Configure user account. logout and relogin
as user. su wherever required. useradd <username> eg. useradd myodduser
passwd myodduser <new password>
Configure Default runlevel to runlevel
3 Use your favorite text editor to edit
/etc/inittab Find a line that is similar to the
following: id:3:initdefault:
Verify the no. after “id:” id-colon is 3. If it is not make it three.
To restrict virtual terminals to two: Find out following stanza to enable only two virtual terminals available:
# Run gettys in standard runlevels 1:2345:respawn:/sbin/mingetty tty1 2:2345:respawn:/sbin/mingetty tty2 3:2345:respawn:/sbin/mingetty tty3 4:2345:respawn:/sbin/mingetty tty4 5:2345:respawn:/sbin/mingetty tty5 6:2345:respawn:/sbin/mingetty tty6
Make it to:
# Run gettys in standard runlevels 1:2345:respawn:/sbin/mingetty tty1 2:2345:respawn:/sbin/mingetty tty2 #3:2345:respawn:/sbin/mingetty tty3 #4:2345:respawn:/sbin/mingetty tty4 #5:2345:respawn:/sbin/mingetty tty5 #6:2345:respawn:/sbin/mingetty tty6
Save /etc/inittab and exit
Edit /etc/fstab . For the file systems /tmp,
/var, and /home replace the "defaults" with "noexec,nodev,nosuid"
noexec : Binaries are not allowed to be executed. NEVER use
this option for your root file system! nosuid : Blocks the operation of suid, and sgid bits. nodev : Prevent any user to mount the file system.
Disable unused services in order to save on
resources and minimize potential security holes. These Services that are to be stopped are mentioned here, check appendix A in
case of custom requirements.
SSH: Disable RootLogin, force protocol 2, (explore restricting SSH to users/groups ) Protocol 2 HostbasedAuthentication no PermitRootLogin no PermitEmptyPasswords no UsePrivilegeSeparation yes AllowTcpForwarding no X11Forwarding no StrictModes yes AllowUsers admin user1 user2 user3 (put actual users here in place of userN)
Stripping It
Down
Following rpms are to be removed (You may add or remove some packages from this
list in order to satisfy your environment.)
Security and management tool installations and
fine tuning:
Security Tools Download, install and run:
a. chkrootkit -
http://www.chkrootkit.org/download/ Download to /usr/local/src Extract using "tar -zxf" Compile & Install using "make sense" Run chkrootkit
b. rkhunter -
http://www.rootkit.nl/projects/rootkit_hunter.html Download to /usr/local/src Extract using "tar -zxf" Install using ./install.sh ./installer.sh --layout /usr/local –install rkhunter --update Run "rkhunter -c --createlogfile"
Management Tool:. Download, install, configure:
Webmin with SSL
Package Dependencies Ensure openssl and openssl-devel are installed rpm -q openssl rpm -q openssl-devel If they are not installed, install them using: yum install openssl openssl-devel -y (Mention ONLY those packages that need to be installed).
Download the Webmin RPM -
http://www.webmin.com/ Download the RPM to /usr/local/src Install using rpm -Uvh Go to https://IP.AD.DR.ESS:10000 to configure. Login with user root, and
password 1. Under Webmin -> Users -> Edit the root user. Rename root user to
"admin" 2. Under Logging ensure all events by all users are logged 3. Change the port from 10000 to a suitable one above 50000 (and below 60000). 4. Under Authntication - set the idle time-out to 5 minutes.
d. Perl Libraries
Net::SSLeay -
http://www.cpan.org/modules/by-module/Net/Net_SSLeay.pm-1.30.tar.gz Download to /usr/local/src/ Extract with tar -xzf Prepare with "perl Makefile.PL" Compile & Install with "make install" Test installation with "perl -e 'use Net::SSLeay'". You should be returned to
the prompt. If you get errors, the installation did not succeed.
e. Portsentry -ftp://194.199.20.114/linux/freshrpms/fedora/linux/1/portsentry/portsentry-1.1-11.fr.i386.rpm Download the RPM to /usr/local/src Install using rpm -Uvh Edit /etc/portsentry/portsentry.conf Edit /etc/portsentry/portsentry.modes Edit /etc/portsentry/portsentry.ignore Start portsentry.
f. Checksuite -
http://checksuite.sourceforge.net/ Download the RPM to /usr/local/src Install using rpm -Uvh
g. Fine Tuning IPTABLES: edit /etc/sysconfig/iptables
Insert rules for trusted ip addresses only which should access ssh port.
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -s
<trusted ip address> -j ACCEPT
These rules are to be added before following rule: -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
Also you will have to make sure other ports are kept open (Those considered
under Pre-Installation preparation)