Hardening Linux 204
davidmwilliams writes "Out of the box, many Linux systems are insecure with open ports and unpatched vulnerabilities. Read about the essential steps to
secure your server as well as how to solve them manually and via automated tools like Bastille."
FP (Score:4, Funny)
Re: (Score:2)
Re: (Score:2)
And hey
- Jesper
AppArmour (Score:3, Interesting)
Re: (Score:2)
In Soviet Russia (Score:2, Funny)
Re: (Score:2)
Happens in LUG meetings too (Score:2)
Bastille hompage (Score:2)
Open Ports? (Score:2)
Per-distro comparisons? (Score:5, Interesting)
Anyone know of such a project - even if just comparing a few top-tier distributions?
Re:Per-distro comparisons? (Score:4, Insightful)
Hardened Linux From Scratch (Score:3, Interesting)
Open ports and unpatched vulnerabilities? (Score:2)
Re: (Score:3)
Article not very informative (Score:5, Informative)
Run 'netstat -apvtu' if you're worried about what you have open. A good ingress/egress firewall policy is ideal and any competent Linux user should be forced to learn iptables instead of relying on a GUI or automated configuration tool to make assumptions about the purposes of your network.
The article isn't very useful or accurate.
Re: (Score:2)
It triggers me on two other points too:
Box? (Score:5, Insightful)
Before making a claim like that, the writer should come up with at least three examples, from current versions of major distros.
Reminds me of a local woman who said "We must have a town-wide neighborhood watch, because there's a child sexual predator on every block." In the several years since she raised that hysteria, there's been exactly one serious case in town: one of her best friends had his extensive child porn collection found by the police. He hired the state's most expensive lawyers and got off with probation. She's still his best friend.
Back to the topic. The article mentions telnet. Is there a single current distro that comes with telnetd enabled? Let's help the sloppy author. Has anyone here installed any current distro and found "open ports and unpatched vulnerabilities"?
Re: (Score:2)
Re: (Score:2)
Hardened? Hardly. (Score:4, Informative)
Re: (Score:2)
You not only have to limit the ports but who you accept conn
So what - we are all NAT'ed anyway? (Score:2)
Re: (Score:2)
Re: (Score:2)
My router has a lot of configuration options which are not NAT. In fact there are lots of uses for routers than don't use NAT schemes. There are also many ways to use NAT without the network device actually being a physical box we usually call a "router".
What is your point? If everybody except you is retarded, then why don't you enlighten us?
- Jesper
Since the submitter is also the author... (Score:4, Funny)
Here's how I'm picturing it:
(editor) Mr. Williams, we need a techie article on Linux.
(mr. williams) Okay... I haven't touched linux since I played around with my RedHat 7.2 box 3 years ago.
(editor) Do you still have it?
(mr. williams) Yes, what would you like me to write about it?
(editor) Write something up on securing its "holes and vulnerabilities", and we'll sensationalize it a bit by making it look like Linux is insecure out of the box.
(mr. williams) I don't know how to do that.
(editor) Find something on google. Try it on your RedHat machine.
(mr. williams) I'm going to look really stupid.
(editor) You're a journalist.
The defaults are no longer what they were in 199x (Score:5, Informative)
- [KU]buntu
All services off by default. netfilter rules are default allow however, but there is
nothing to connect to.
- Fedora/RHEL/CentOS
Choose during install what services you want enabled/open/firewalled.
SELinux enabled by default.
- Knoppix 5.1.1
Only Port 68 for dhcp client listener.
- Mandriva 2007 Bootable CD
Port 6000 is all that's open (X server. Ok this is dumb, why?)
Other distros follow similar suit. You can find out what's running on your linux box with:
- netstat -tuna (all tcp/udp sockets, dont resolve names, all listening/non-listening sockets)
- locate iptables; sudo iptables -nvL (show iptables chains for netfilter)
Chances are, if you've not mucked around with the default services things are pretty tight.
TFA is a bit inaccurate for linux systems these days.
Re: (Score:2)
> Port 6000 is all that's open (X server. Ok this is dumb, why?)
Well, if it's a bootable CD, maybe the idea is you boot to it, and then do a remote X session to it? With no HD in the box, there would be no risk to your data.
newbie article (Score:3, Interesting)
Redhat 7.0, ipchains? (Score:2)
Secure wget! (Score:2)
The simplest way, then, to prevent script kiddies from compromising your system is not only allow access to wget through sudo! Simply chmod it.
Now, this is no excuse not to ensure every
Re: (Score:2)
Hardening Linux (Score:5, Funny)
Bind services to localhost. (Score:2)
Installing Debian server (Score:3)
Use nmap? (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2)
That command will tell you much more than netstat. It'll also give you the program that is opening the port.
How To in summary... (Score:5, Informative)
1) Disable unwanted services (done via the CLI in this day of GUIs)
2) Keep the OS patched
3) Install and run Bastille to do everything else for you.
Re:How To in summary... (Score:4, Insightful)
That's because the article fell through a hole in time, and actually belongs in 1997. They are already yelling to give their article back. No self-respecting consumer distro has shipped with open ports in ages.
Re:How To in summary... (Score:5, Funny)
The summary is ... strange.
"... many Linux systems are insecure with open ports" ... "...how to secure your server ..."
Remember all those internet ads about "YOUR COMPUTER HAS OPEN PORTS !!!"
Its a computer connected to "Teh Intarweb" - its supposed to have open ports.
Next we'll read another story about how some "1337 hacker hacked into another person's machine" at IP address 127.0.0.1, erased all their files, and somehow, the "other person" was able to hack their machine and do the same thing ...
Followed by a nostalgiac look at "Punch-the-monkey" ads.
Re: (Score:2)
Not if it just acts as a client, as most "consumer" machines do.
Re: (Score:2)
>>Its a computer connected to "Teh Intarweb" - its supposed to have open ports.
>>Not if it just acts as a client, as most "consumer" machines do.
Nobody with a consumer machine uses a chat program? A file-sharing program? Heck, Window95 shipped with a web server (PWS), and thats about as "ghetto consumer box" as you can get.
Re: (Score:2)
What part of "in the default configuration" do you not understand? OBVIOUSLY if you run a program that opens a port, you will have an open port. It is rather silly to demand that you can run chat clients and file sharing programs without opening ports.
What the fact that Windows 95 was a braindead abomination has to do with the cur
Re: (Score:2)
>OBVIOUSLY if you run a program that opens a port, you will have an open port. It is rather silly to demand that you can run chat clients and file sharing programs without opening ports.
Which is why I said that the fact that a port is open is not, of itself, a problem. The summary of the article said "many Linux systems are insecure with open ports"; that a port is open or not is not, in itself, indicative of a security problem, and that it put me in mind of all those "Your computer is at risk because
Re: (Score:2)
Re: (Score:2)
Most distros nowadays are pretty decent about not installing, never mind running, stuff "out of the box". This "article" is severely dated, back to the time when the only people who installed linux *wanted* all sorts of servers running.
I'm from those "bad old days", and I've had to adapt, by not assuming that tools and utilities that I took for granted are still available in a near-default install. Even when I check "developer tools", I still have to go through the list to include those older, simpler par
Re: (Score:2)
Re the article: yeah, ipchains. And giving tips for securing telnetd. And missing apparmor and SELinux and grsecurity. And does anyone still run servers on a Pentium 1 and needs xinitd? It totally looks like random bits pasted together after googling for "linux, security". BTW, I left a comment at the site, basically summarizing the slashdot discussion (and linking back to it), and he blocked me
Re: (Score:2)
Tree is hardly a developer tool, is it? But yes, it's sometimes useful and I install it on all my machines.
Re: (Score:2)
"BTW, I left a comment at the site, basically summarizing the slashdot discussion (and linking back to it), and he blocked me :)"
Sounds like he's a real dickhead! [trolltalk.com] (link is NSA - Not Safe Anywhere).
Re: (Score:2)
I use tree a fair amount of the time - its really handy for grepping only parts of a source tree, for example, or for when I want to save a quick snapshot of a directory layout to a plain-text file, before making any serious mods that I may live to regret :-)
Its also handy in shell scripts. I just like my older, simpler tools for some jobs.
Re: (Score:2)
Most distros nowadays are pretty decent about not installing, never mind running, stuff "out of the box".
One word: Ubuntu. Ubuntu doesn't install much out of the box, but it doesn't install a firewall. If you apt-get, say, apache2, it automatically starts it. That's not cool. The Fedora/RHEL/CentOS way is better. If you install something, it stays disabled until you configure it and enable it. They also default to installing a firewall, and also default to using SELinux.
Re: (Score:2)
"If you apt-get, say, apache2, it automatically starts it. That's not cool."
I would assume that if someone goes to the effort to install apache, they want to run it, and that's probably what Ubuntu does. Having said that, the experience of a coworker was different. He didn't want to run the OpenSUSE disk I had handy, so he borrowed an Ubuntu disk. Of course, that meant that the machine absolutely sucked for development. Missing servers, development tools, libraries, files ...
Each distro has its good an
Re: (Score:2)
Re: (Score:2)
Not if it just acts as a client, as most "consumer" machines do.
Well, you need at least incoming udp:68, at least if you want it to receive the initial response from the DHCP server.
Re: (Score:2)
Re: (Score:2)
But ports that are only open in response to the user initiating a connection are not open "by default", are they. Plus, this is just the way things are, technically, and as such not usable as differentiating criteria, wouldn't you agree?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
No, but I remember "Your computer is broadcasting an IP address!".
Re:How To in summary... (Score:5, Insightful)
gentoo has great service management
GUI tools are seriously annoying, since this article is about security and disabling unneeded services having config tools that require the unneeded service X11 is pretty silly.
Re: (Score:2)
Re: (Score:2)
True, it's not necessary but in a sane setup X11 isn't a network service either. If you need to first compromise a running internet-facing service to get local privilidges and then use a local escalation exploit in X11, the bar is fairly high. If you prefer the GUI tools, I wouldn't worry too much over it as long as it's otherwise pa
Re: (Score:2)
Yes, but GUIs also normally have applications to enable and disable services (which was my point). Their method is to hack in files from the command line or similar, while most distros should have an "easy to use" service management app. I know Redhat and Fedora have for ages.
That has always bothered me (on RHEL, at least - Fedora is more desktop oriented than server oriented). They create these GUIs to do everything for you, which is a front end for their own interface to the flippin' etc files. I guess I just don't want to see RHEL admins become MSCEs, or it could be because my mind is warped since Slackware was my first distro. It could also be because I've lately been fighting with Solaris for control of my services (don't get me started). But I think any admin worth th
What could be simpler??? (Score:2)
Middle clicking on any executable command and have it execute is also pretty neat. (acme, send menu item in the wm, rio)
I can also send arbitrary strings for matching against a list and the match executes, that's a boon as well. (plumber which is a system service (though it runs in userland as you, obviously - this is plan9 there are rules)
I write a pallette of commands for my current problem domain which are just txt files so I
Re: (Score:2)
Slashdot comments (and sometimes articles) contain ton
Re: (Score:3, Informative)
Don't read TFA then. The advice it gives is barely relevant to any distro released in the past decade.
Re: (Score:2)
Re: (Score:2)
That was Goatse.cx
Dude, that article sucked. (Score:5, Insightful)
It reads more like someone who's just discovered Bastille and now considers himself "informed" on "security issues".
Step #1. Limit the avenues of attack. This is where you'd use nmap.
Step #2. Remove anything you don't absolutely need. Come on, most people out there will be running some distribution now. At least he could have covered dpkg, rpm, etc.
What's this with the "Enter kill -9 xxx where xxx is the PID."? How about just
And editing xinetd.conf / inetd.conf? Again, just use the package manager to remove it.
And he doesn't even go into how each distribution handles package updates? What the fuck? Nothing about "apt-get update"? No "apt-get upgrade"?
No, this article is about someone's discovery of Bastille and how it helps an old, stock installation of Red Hat.
That's a good point. Thanks. (Score:5, Interesting)
Yep. That's why I prefer hitting it from a different machine. Multiple machines if possible. One on the same LAN segment and one from somewhere on the Internet.
That way you'll see what a would-be-attacker will see.
Sure, I might be running SMTP on port 25, but bound to 127.0.0.1 instead of eth0. An attacker would have to FIRST gain access to my machine through some other means to be able to attack my SMTP service.
Sure, that first hurdle might be set very, Very, VERY, VERY high, but if someone can get over it
And that's what "security" is all about to me. It's the PROCESS of evaluating threats and reducing their effectiveness.
Maybe. (Score:2)
I set up a VPN connection for a co-worker last week. She was directly connected to the Internet through her ISP supplied cable modem.
... but checking from outside showed that everything was not okay.
Except that that particular cable modem automatically filtered the inbound connections. Checking her machine showed that everything was okay
Rather
This is the last time I'm explaining it to you. (Score:5, Informative)
Maybe it does. Maybe it does not. But that is immaterial. This is about what an attacker would see. Not what your machine can see from itself.
It is possible to set up a system that allows access to those services from eth0 & localhost, but not from any other addresses.
You are not concerned about what you can see from your machine. You are concerned about what an attacker can see. They are NOT the same.
NO it will NOT.
Your statement is only accurate for the condition in which NO ports are open. That is a single scenario and does NOT account for the various possibilities. Therefore the ONLY way to know what an attacker would see is to scan the way the attacker would.
No. Again, the system can be set up so that the ports are visible from localhost and eth0. The only way to know EXACTLY what the attacker can see (other than in the specific scenario of all ports being closed) is to scan the way the attacker would.
No, the list given by nmap would not be accurate. Because the list given by nmap would show ports open (and therefore vulnerable) when there would be no way for an attacker to see those ports.
Again, the only time your statement would be accurate is the single case of all ports being closed.
I've given multiple, specific examples where such would not be the case. I've shown where your statement is correct ONLY FOR A SINGLE SCENARIO where all the ports are closed.
Again, I've provided specific examples that illustrate where the information gained by scanning from an attacker's position would be different than scanning from the machine itself.
You can claim that such is impossible all you want.
But the facts contradict you.
You are taking a single case and claiming that it is the same for ALL the possible configurations. It is not. The only way to know what an attacker will see is to perform the scan as an attacker would.
Re: (Score:2)
From the local machine, if you nmap the externally-facing IP address, you will get different results than if you scan the loopback IP address. That is, you will only see services and ports that will roger up to a SYN (or whatever nmap is set to send) packet received by that IP.
For this reason, scanning from a distant computer is unnecessary.
Claiming otherwise, when several security professional are telling you are wrong, is asinine.
Telling them that you have specific anecdata that prove
Re: (Score:2)
Irony defintion: when the 6 digit ids are lecturing the 4 digit ids about being new to the internet, and this thing called networking...
all an nmap on your external interface will show you is what an external entity might be able to see.. not what they can see
this is fine for the special case
Re: (Score:2)
The reason you keep saying this is, as has been observed by others, that you do not understand networking.
Seriously, you. are. wrong.
Re: (Score:2)
No...he's not wrong. Network daemons of many sorts can be set up to ignore requests from certain IP addresses (eg. 100.1.1.1), and acknowledge them from others (200.1.1.1). If the daemon does not even send an ACK back when connected to from 100.1.1.1, this would make the port appear firewalled when scanned from 100.1.1.1, but open and accepting connections from 200.1.1.1.
Re: (Score:2)
You're saying that nmapping localhost just shows open ports visible from the local machine. The nmap scan does not get routed out to the ISP (obviously) and back to the external IP address, so it only shows what the local machine can see. This is, obviously, what localhost does.
Nmapping the external IP address gets routed out to the ISP and then back and therefore it shows exactly what an attacker would see (barring some filtering of outbound ports done by
Re: (Score:2)
And to clarify, do you claim that a packet from this machine to this machine is sent out on the wire? That would be inefficient routing.
Re: (Score:2)
If I scan my network-facing IP address, whether I do so from another machine on my LAN or from my server itself, the scan will not traverse to my ISP and back again through my modem. It will be recognized as a connection to a local address and head to that interface directly but traffic will be understood to come from a safe(r), local sourc
Re: (Score:3, Informative)
UNIX is all about small programs doing one thing, and doing it well. Something like inetd does a few things that are needed by pretty much all server-type programs, and separating them out makes
Re: (Score:2)
I mean, it just took me about 15 minutes.
Just sayin'.
Re: (Score:2)
Re: (Score:2)
Re:Huh? (Score:5, Informative)
Re: (Score:3, Funny)
A default Ubuntu box has them all closed. (Score:4, Informative)
That is correct. By default, they are all closed.
But you may have changed that. If you've installed any P2P or such apps, you may have open ports from that.
As the other poster suggested, use nmap to determine what your outward profile looks like. Even better, have a friend scan your address from their location. That will tell you what your machine looks like from the Internet.
That's without a firewall.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Well, if you're looking for something that's "not linux", you can always enter this contest [trolltalk.com] - there are already a few entries that cover "open ports" that have nothing to do with linux - and one (# 12) that really nails "hardening" pretty good.
"The purpose of this post is to see the reasoning behind so many linux fluff stories making front page "
Its Sunday, this is slashdot, not PC Magazine, CmdrTaco is stuck reviewing submissions over dialup, and the big news of the MONTH was SCO getting kicked in the [youtube.com]
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
There are other kinds of FOSS products than Linux btw - so why is Linux the only one to get 30% of the index page?
Allthough I like and use Linux, I think the point is valid.
- Jesper
Re: (Score:2)
Re: (Score:2)
But I am sure those days don't have comments about "too many Linux stories" either. Right?
So we could say it is only fair to have that particular criticism on a day where there is also fact to back it up?
- Jesper
Re: (Score:2)
Re: (Score:2)