Securing inetd, hosts.allow, and hosts.deny

Do we want to let people in ?

tcp_wrappers:
First lets open /etc/inetd.conf

Here's an example inetd.conf from my desktop box.

# /etc/inetd.conf
# See "man 8 inetd" for more information.
#
# If you make changes to this file, either reboot your machine or send the
# inetd a HUP signal:
# Do a "ps x" as root and look up the pid of inetd. Then do a
# "kill -HUP ".
# The inetd will re-read this file whenever it gets that signal.
#

#
#
# The first 4 services are really only used for debugging purposes, so
# we comment them out since they can otherwise be used for some nasty
# denial-of-service attacks. If you need them, uncomment them.
# echo stream tcp nowait root internal
# echo dgram udp wait root internal
# discard stream tcp nowait root internal
# discard dgram udp wait root internal
# daytime stream tcp nowait root internal
# daytime dgram udp wait root internal
# chargen stream tcp nowait root internal
# chargen dgram udp wait root internal
#time stream tcp nowait root internal
#time dgram udp wait root internal
#
# These are standard services.
#

#ftp stream tcp nowait root /usr/sbin/tcpd wu.ftpd -l -i -a
#telnet stream tcp nowait root /usr/sbin/tcpd in.telnetd
#ssh stream tcp nowait root /usr/sbin/tcpd /usr/sbin/sshd -i
#
# Use this one instead if you want to snoop on telnet users (try to use this
# for ethical purposes, ok folks?), and see 'man ttysnoop' and /etc/snooptab
# for further instructions:
# telnet stream tcp nowait root /usr/sbin/tcpd in.telnetsnoopd
#
# This is for BSD sendmail. NOTE: It's not a good idea to uncomment this
# one, since sendmail is already set up to run as a daemon in /etc/rc.d/rc.M.
# But, if you really want to run sendmail this way for some reason, you'll
# need to uncomment the smtp line below AND change the line in /etc/rc.d/rc.M
# to run sendmail like this: /usr/sbin/sendmail -q30m
# ...otherwise the queue will not be processed.
# smtp stream tcp nowait root /usr/sbin/tcpd sendmail -bs
#
# The comsat daemon notifies the user of new mail when biff is set to y:
#comsat dgram udp wait root /usr/sbin/tcpd in.comsat
#
# Shell, login, exec and talk are BSD protocols.
#
#shell stream tcp nowait root /usr/sbin/tcpd in.rshd -L
#login stream tcp nowait root /usr/sbin/tcpd in.rlogind
# exec stream tcp nowait root /usr/sbin/tcpd in.rexecd
# talk dgram udp wait root /usr/sbin/tcpd in.talkd
#ntalk dgram udp wait root /usr/sbin/tcpd in.talkd
#
# Kerberos authenticated services
#
# klogin stream tcp nowait root /usr/sbin/tcpd rlogind -k
# eklogin stream tcp nowait root /usr/sbin/tcpd rlogind -k -x
# kshell stream tcp nowait root /usr/sbin/tcpd rshd -k
#
# Services run ONLY on the Kerberos server
#
# krbupdate stream tcp nowait root /usr/sbin/tcpd registerd
# kpasswd stream tcp nowait root /usr/sbin/tcpd kpasswdd
#
# Pop et al
#
# pop2 stream tcp nowait root /usr/sbin/tcpd in.pop2d
#pop3 stream tcp nowait root /usr/sbin/tcpd in.pop3d
# The ipop3d POP3 server is part of the Pine distribution. If you've
# installed the Pine package, you may wish to switch to ipop3d by
# commenting out the pop3 line above, and uncommenting the pop3 line below.
# pop3 stream tcp nowait root /usr/sbin/tcpd ipop3d
#imap2 stream tcp nowait root /usr/sbin/tcpd imapd
#
# The Internet UUCP service.
#
# uucp stream tcp nowait uucp /usr/sbin/tcpd /usr/lib/uucp/uucico -l
#
# Tftp service is provided primarily for booting. Most sites
# run this only on machines acting as "boot servers."
#
# tftp dgram udp wait nobody /usr/sbin/tcpd in.tftpd
# bootps dgram udp wait root /usr/sbin/in.bootpd in.bootpd
#
# Finger, systat and netstat give out user information which may be
# valuable to potential "system crackers." Many sites choose to disable
# some or all of these services to improve security.
# Try "telnet localhost systat" and "telnet localhost netstat" to see that
# information yourself!
#
#finger stream tcp nowait nobody /usr/sbin/tcpd in.fingerd -u
# systat stream tcp nowait nobody /usr/sbin/tcpd /bin/ps -auwwx
# netstat stream tcp nowait root /usr/sbin/tcpd /bin/netstat -a
#
# Ident service is used for net authentication
auth stream tcp wait nobody /usr/sbin/in.identd in.identd -w -t120 -l
#
# These are to start Samba, an smb server that can export filesystems to
# Pathworks, Lanmanager for DOS, Windows for Workgroups, Windows95, Lanmanager
# for Windows, Lanmanager for OS/2, Windows NT, etc.
# If you're running smbd and nmbd from daemons in /etc/rc.d/rc.samba, then you
# shouldn't uncomment these lines.
# netbios-ssn stream tcp nowait root /usr/sbin/smbd smbd
# netbios-ns dgram udp wait root /usr/sbin/nmbd nmbd
#
# Sun-RPC based services.
#
#
# rstatd/1-3 dgram rpc/udp wait root /usr/sbin/tcpd rpc.rstatd
# rusersd/2-3 dgram rpc/udp wait root /usr/sbin/tcpd rpc.rusersd
# walld/1 dgram rpc/udp wait root /usr/sbin/tcpd rpc.rwalld
#
# End of inetd.conf.



Notice how everything has a hash mark/comment the '#' sign in front of it except for the auth server(inetd). This is my desktop, I don't need any daemons or services other than auth(man inetd) running on this box. Ya must look at it this way, if they(crackers) can't get in... they can't do any harm. I suggest until you learn more about certain types of services listed in this default inetd.conf and adding your own lines to inetd.conf you just comment(put a # in front of every line) except auth.

A brief explaination of how inetd works: To do this lets take a look at say the sshd line in this inetd.conf...


#ssh stream tcp nowait root /usr/sbin/tcpd /usr/sbin/sshd -i



So we have the service, socket type this service uses, protocol this service uses, flags(see the inetd manual page), what user will run the service, then the next line is /usr/sbin/tcpd. tcpd a.k.a. tcp_wrappers is used as an "access control facility for internet services". Then next we have the actually binary( sometimes a symlink to the binary) that does all the magic to make this service happen. But lets go back to tcpd(tcp_wrappers). How tcpd a.k.a. tcp_wrappers works is when a connection is made to say port 22 (the standard port for ssh) the remote hosts first has to make a 'handshake' with tcpd, tcpd looks to /etc/hosts.allow and /etc/hosts.deny; now say the host trying to connect in in /etc/hosts.deny guess what happens ? The connection is refused, otherwise tcpd says "Ok you're free to move on", then passes the connection to the appropriate server program(in this case /usr/sbin/sshd) and goes away. See the manual page for tcpd.

Now we'll look at /etc/hosts.allow and /etc/hosts.deny. And you guessed it! /etc/hosts.allow are hosts that are allowed to connect to said services using tcp_wrappers and /etc/hosts.deny are host that aren't allowed to connect to said services using tcp_wrappers.

Let's look at my /etc/hosts.deny


# /etc/hosts.deny
ALL:ALL EXCEPT localhost:DENY

#EOF



This is pretty simple to understand actually.
ALL:ALL specifies that noone is allowed to connect
EXCEPT localhost
Then DENY is just an extra flag, it's not needed but ensures much sharper tcp_wrappers functions.

So Noone is allowed to connect to any services on this box but localhost (127.0.01).

Now lets look at my /etc/hosts.allow


#/etc/hosts.allow

#Allow localhost
ALL : 127.0.0.1

# Allow my other box tr0n to connect to any service
ALL : 192.168.1.2

# Let everyone ssh here except 192.168.1.3 and 192.168.1.4
sshd: ALL EXCEPT 192.168.1.3, 192.168.1.4 .microsoft.com : ALLOW

#EOF



First line allow any connection to any services from localhost Second line allow any connections to any services from 192.168.1.2 Third line, this one may have confused you... Allow anyone from anywhere to connect to and use the ssh service EXCEPT 192.168.1.3, 192.168.1.4, and anyone coming from the domain of microsoft.com.

See the manuall page for hosts.allow and hosts.deny

Read more!

Securing file permissions

The default permissions set by a Linux distro during the install are fairly good. Still, we can apply some less permissive permissions to keep non-root users from accessing administrator utilities/files. If you choose to apply this option, we you remove world read/write/execute access from a large number of system utilities/files that we feel only administrators should have access to.

Here is a list of some file permissions that should be made to make your system more secure... Please see the manual page for chown and chmod!


Some of these groups may not exist on your system you can either create them, or just use root in place. Also some of these files may not exist on your system. Big deal : P


Note: Linux-Mandrake users can choose high security
settings inside DrakConf to have the settings below.


/bin/ root.root 711
/boot/ root.root 700
/dev/ root.root 711
/dev/audio* root.audio 600
/dev/dsp* root.audio 600
/etc/ root.adm 711
/etc/conf.modules root.adm 640
/etc/cron.daily/ root.adm 750
/etc/cron.hourly/ root.adm 750
/etc/cron.monthly/ root.adm 750
/etc/cron.weekly/ root.adm 750
/etc/crontab root.adm 640
/etc/dhcpcd/ root.adm 750
/etc/dhcpcd/* root.adm 640
/etc/esd.conf root.audio 640
/etc/ftpaccess root.adm 640
/etc/ftpconversions root.adm 640
/etc/ftpgroups root.adm 640
/etc/ftphosts root.adm 640
/etc/ftpusers root.adm 640
/etc/gettydefs root.adm 640
/etc/hosts.allow root.adm 640
/etc/hosts.deny root.adm 640
/etc/hosts.equiv root.adm 640
/etc/inetd.conf root.adm 640
/etc/rc.d/init.d/ root.adm 750
/etc/rc.d/init.d/syslog root.adm 740
/etc/inittab root.adm 640
/etc/ld.so.conf root.adm 640
/etc/lilo.conf root.adm 600
/etc/modules.conf root.adm 640
/etc/motd root.adm 644
/etc/printcap root.lp 640
/etc/profile root.root 644
/etc/rc.d/ root.adm 640
/etc/securetty root.adm 640
/etc/sendmail.cf root.adm 640
/etc/shutdown.allow root.root 600
/etc/ssh_config root.root 644
/etc/ssh_host_key root.adm 640
/etc/ssh_host_key.pub root.adm 644
/etc/sshd_config root.adm 640
/etc/syslog.conf root.adm 640
/etc/updatedb.conf root.adm 640
/home/ root.adm 751
/home/* current 700
/lib/ root.adm 751
/mnt/ root.adm 750
/root/ root.root 700
/sbin/ root.adm 751
/tmp/ root.root 1777
/usr/ root.adm 751
/usr/* root.adm 751
/usr/X11R6/ root.xgrp 751
/usr/bin/ root.adm 751
/usr/bin/* root.root 755
/usr/sbin/ root.adm 751
/usr/sbin/* root.root 755
/var/ root.root 755
/var/log/ root.root 711
/var/log/* root.root 600
/var/spool/mail/ root.mail 771

Dig deeper into this subject because in a lot of cases this is what stands between you and you're box getting 0wn3d.

Read more!

Securing Sendmail

This article focuses on security issues that pertain to most Linux servers in a production environment. Therefore, securing a mail or relay server is out of scope for this article since not all Linux servers in a production environment are mail or relay servers. However, Sendmail or Postfix is usually required for local mail delivery. Note that it is recommended to use Postfix over Sendmail for various security reasons, see Securing Postfix for more information.
On newer Linux systems Sendmail is configured to run in the background for local mail delivery and not to accept incoming network connections. If your server is not a mail or relay server, then it is important that Sendmail is not accepting incoming network connections from any host other than the local server.

The default sendmail.cf configuration file on RedHat does not allow Sendmail to accept incoming network connections. The following setting in /etc/mail/sendmail.cf tells Sendmail not to accept incoming network connections from servers other than the local node:

O DaemonPortOptions=Port=smtp,Addr=127.0.0.1, Name=MTA


If that's not the case on your system, you can change it by setting or uncommenting the DAEMON_OPTIONS parameter in the /etc/mail/sendmail.mc file. Uncomment the DAEMON_OPTIONS line in /etc/mail/sendmail.mc to read:

DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA')dnl
Then run:

# mv /etc/mail/sendmail.cf /etc/mail/sendmail.cf.old
# m4 /etc/mail/sendmail.mc > /etc/mail/sendmail.cf
# /etc/init.d/sendmail restart


To verify whether Sendmail is still listening for incoming network request, you can run one of the following commands from another node (make sure that you have permissions to probe a machine):

# nmap -sT -p 25
# telnet 25

Don't run these commands on the local host since Sendmail is supposed to accept connections from the local node.

Read more!

Securing Postfix

Postfix is a replacement for Sendmail which has several security advantages over Sendmail. Postfix consists of several small programs that perform their own small task. And almost all programs run in a chroot jail. These are just a few examples why Postfix is recommended over Sendmail. For more information on chroot jail, see Using Chroot Securely.
Linux servers that are not dedicated mail or relay servers should not accept external emails. However, it is important for production servers to send local emails to a relay server.

Before you continue on a Red Hat system, make sure Postfix is activated using the following command:

# alternatives --set mta /usr/sbin/sendmail.postfix


The following parameters in /etc/postfix/main.cf should be set to ensure that Postfix accepts only local emails for delivery:

mydestination = $myhostname, localhost.$mydomain, localhost
inet_interfaces = localhost

The parameter mydestination lists all domains to receive emails for.
The parameter inet_interfaces specifies the network to liston on.

Once you've configured Postfix, restart the mail system with the following command:

# /etc/init.d/postfix restart


To verify whether Postfix is still listening for incoming network request, you can run one of the following commands from another node:

# nmap -sT -p 25
# telnet 25

Don't run these commands on the local host since Postfix is supposed to accept connections from the local node.

If you believe that I should cover other parameter(s) or if you think that other parameter(s) should explicitly be set/changed for local mail delivery, please drop me an email.

Read more!

Securing SSH

Many network services like telnet, rlogin, and rsh are vulnerable to eavesdropping which is one of several reasons why SSH should be used instead. Red Hat's default configuration for SSH meets the security requirements for many environments. However, there are a few parameters in /etc/ssh/sshd_config that you may want to change on RHEL and other Linux systems.

PermitRootLogin no

Also ensure to have privilege separation enabled where the daemon is split into two parts. With privilege separation a small part of the code runs as root and the rest of the code runs in a chroot jail environment. Note that on older RHEL systems this feature can break some functionality, for example see Preventing Accidental Denial of Service.

UsePrivilegeSeparation yes

Since SSH protocol version 1 is not as secure you may want to limit the protocol to version 2 only:

Protocol 2

You may also want to prevent SSH from setting up TCP port and X11 forwarding if you don't need it:

AllowTcpForwarding no
X11Forwarding no

Ensure the StrictModes directive is enabled which checks file permissions and ownerships of some important files in the user's home directory like ~/.ssh, ~/.ssh/authorized_keys etc. If any checks fail, the user won't be able to login.

StrictModes yes


Ensure that all host-based authentications are disabled. These methods should be avoided as primary authentication.

IgnoreRhosts yes
HostbasedAuthentication no
RhostsRSAAuthentication no


Disable sftp if it's not needed:

#Subsystem sftp /usr/lib/misc/sftp-server


After changing any directives make sure to restart the sshd daemon:

/etc/init.d/sshd restart

Read more!

Restricting System Access from Servers and Networks

Usually a firewall is used to protect a server from other servers and networks. However, in some cases you may also want to protect a server within a network by using a TCP Wrapper.
The Xinetd super server that comes with most Linux distributions includes a built-in TCP wrapper. It can be used to explicitly define network services to accept incoming connections from specified servers and networks. The TCP wrappers implements access control through the use of two files, /etc/hosts.allow and /etc/hosts.deny. Note that the hosts.allow file takes precedence over the hosts.deny file. And you may want to change the permissions on the two configuration files since they are both world readable.

A recommended security-strategy is to block all incoming requests by default, but allow specific hosts or networks to connect. This is the strategy I will describe here.

To deny everything by default, add the following line to /etc/hosts.deny:

ALL: ALL

To accept incoming SSH connections from e.g. nodes rac1cluster, rac2cluster and rac3cluster, add the following line to /etc/hosts.allow:

sshd: rac1cluster rac2cluster rac3cluster

To accept incoming SSH connections from all servers from a specific network, add the name of the subnet to /etc/hosts.allow. For example:

sshd: rac1cluster rac2cluster rac3cluster .subnet.example.com

To accept incoming portmap connections from IP address 192.168.0.1 and subnet 192.168.5, add the following line to /etc/hosts.allow:

portmap: 192.168.0.1 192.168.5.

To accept connections from all servers on subnet .subnet.example.com but not from server cracker.subnet.example.com, you could add the following line to /etc/hosts.allow:

ALL: .subnet.example.com EXCEPT cracker.subnet.example.com

Here are other examples that show some features of TCP wrapper:

If you just want to restrict ssh connections without configuring or using /etc/hosts.deny, you can add the following entries to /etc/hosts.allow:

sshd: rac1cluster rac2cluster rac3cluster
sshd: ALL: DENY


The version of TCP wrapper that comes with Red Hat also supports the extended options documented in the hosts_options(5) man page. Here is an example how an additional program can be spawned in e.g. the /etc/hosts.allow file:

sshd: ALL : spawn echo "Login from %c to %s" mail -s "Login Info for %s" log@loghost

For information on the % expansions, see "man 5 hosts_access".

The TCP wrapper is quite flexible. And xinetd provides its own set of host-based and time-based access control functions. You can even tell xinetd to limit the rate of incoming connections. I recommend reading various documentations about the Xinetd super daemon on the Internet.

Read more!

Reviewing Inittab and Boot Scripts

The inittab file /etc/inittab also describes which processes are started at bootup and during normal operation. For example, Oracle uses it to start cluster services at bootup. Therefore, it is recommended to ensure that all entries in /etc/inittab are legitimate in your environment.

I would at least remove the CTRL-ALT-DELETE trap entry to prevent accidental reboots:

# sed -i 's/ca::ctrlaltdel:/#ca::ctrlaltdel:/g'


The default runlevel should be set to 3 since in my opinion X11 (X Windows System) should not be running on a production server. In fact, it shouldn't even be installed.

# grep ':initdefault' /etc/inittab
id:3:initdefault:
#

And depending on your environment you might want to comment out the UPS entries as well.

To have changes in /etc/inittab become effective immediately, you can run:

# init q


The /etc/rc.local script is used for commands or startup scripts which are pertinent only to a specific server. (/etc/rc.local is a link to /etc/rc.d/rc.local).
Ensure that all startup scripts in /etc/rc.d/rc.local are legitimate.

Read more!

Closing Network Ports and Disabling Xinetd Services

The xinetd daemon is a replacement for inetd, the internet services daemon. It monitors the ports for all network services configured in /etc/xinetd.d, and starts the services in response to incoming connections.

To check if xinetd is enabled and running, execute:
# chkconfig --list xinetd
xinetd 0:off 1:off 2:off 3:on 4:on 5:on 6:off
# /etc/init.d/xinetd status
xinetd (pid 2619) is running...
#


If xinetd is active, it is important to check which Unix services are active and controlled by xinetd. The following command shows all services configured in /etc/xinetd.d and wheter xinetd monitors the ports for these services:

# chkconfig --list awk '/xinetd based services/,/""/'
xinetd based services:
krb5-telnet: off
rsync: off
eklogin: off
gssftp: off
klogin: off
chargen-udp: off
kshell: off
auth: on
chargen: off
daytime-udp: off
daytime: off
echo-udp: off
echo: off
services: off
time: off
time-udp: off
cups-lpd: off
#

To get a list of only active services for which xinetd monitors the ports, you could run:

# chkconfig --list awk '/xinetd based services/,/""/' grep -v off
xinetd based services:
auth: on
#

In the above example you can see that the telnet-server RPM is not installed on the system. If the Telnet Server package telnet-server would be installed, it would show up on the list whether it's active or not.

Here is an example how to disable a service. Assuming the telnet service is active, run the following commands to disable it and to see how the telnet service entries are being updated:

# chkconfig --list telnet
telnet on
# cat /etc/xinetd.d/telnet grep disable
disable = no
# chkconfig telnet off
# chkconfig --list telnet
telnet off
# cat /etc/xinetd.d/telnet grep disable
disable = yes
#

For the telnet service it would be better to remove the package from the system since SSH should be used instead:
# rpm -e telnet-server


It is important to investigate all active xinetd services and to disable them if they are not needed.

Here is an example how to find out what a service does. Assuming you don't know what the auth service does which is listed as active in the list above, run the following commands:

# grep " server" /etc/xinetd.d/auth
server = /usr/sbin/in.authd
server_args = -t60 --xerror --os -E
# man in.auth
No manual entry for in.auth
# rpm -qf /usr/sbin/in.authd
authd-1.4.1-1.rhel3
# rpm -qi authd-1.4.1-1.rhel3 awk '/Description/,/""/'
Description :
authd is a small and fast RFC 1413 ident protocol daemon
with both xinetd server and interactive modes that
supports IPv6 and IPv4 as well as the more popular features
of pidentd.
# rpm -ql authd-1.4.1-1.rhel3
/etc/ident.key
/etc/xinetd.d/auth
/usr/sbin/in.authd
/usr/share/doc/authd-1.4.1
/usr/share/doc/authd-1.4.1/COPYING
/usr/share/doc/authd-1.4.1/README.html
/usr/share/doc/authd-1.4.1/rfc1413.txt
/usr/share/locale/ja/LC_MESSAGES/authd.mo
#

This example shows what can be done if there exists no online manuals for the binary in.authd that is started by xinetd. The steps above should be helpful for finding out more about services.

The auth service (aka IDENT, see RFC 1413) allows remote daemons to query information about users establishing TCP connections on the local server. In a trusted environment it helps a server to identify who is trying to use it. For example, it can provide vital information for troubleshooting and who has done what. IDENT requests are needed by some applications like IRC. However, IDENT can be a security risk.

To disable the auth service, run the following command:
# chkconfig auth off

The xinetd daemon is quite flexible and has many features. Here are just a few functionalities of Xinetd:
- Acces control for TCP, UDP, and RPC services
- Acess limitations based on time
- Provides mechanisms to prevent DoS attacks

For more information on Xinetd, see http://www.xinetd.org/

Read more!

Closing Network Ports and Disabling Runlevel System Services

One of the most important tasks is to remove any network services from the system startup process that are not needed.
On Red Hat systems you can list all services which are started at bootup using the following command:
chkconfig --list grep on
You will notice that there are quite a lot of services enabled on your system. But many runlevel services (Stand-Alone Services) are not network related services like kudzu which is responsible for detecting and configuring new and/or changed hardware on your system. This service is only run during the boot process. Ensure not to disable runlevel services that are needed by the system to run smoothly.

Here are examples of Red Hat Runlevel System Services which you may or may not want to enable:
gpm needed if you want to use the mouse at the console
kudzu important for detecting new hardware
syslog important for syslog services
netfs needed only if there are NFS shares that should be mounted at boot time
network important for starting network interfaces (e.g. eth0, eth1, bonding,...)
random used for the system entropy pool
atd needed if the at(1) service is used instead of cron
apmd Advanced Power Management (APM) daemon is used for laptops and some desktops
isdn needed if ISDN is being used
iptables needed if Netfilter (iptables) Firewall is being used
ip6tables needed if ip6tables Firewall is being used
pcmcia not needed on servers - needed for laptops
irqbalance important for distributing interrupts across all CPUs
sendmail needed if Sendmail is used - Procmail should be used which is more secure
autofs needed if automounter is used - production applications should not be dependent on automounter
sshd important for logins via SSH
portmap needed if e.g. NFS is being used
nfslock needed if NFS shares are mounted
nfs needed if server runs the NFS server
mdmonitor needed only if software RAID is being used
crond important for running cron jobs
xinetd needed if xinetd services are being used, see /etc/xinetd.d/ for list of services
cups needed if CUPS is used for the printing system
rhnsd needed if server should connect to RHN to check for software updates etc.
sysstat needed to reset system statistics logs
audit needed only if Linux Audit Subsystem (LAuS) should run for collecting system call audit records
psacct needed only if kernel process accounting information is needed
smartd important for monitoring disk problems if hard disks support SMART technology
netdump important if kernel oops data and memory dumps should be sent to a Netdump server for server crashes


The start/stop scripts of all runlevel services can be found in the /etc/init.d directory. For example, if you don't know what the atd service does, go to /etc/init.d and open the file atd. And in the script look for lines that start programs. In the atd script the "daemon /usr/sbin/atd" line starts the binary atd. Now having the name of the program that is started by this service, you can check the online pages of atd by running man atd. This will help you to find out more about a system service.

To permanently disable e.g. the runlevel service nfs, run:
chkconfig nfs off
To immediately disable the runlevel service nfs, run:
/etc/init.d/nfs stop

Read more!

Removing Unnecessary Software Packages (RPMs)

A very important step in securing a Linux system is to determine the primary function or role of the Linux server. You should have a detailed knowledge of what is on your system. Otherwise you will have a difficult time to understand what needs to be secured and hence securing your Linux systems proactively won't be that effective. Therefore, it is very critical to look at the default list of software packages and remove unneeded packages or packages that don't comply with your security policy. If you do that you will have less packages to update and to maintain when security alerts and patches are released.

For example, you should not have Apache or Samba installed on your system if you don't use them. Also, it is a good practice not to have development packages, desktop software packages (e.g. X Server) etc. installed on production servers. Other packages like FTP and Telnet daemons should not be installed as well unless there is a justified business reason for it (SSH/SCP/SFTP should be used instead).

One of the first action items should be to create a Linux image that only contains RPMs needed by the applications, and needed for maintenance and troubleshooting purposes. A good approach is to start with a minimum list of RPMs and then add packages as needed. It may be time-consuming but worth the efforts.

To get a list of all installed RPMs you can use the following command:
rpm -qa
If you want to know more about a particular RPM, run:
rpm -qi

To check for and report potential conflicts and dependencies for deleting a RPM, run:
rpm -e --test

For information on performing Kickstart installations and how to build an image, see Kickstart Installations for more information.

Read more!

ZoneMinder-1.23.3.tar.gz

ZoneMinder is a suite of applications intended for use in video camera security applications, including theft prevention and child or family member monitoring. It supports capture, analysis, recording, and monitoring of video data coming from one or more cameras attached to a Linux system. It also features a user-friendly Web interface which allows viewing, archival, review, and deletion of images and movies captured by the cameras. The image analysis system is highly configurable, permitting retention of specific events, while eliminating false positives.
ZoneMinder supports both directly connected and network cameras and is built around the definition of a set of individual 'zones' of varying sensitivity and functionality for each camera. This allows the elimination of regions which should be ignored or the definition of areas which will alarm if various thresholds are exceeded in conjunction with other zones. All management, control, and other functions are supported through the Web interface.

ZoneMinder-1.23.3.tar.gz

Read more!

pam_p11-0.1.4.tar.gz

Pam_p11 is a pluggable authentication module (PAM) package for using cryptographic tokens such as smart cards and USB crypto tokens for authentication. Pam_p11 is very simple, as it has no config file, no options other than the PKCS#11 module file, and does not know about certificate chains, certificate authorities, revocation lists, or OCSP. There is one module that uses the $HOME/.eid/authorized_certificates file (like the old pam_opensc did) and one module that uses the $HOME/.ssh/authorized_keys file (like ssh does).

Download Here

Read more!