now we can start to give access to certain hosts and users via hosts.allow

Giving access to services in hosts.allow can be service based, host/ip based or both. For example, if you wanted to permit logins to pickup mail via IMAP, you could add this to your hosts.allow:

Code:
imapd: ALL

Since you may have roaming users, it would be impossible to know where they might be at any given moment. They may be getting their connection from a hotel or an public wireless point at an airport, for example. This would let anybody from anywhere login (or at least try to login) to the IMAP daemon. Since mail passwords are often sent in the clear, this is potentially a security breach if your users had the same password for mail pickup as they do for their accounts. Their password could be sniffed and an attacker could gain a foothold in the system via a user account. This, of course, doesn't have to happen. We could, for example, set up a mail system that uses virtual accounts instead of real ones, keeping the user accounts and the mail accounts separate. Virtual mail accounts would also keep you from having to give user accounts on the system altogether. A mail system with virtual accounts can be very useful and is something we'll deal with in a separate section of this advanced course.

There are also measures that we can take in the hosts.allow file itself that would slow at attacker down. We could limit access by hostname or IP to other services by adding the following lines to your hosts.allow.


Code:
# acmeisp.com = Bob's ISP
# 333.444.555.666 = Janet's home IP
# 987.654.321.001 = Dave the outside consultant
ALL : 192.168., .acmeisp.com, 333.444.555.666, 987.654.321.001



I always find it a good idea to add little comments about who belongs to these IPs and hosts. If you ended up up, say, ending your contract with Dave, the outside consultant, you don't really want him having access to the machine anymore. With these comments you can more easily keep track of what people should be accessing and who should be removed. Sure, it's a little bit more work, but security is only as good as the work you put into it. Believe me, attackers have more time on their hands than you, so any extra work is worth the trouble.

We've secured our machine as best we can with the default tools and files available, but it still isn't good enough. What we can do now, other than un-plugging our machine when we're not using it, is to set up a top-notch firewall.
 


Trenix25

Member
Joined
Aug 15, 2017
Messages
67
Reaction score
15
Credits
508
Does su still ignore the wheel group?
It did years ago in the version of Linux that I was using. This made it possible for anyone knowing the root password to become root, and without using a securetty. So I used chown root:wheel su, and chmod 4110 su to fix this.
 

Pratham

New Member
Joined
Oct 25, 2017
Messages
16
Reaction score
1
Credits
0
In linux, an external anti-virus software can stop attack of virus or other malwares ?

Or

Linux in-built security is enough for them ?
 

atanere

Well-Known Member
Joined
Apr 6, 2017
Messages
2,626
Reaction score
2,760
Credits
26
In linux, an external anti-virus software can stop attack of virus or other malwares ?

Or

Linux in-built security is enough for them ?

Some people have different views on this, but most folks I know do not use any anti-virus programs on Linux. Most viruses are written specifically for Windows, and those cannot infect Linux. If you run your own email server, or Samba file server, you might be more likely to use an anti-virus app to identify those Windows viruses that might pass through your system.

If you are really paranoid about this, one of the safest ways to surf the web is to boot up a Linux live DVD and run from that. The DVD is "closed" after burning, so nothing can infect it (don't mount any physical hard drives or they could be exposed).

If you want to run anti-virus on an installed Linux, then ClamAV is probably a pretty good choice. You might consider RKHunter also to protect against root kits.

Cheers
 

Pratham

New Member
Joined
Oct 25, 2017
Messages
16
Reaction score
1
Credits
0
Some people have different views on this, but most folks I know do not use any anti-virus programs on Linux. Most viruses are written specifically for Windows, and those cannot infect Linux. If you run your own email server, or Samba file server, you might be more likely to use an anti-virus app to identify those Windows viruses that might pass through your system.

If you are really paranoid about this, one of the safest ways to surf the web is to boot up a Linux live DVD and run from that. The DVD is "closed" after burning, so nothing can infect it (don't mount any physical hard drives or they could be exposed).

If you want to run anti-virus on an installed Linux, then ClamAV is probably a pretty good choice. You might consider RKHunter also to protect against root kits.

Cheers
OK , boss !!!!:):):)
 

FrankDev

New Member
Joined
Sep 8, 2021
Messages
1
Reaction score
0
Credits
5
Some people have different views on this, but most folks I know do not use any anti-virus programs on Linux. Most viruses are written specifically for Windows, and those cannot infect Linux. If you run your own email server, or Samba file server, you might be more likely to use an anti-virus app to identify those Windows viruses that might pass through your system.

If you are really paranoid about this, one of the safest ways to surf the web is to boot up a Linux live DVD and run from that. The DVD is "closed" after burning, so nothing can infect it (don't mount any physical hard drives or they could be exposed).

If you want to run anti-virus on an installed Linux, then ClamAV is probably a pretty good choice. You might consider RKHunter also to protect against root kits.

Cheers
Nice answer!
 

SlowCoder

Member
Joined
May 2, 2022
Messages
96
Reaction score
66
Credits
791
I've noticed in Mint and Ubuntu personal distros that user home directories are granted drwxr-xr-x by default. I guess the builders think everyone at home should be able to see everyone else's data. This does not follow the Linux Principal of Least Privilege.

I believe this can be easily remedied by issuing the command
Code:
chmod -R go-rwx $HOME
Disclaimer: Someone once told me this could cause problems with authentication, (maybe XAuthority?), but I don't remember having any problems.
 

sam444

Active Member
Joined
Oct 22, 2020
Messages
216
Reaction score
188
Credits
1,654
I just enable the Firewall...never had any problems because Linux isn't windwoes.
happy0034.gif
 

SlowCoder

Member
Joined
May 2, 2022
Messages
96
Reaction score
66
Credits
791
I just enable the Firewall...never had any problems because Linux isn't windwoes.
happy0034.gif
That works for remote client systems with no servers. But once you start adding services, like sshd, things get more complicated. A firewall also doesn't account for physical access.
 

sam444

Active Member
Joined
Oct 22, 2020
Messages
216
Reaction score
188
Credits
1,654
Linux is very secure as I've found, but it also depends on the user too.
happy0039.gif
 
$100 Digital Ocean Credit
Get a free VM to test out Linux!


Top