| The goal is to develop an Enterprise-like SOHO Protect Strategy that will help all the DFWUUG SOHO's. Enterprise-like means it includes non-*nix platforms, as all of our SOHOs do. The *nix platforms seem to be neglected in the SOHO Protect Strategies found so far. Mac is a *nix platform.
|
| An example is "iptables". What is the basic "iptables" setup for good SOHO protection?
This would involve input from all DFWUUG members with additional input from the Linux SIG, Security SIG and Storage SIG. All help is appreciated.
|
How to get Root Rights on Linux
*nix SOHO Protect Strategy
How do we know when the SOHO Protect Strategy is "As Good as it Gets"?
*nix SOHO Protect Strategy01 - A mostly Enterprise Roadmap - not much detail - Some features apply to the SOHO
Should We All Just Use Macs? - OSX is Unix
Enterprise-like SOHO Protect Strategy (includes PC 's or mostly PC based)
How to get Root rights on Linux ?
LINUX Info diagram (linux.gif) goes here
- To protect your Linux,
- use only Linux
- use shadow password (Run pwconv as root)
- setup LILO password
- keep your Linux up-to-date
- subscribe to bugtrack mailling liste
- read the Linux Administrator Security Guide LASG and #Securing-Optimizing-Linux-RH-Edition
- Remove the services you don't use (don't forget inetd services in /etc/inetd.conf)
- Replace inetd by xinetd
- Convert your old information: itox -t /usr/sbin/ < /etc/inetd.conf > /etc/xinetd.conf
- Update your /etc/hosts.allow to reflect service name and not binary name.
- Your default policy must be deny (ALL:ALL in /etc/hosts.deny)
- Setup a firewall with a default deny policy NetFilter
- Use OpenSSH instead of telnet and configure it correctly (no X forwarding in client, limit simultaneous connection for your server)
- If you use Winx, you can get PuTTY, free win32 telnet/ssh client
- Configure your servers to run as non root (Squid,Mysql,Apache,IPLog,Bind,PostFix...)
- If you run an X server with XDM/KDM/GDM, use the last version of XFree server with Xwrapper and deny XDMCP: XDM, KDM : /etc/X11/xdm/Xaccess
- GDM : look for [security] and [xdmcp] in /etc/X11/gdm/gdm.conf
- Chrooted BIND/DNS servers
- IPLog: TCP/IP traffic logger
- Nessus: Remote Security Scanner
- Use the option "-a 127.0.0.1" to only listen to loopback interface
- Use PostFix instead of Sendmail
- Important parameters in main.cf are mydestination and relay_domains
- smtpd_banner = $myhostname ESMTP $mail_name
- Use ProFTPD instead of `Wu-FTPD
- In /etc/proftpd.conf, set
- SyslogFacility AUTH
- ExtendedLog /var/log/ftp.log AUTH
- ServerIdent Off
- Restrict crontab users with /etc/cron.allow
- NMAP port scanner
- The password cracker John The Ripper is avaible at http://www.openwall.com/john/.
- Introduction to Awk
- The Unix Shell Guide
- HTML Reference
Return to Table of Contents
*nix SOHO Protect Strategy
- Firewall - first line of defense
- Does *nix need a hardware firewall?
- Even on dial-up?
- What's a good "iptables" setup to start with?
- For Linux?
- For Unix?
- Are the Linux and Unix "iptables" the same?
- How are they different?
- Identity Management
- LDAP ?
- NIS/NIS+ ?
- Other ?
- Trusted Network and Hosts
- DHCP Configuration?
- DNS Configuration?
Return to Table of Contents
How do we know when the SOHO Protect Strategy is "As Good as it Gets"?
- Is my SOHO Protected? or Infected?
- How to determine the level of protection?
- How to test the protection level after changes to the SOHO?
Return to Table of Contents
*nix SOHO Protect Strategy01 - A mostly Enterprise Roadmap - not much detail - Some features apply to the SOHO
Return to Table of Contents
Should We All Just Use Macs? - OSX is Unix
Return to Table of Contents
Enterprise-like SOHO Protect Strategy
Return to Table of Contents
