Linux Security: Tips from the Experts - Page 2

Don't Place the Cart Before the Security Horse

Effective IT security depends first and foremost on sound secuirty policies, Dennis emphasizes. "Policies are requirements. They should be part of your broader requirements analysis."

The following policies should be "implicit," Dennis says:

• The system should only run MY software, executed by and for MY users
  


• Files can only be created/written/read by and for authorized users
  


• Files must be available whenever — and from wherever — I want

However, policies alone, of course, are not enough. "Policy docs don't implement. The map is not the terrain," cautions Dennis.

Eliminate What You Don't Need and Restrict the Rest

Dennis recommends installing from either a clean CD or an isolated LAN. Services that aren't needed should be eliminated. Even if you do need a service, you should place appropriate restrictions on its use.

Here's how to disable Linux services, according to Dennis:

• First, find them:  netstat -nlp -inet
  


• Next, disable them:  chconfig $SERVICE off
  


• To edit them:  inetd.conf  OR  xinetd.d/*
  


• Finally, double-check with:  nmap (from remote machine)

You can restrict access in several ways:

• Bind services to specific interfaces, via their config files
  


• Use the hosts.allow command
  


• Implement belts and suspenders such as ipchains, iptables, and ipfwadm

Page 3: Bastille, Tripwire, AIDE, and Samhain