secsh - Secure Shell - prompts the user for a password after login. www.leenux.com/scripts
System Files:
/etc/passwd
This file provides login and file information to users. It must be world readable, which means the encrypted passwords in it are world readable. This is bad! Don't think that changing permissions on the file will work, this will cause problems throughout the system. Use /usr/sbin/pwconv at the command line to create a /etc/shadow file. The /etc/shadow file is now only readable by root and contains the passwords which have been stripped from /etc/passwd along with other private information.
/etc/group and /etc/gshadow
A similar situation to the /etc/passwd file combo. Create this file using /usr/sbin/grpconv. Run both these commands at regular intervals to ensure all passwords are shadowed.
/etc/shells
Contains valid shells for your system. Delete shells that are not installed on your system.
/etc/login.defs
This file contains some default values for account creation. Review it's contents as it is commented well.
/etc/securetty
These are consoles where root can log into the machine directly. It might be favorable to provide at least one console for this, '/dev/tty1', although you can disable this altogether. You can also allow root to log in on a serial port for network/modem usage. This is a very bad idea. In the more advanced documentation, I will discuss some 'neat' options for root logins.
System Logging:
There are two programs which handle logging under Linux: sysklogd and klogd. klogd provides logging for the kernel, and sysklogd does almost everything else. Try to configure most programs, i.e. apache, to log to a central place, /var/log/. As noted above, keep /var on a separate disk to keep / from becoming full. Compression utilities should be used in conjunction with a log rotator.
I think one of the neatest features of syslog is the ability to log to a remote host. This is great for centralizing log files for many servers.
A major problem with logging facilities is that once a hacker has gained root access, they are free to modify and delete log files. A free secure-syslog program from www.core-sdi.com/ssyslog/ is available for logging with encryption, however logs can still be deleted. One way to help prevent deletion is to set imutable bits on log files. This is discussed in the advanced docs.
Add the following line to /etc/syslog.conf:
*.*;auth,authpriv.none /dev/tty12
This will log most of the important stuff to /tty12. You can also log to another host by using:
*.*;auth,authpriv.none @129.21.60.9
A sample /etc/syslog.conf
This logs to the host at 129.21.60.9. Use IPs instead of DNS lookups as server failures and spoofing cause headaches.
Don't forget to check logs for suspicious activity and messages from programs. Many programs for this purpose are available along with statistical genereators.
TCP Wrappers:
TCP Wrappers are used to allow and deny certain hosts from making connections to your machine. Let's start with the two configuration files:
/etc/hosts.allow and /etc/hosts.deny
These files work in a top-down reading where explicit entries in hosts.allow will automatically be allowed in. If an entry in hosts.allow is not found, hosts.deny is checked. If a match is found, the host is disallowed, however if no match is found in either table, the host is allowed. You should avoid using DNS lookups because they are fairly easy to spoof, and a DNS failure would put you SOL. Here is a sample, consult the man page 'hosts.allow' for more info.
hosts.allow
#allow everything inside of the CSH network
ALL: 129.21.60.0/255.255.255.0
#Give myself some access points in case DNS gets fsucked
in.telnetd: wrench.cs.rit.edu
in.telnetd: sprocket.cs.rit.edu
in.telnetd: grace.isc.rit.edu
#Allow the world to get ftp access
in.ftpd: 0.0.0.0/0.0.0.0
------------------------------------------------------------
hosts.deny
#The following line kills everyone else off including NFS
ALL: 0.0.0.0/0.0.0.0
Run /usr/sbin/tcpdchk to find possible errors with your configuration.
A note about paths:
Paths should be set up like this....
$ echo $PATH
/usr/bin:/bin:/usr/sbin::$HOME/bin:.
The deal is that if the user's home 'bin' directory was searched
before the system /bin, the user might be able to sneak a program into
$HOME/bin which preforms a malicious act on the system.
Topics to be included later:
something about pwck
X Windows:
Never run as root. Period!