Chapter 14 Linux Security 443

finger

This command is used to find out information about a particular user or host. You should disable the finger service because it allows an outside user to gain valuable information about your system. Disable the service in the inetd.conf file, specifically the daemons fingerd and cfingerd.

nmap

nmap is a special utility that you can use to see what open ports you have on your system. Commonly called a port scanner, you can use it to determine what services you are currently enabling for the outside world. This tool is very useful because it lets you know exactly what services you are providing from your system. You can then decide which ones you want to keep, and then disable the others that aren’t being used, which pose a security risk.

Securing a Web server

The most widely used Web server for Linux is the Apache Web server. It currently runs on approximately 60 percent of all Web servers on the Internet. Web server attacks have become increasingly common in the last few years, and hacking or disabling a Web site has become an everyday occurrence. To prevent this from happening, there are number of precautions that you can take to protect your web server.

Apache versions

You must ensure that you are using the most recent version of Apache. The most recent version, as of July 2001, is 1.3.20. You can always obtain the latest release of Apache from www.apache.org.

Modifying httpd.conf

The configuration file for Apache is usually located in /usr/local/apache/conf/ httpd.conf, or in /etc/httpd/conf/httpd.conf. You can modify a number of settings to make your server more secure than the default installation.

User/Group

The httpd.conf configuration file contains a user and group directive, which tells the Apache Web server which server to use when running its service daemon. By default, these directives are set to nobody, which is a special user with only limited rights. You can set the user to anyone, but this poses a security risk. If you run the Web server as user root, malicious users may be able to gain root access to your machine via the Web server. If you need to switch it from the default, ensure that the user has only read and execute permissions for only your Web directories.

DocumentRoot

This directive sets the initial root directory for your Web pages. Ensure that this value is not a different directory. For example, if it is set to /etc, any user connecting to the Web server is able to see all the system configuration files.

444 Part V Maintaining the Linux System

Indexes

By removing the indexes directive, you can prevent users from seeing an index of a directory if they access a URL that doesn’t point to a specific document.

CGI scripts

Some default installations of Apache come with a set of example CGI scripts. Delete these because some of these scripts contain known security holes.

Modules

Apache comes with a system of loadable modules for extra functionality, which you can add and remove as needed. Ensure that only the modules that you need are loaded, and remove all others. Having extra modules increases the complexity of your system, and thereby increases the number of possible security holes.

Securing an FTP server

Along with Web servers, FTP servers are one of the most popular applications that can be easily run from Linux. Unfortunately, many FTP server software configurations contain a number of security holes that can be easily compromised. There are a number of ways in which you can increase security for your FTP server — especially by utilizing the FTP configuration files to reduce the risk of being compromised.

FTP program version

Ensure that you are using the most recent version of your FTP server. The most recent release will always have updated security patches that have fixed previous holes in the system. Check the website of your particular Linux distribution, or the web page of the FTP program you are using for the most recent updates.

FTP configuration files

The FTP daemon uses several configuration files to control access to the FTP server. Adding and removing certain users from these files will greatly enhance the security on your system because you can ensure that only a select group of user accounts can get access. These files are located in the /etc directory.

ftpusers

This file contains a list of user names that are not allowed to log in to the FTP server (this file is usually blank by default). Copy all special accounts (such as root, bin, daemon, adm, lp, sync, shutdown, halt, mail, news, uucp, operator, games, gopher, ftp, nobody, lists, and xfs) so they can’t access FTP services.

Chapter 14 Linux Security 445

ftphosts

This file allows access to the FTP server from a selected set of hosts. They can be identified either by IP addresses or hostnames. The default file is blank, which allows any host to access the system. For example, if you want to give access to only machines from your own domain, add the following line to the ftphosts file:

allow * *.mycompany.com

You can also deny specific hosts by using the deny command within the configuration file:

deny * *.hackers.org

Anonymous users

Depending on your FTP server setup, you may not want anonymous users to have access, especially if the FTP files are for your company use only. Disable the anonymous account, which is usually the ftp user.

The most vulnerable applications are any type of Internet application, such as Web and FTP servers. They are the most commonly hacked services, and therefore, you must give special attention to the security of these systems.

Process security

5.13 Set daemon and process permissions (e.g., SUID - SGID - Owner/groups)

Every process and daemon that is running on your system employs a user ID to create its permission base. Many important system services need to use the root user ID to perform their functions, which may involve killing and starting other processes. Other less important daemons employ user IDs with limited rights, such as nobody or daemon.

Any service or daemon running as a root user poses a security risk to your system. If that service can be interrupted or be directed to perform other activities not related to its function, it will do so as the root user. Effectively, this gives the unauthorized person control of the daemon root access to your machine.

Ensure that all services and daemons are using the most appropriate user ID for their function, and that they have the least amount of permission rights possible.

Set-user-ID permission (SUID) is a special permission that can be set on executable files. It allows any user that is executing the file to run that file as if they were the file’s owner. The Set-Group-ID permission (GUID) performs the same function, but for groups.