1

If other alternatives are unavailable, this can be accomplished by installing a SOHO router/firewall in between the network and the host to be protected.

4

If you decide to utilize SSH, the ISO highly recommends the following:

• Change the port from port 22 to something/anything else. There are scripts online that malicious hackers can use against an SSH server. These scripts always attack port 22 since most people do not change the default port.
• Do not allow root logins via SSH.
• If possible, use keys with passphrase instead of just passwords. To create rsa keys, follow these commands:
  
  • ssh-keygen –t rsa
    
  • ssh server “mkdir .ssh; chmod 0700 .ssh”
    
  • scp ./ssh/ida_rsa.pub server:.ssh/authorized_keys2

The CIS Solaris Benchmark covers some suggested basic settings to place in the configuration file.

You may also want to visit the SSL Web site.

5

System accounting gathers baseline system data (CPU utilization, disk I/O, etc.) every 10 minutes. The data may be accessed with the sar command, or by reviewing the nightly report files named /var/log/sa/sar*. Once a normal baseline for the system has been established, unauthorized activity (password crackers and other CPU-intensive jobs, and activity outside of normal usage hours) may be detected due to departures from the normal system performance curve.

6

The psacct package contains several utilities for monitoring process activities, including ac, lastcomm, accton, and sa.

• ac displays statistics about how long users have been logged on.
• lastcomm displays information about previously executed commands.
• accton turns process accounting on or off.
• sa summarizes information about previously executed commands.

7

Disable any xinetd services you do not absolutely require by setting “disable=yes” in /etc/xinetd.d/*. If no xinetd services are required, disable xinetd altogether (sudo service xinetd stop; sudo chkconfig xinetd off)

Configure TCP wrappers for access control.

Edit /etc/hosts.deny to include this entry as the first uncommented line in the file: ALL:ALL

Ensure /etc/hosts.allow is edited appropriately to allow the administrator(s) to connect.

Unless “r” commands (i.e., rsh, rlogin) are required, remove or empty the file /etc/hosts.equiv.

If “r” commands are required, consider replacing them with a secure alternative such as SSH.

Verify that you have disabled any unnecessary startup scripts under /etc, /etc/rc*.d, or /etc/init.d (or startup script directory for your system) and disabled any unneeded services from starting in these scripts.

Unnecessary services can be disabled with:

To check what services are listening use: 

OR

Much more detailed information regarding services is available in the CIS benchmark documents.

Red Hat also provides a text-based interface for changing startup services:

For example, the command

configures runlevels 3, 4, and 5.

8

Red Hat comes with iptables. Below is a list of some iptables resources:

http://firehol.sourceforge.net

http://sourceforge.net/projects/fwbuilder

http://www.simonzone.com/software/guarddog

9

A simple way to disable the GUI is to change the default run level. Edit the file /etc/inittab. Look for the line that contains the following:

id:5:initdefault:

Replace the “5” with “3”. The line will then read:

id:3:initdefault:

11

ITS Networking operates two stratum 2 NTPv4 (NTP version 4) servers for network time synchronization services for university network administrators.

12

Examples: syslog
Red Hat: http://www.redhat.com/docs/manuals/enterprise/RHEL-AS-2.1-Manual/cluster-manager/s1-software-syslog.html 

13

• Check in /etc/sudoers to see who has sudo rights
• Check in /etc/groups to see what groups your users belong to
• Check in /etc/passwd and/or /etc/shadow for blank passwords
• Check the strength of users’ passwords with tools such as John the Ripper
• Seek approval from IT Owner. Consider using a simple dictionary for easily guessed passwords.
• Develop a procedure to report and remediate easily guessed passwords.

14

Ensure the following are set in /etc/pam.d/other:

• auth  required pam_deny.so
• auth   required pam_warn.so
• account  required pam_deny.so
• account  required pam_warn.so
• password  required pam_deny.so
• password  required pam_warn.so
• session  required pam_deny.so
• session  required pam_warn.so
• session  required pam_deny.so

Warn will report alerts to syslog.

15

Ensure that the terminal security file (for example, /etc/securetty or /etc/ttys) is configured to deny privileged (root) access. On a Red Hat box, this means that no virtual devices (such as /dev/pty*) appear in this file.

16

The text of the university's official warning banner can be found on the ITS Web site. You may add localized information to the banner as long as the university banner is included.

18

There are few viruses that infect Linux computers; therefore, it is understandable for most Linux servers to have an exception to this rule. See the Operations Manual for information on the exception process.

You may choose any proven anti-virus product. One option is ClamAV.

19

There are few viruses that infect Linux computers; therefore, it is understandable for most Linux servers to have an exception to this rule. See the Operations Manual for information on the exception process.

20

There are a variety of methods available to accomplish this goal. Two good candidates are PGP (cost) and GNUPG (free).

21

There is a license fee for Tripwire. The Tripwire management console can be very helpful for managing more complex installations.

AIDE is a free tool available from SourceForge.

SamHain is another free tool.