436 Part V Maintaining the Linux System

your cage or closet is to use special keycode doors with a combination lock in place. This method, however, also suffers from some of the disadvantages of regular keys because the combination must be changed whenever an employee leaves the company. The most useful method for securing the cage or closet is magnetic swipe cards. With this method, each employee that needs access to the room has his or her own card. If an employee is terminated, that card is simply denied access to the area.

In smaller environments, you may not have room for a server room — or even a wiring closet. In order to ensure security in this case, make sure that the terminal is locked with a password so that no user passing by can access the system.

Environment

Your computer system is very susceptible to natural environmental issues, such as heat, fire, and flood. Your server location should be safe from any and all of these natural disasters. It should also be equipped with a proper air conditioning system, dehumidifier, and adequate ventilation to prevent overheating.

System Security

After you have secured your physical environment, you must take steps to secure your virtual environment. Although physical security is extremely important, unauthorized users can still access your system over the network or through a remote terminal. The following sections detail some general tips on keeping your internal system secure.

System/user files

You must ensure that your core system and application files are kept separate from your general user files and home directories. Most standard Linux installations already perform this partitioning scheme by setting up /home and the root / partition separately. Allowing only the system partitions to be accessed by the root user is an effective tool for security, and it is helpful in the event that the user directories run out of disk space because it won’t affect the system partition.

Permissions

Even within the user directories, you must take care to set up appropriate access permissions for user and group directories. Consider the example of a payroll or human resources directory, which contains sensitive personal and salary information. Even though it is within the same /home directory, such as /home/HR, its file and directory permissions can be set up so that only certain users can read and modify its contents.