Re: Securing Fedora Core 4

On 9/21/05, AragonX <[email protected]> wrote:
> I am trying develop a method to secure my servers.  I'll list the steps I
> am going to take.  Can you please review and make any additional
> suggestions.  Thank you.
>

To reinterate what Michael said.. what are you trying to secure and from whom?

Here are my basic steps for locking down a RHEL/Fedora/Whitebox/etc server.

1) Get the packages I need:
   a) Download the ISO's.
   b) Download and cut an ISO of the updates.
   c) Download from extras, DAG, pick your trusted repository
         chkrootkit
         aide or tripwire.

2) Plan out the installation
   a) What is the purpose of the box
         desktop
         workstation
         server
            email
            http
            dns
            smb
            firewall
   b) Plan out partitions for IO/performance (e.g. seperate disks)
       Standard layout to play with
       /
       /usr
       /tmp
       /var/tmp
       /var
       High IO partition(s) (if needed)
          /var/spool
          /var/named
          /var/www
          /var/samba
          etc.
      Seperating out these partitions on a server allow you to put in
specific acls, mount rules etc depending on what higher level tool you
are using.
      c) Plan out the backup schedule, what the box can the box trust,
and  what are its levels of defense per box.

3) Install the system off the wire. Do all the updates and install
extra packages from ISOs

4) Configure daemons to be used.
      a) Turn off xinetd for all desktops/workstations.
      b) Turn off xinetd for most servers
      c) Configure aide/tripwire for your system.
            a) Write data to read-only object to be compared to.
            b) Nightly run is done and mailed to root.
      d) Configure ssh to
            a) Protocol 2
            b) No port forwarding (unless your risks assessment says its ok)
            c) No root login
      e) Configure email (postfix, sendmail, exim, etc) to
            a) Root email goes to central box
            b) If service can only run in queue mode do so.
            c) mail works for your network environment.
      f) Configure syslog (replace with syslog-ng) to
            a) Log events appropriate for your environment
            b) Log to central server.

5) Configure firewall appropriately
     a) Allow in only what you want.
     b) Allow out only what you want. [Desktops this is hard.]
     c) Forward only what you want. [If it aint a firewall set to deny.]
     d) Log everything else and tune to quiet it down to what is useful.
     I go for only allowing out what you want on a firewall because on
www servers seeing that your box is trying to ftp or ssh to some
untrusted site says.. hmm is someone trying to get a root-kit?

6) Tune the kernel and applications for your environment.

7) Backup the box and make sure your automated backups work.

8) Other steps depending on service/products.

9) Put box on wire.

I do not put snort on the same box as I am trying to protect normally.

--
Stephen J Smoogen.
CSIRT/Linux System Administrator