Hello! Is your precious Linux server safe and sound today? π₯οΈ Even if it looks peaceful on the surface, countless threats lurk unseen. π΅οΈββοΈ A small security flaw can lead to a major incident. So today, we’ll delve into the Linux/Unix Server Security Essential Diagnostic Checklist to make our servers impregnable. Follow each item carefully and check the security status of your server!
π€ Account Management: The First Step in All Security
Account management is the most basic yet most crucial part of security. If permissions are compromised, it’s like losing everything.
- π Restrict Remote Root Access (U-01) Direct remote access (Telnet, SSH) to the root account, which has all system privileges, must be prevented. If an attacker compromises the root account, the system will be completely taken over. Get into the habit of logging in with a regular account and then using su or sudo.
- π‘οΈ Restrict Root su Usage (U-45) The su command should not be used by just anyone. Restrict su command usage to users belonging to specific groups (e.g., the wheel group) to switch to root privileges, thereby controlling privilege escalation attempts.
- π¨ Prohibit UID ‘0’ for Non-Root Accounts (U-44) UID ‘0’ is the unique identifier for the root account. If another account has UID ‘0’, that account will also have the same powerful privileges as root. Such accounts must be found and modified or deleted immediately.
- π Set Strong Password Policies (U-02, U-46, U-47, U-48) Easy-to-guess passwords are like leaving the door open.
- Minimum Length: Set to 8 characters or more.
- Complexity: Enforce a combination of English letters, numbers, and special characters.
- Usage Period: Set a maximum of 90 days or less, and a minimum of 1 day or more, to encourage regular changes.
- π€« Protect Password Files (U-04) It is dangerous if encrypted passwords are directly stored in the /etc/passwd file. Use a shadow password system to securely store passwords in the /etc/shadow file, and always verify that the password field in /etc/passwd is marked with ‘x’.
- π Set Account Lockout Threshold (U-03) To prevent brute-force attacks, the number of failed login attempts should be limited to 10 or fewer. Configure accounts to automatically lock after a certain number of failures to neutralize attacker attempts.
- β³ Set Session Timeout (U-54) What if someone touches your computer while you’re away? It’s a terrifying thought. Configure automatic logout after a certain period of inactivity (recommended 600 seconds/10 minutes) to prevent unauthorized access.
- π§Ή Remove Unnecessary Accounts (U-49) Accounts for former employees or no longer used system accounts are potential security threats. Periodically check and neatly delete them.
- π¨ββοΈ Minimize Administrator Groups (U-50) The root group (GID 0) should only include the absolute minimum necessary accounts to reduce the possibility of privilege abuse.
- π Prohibit Duplicate UIDs (U-52) If different accounts use the same UID, privilege conflicts will occur, and audit trails will become difficult. All accounts must have a unique UID.
π File and Directory Management: Safeguarding Important Information
Neglecting permission management for important configuration files can lead to system configuration tampering or information leakage.
- π Protect Important Account Information Files (U-07, U-08)
- /etc/passwd: Owner is root, permissions are 644 or less
- /etc/shadow: Owner is root, permissions are 400 or less (only root can read!) Set these to completely block tampering with account information files.
- π Protect Host and Service Configuration Files (U-09, U-10)
- /etc/hosts: Owner is root, permissions are 600 (prevents pharming attacks via DNS tampering)
- /etc/(x)inetd.conf: Owner is root, permissions are 600 (prevents illegal service registration)
- π Protect Log and Service Port Files (U-11, U-12)
- /etc/syslog.conf: Owner is root (or bin, sys), permissions are 640 or less (prevents log configuration tampering)
- /etc/services: Owner is root (or bin, sys), permissions are 644 or less (prevents service port tampering)
- π¦ΈββοΈ Check SUID, SGID Configuration Files (U-13) SUID/SGID is a powerful feature that allows ordinary users to execute files with the permissions of the file owner/group, but it can be a path for attackers to escalate privileges. SUID/SGID set on unnecessary files must be removed immediately.
- βοΈ Check World Writable Files (U-15) Use the `perm -2` option to find files that anyone can write to. Such files can be exploited to plant malicious code on the system, so writing permissions must be removed unless absolutely necessary.
- π€ Prohibit .rhosts, hosts.equiv Usage (U-17) Trust-based authentication files used by r-series services (rlogin, rsh, etc.) are highly vulnerable to security breaches. Ensure these files do not exist to block remote access without authentication.
- β Check for Ownerless Files/Directories (U-06) Use the `find / -nouser -o -nogroup` command to find files or directories without an owner. Such files in management blind spots should be deleted or assigned an appropriate owner.
- π€οΈ Secure PATH Environment Variable (U-05) If the current directory (‘.’) is included in the PATH environment variable, especially at the beginning, there is a risk that malicious scripts will be executed first. It is safer to add it to the end of PATH or remove it entirely.
βοΈ Service Management: Lock Unnecessary Doors
It’s fundamental to turn off unused services! For services that are running, security settings must be strengthened.
- π« Disable Vulnerable r-series Services (U-21) rlogin, rsh, rwho, etc., have very weak authentication processes and must be disabled. With SSH available now, there’s no need to worry!
- π€« Disable Information Leakage Services (U-19, U-20) The finger service, which can leak user information, and Anonymous FTP, which allows anonymous file access, can pose significant security threats and should be disabled.
- π₯ Disable DoS Vulnerable Services (U-23) echo, discard, daytime, etc., are old services that can be exploited for Denial of Service (DoS) attacks. Disable all of them.
- πͺ NFS Service Security (U-24, U-25) If you are not using NFS (Network File System), stop the service. If you are using it, strictly control access by specifying only authorized hosts in the /etc/exports file.
- π§ Strengthen Sendmail Security (U-30, U-31, U-70) Older versions of Sendmail are vulnerable to security flaws. Update to the latest version, restrict spam relaying, and disable commands like expn/vrfy that can potentially leak information.
- πΊοΈ Strengthen DNS Security (U-33, U-34) Always keep the BIND version up to date and allow zone transfers only to authorized servers to prevent entire DNS information from being leaked.
- π Remove Web Directory Listing (U-35) Remove the Indexes option from your web server configuration (httpd.conf). This option displays the file list of the web directory directly, which can expose important information to attackers.
- π¦ Restrict Web Process Permissions (U-36) Web server daemons like Apache should never be run as the root account. Run them with separate, lower-privileged accounts like apache or nobody to prevent the entire system from being compromised even if the website is hacked.
- β¬οΈβ Prohibit Access to Parent Directories (U-37) Setting the AllowOverride directive to None in web configurations prevents additional settings via .htaccess files. Configure it appropriately with AuthConfig, etc., to block attempts to access parent directories.
π Patch and Log Management: Continuous Monitoring and Reinforcement
Security is not a one-time event but requires continuous attention and management.
- β¨ Apply Latest Security Patches (U-42) Security vulnerabilities in operating systems (OS) and major software (Apache, PHP, OpenSSL, etc.) are continuously discovered. Periodically apply the latest security patches according to vendor recommendations to eliminate known threats.
- π΅οΈββοΈ Regular Log Review and Reporting (U-43) System logs (wtmp, sulog, etc.) are crucial clues for finding traces of intrusion. Regularly review logs to check for abnormal access attempts or privilege usage history, and establish a system for reporting issues when they occur.
- βοΈ Configure System Logging According to Policy (U-72) Set clear logging policies in the /etc/syslog.conf (more recently rsyslog.conf) file to ensure that all necessary security-related logs are recorded without omission.
Phew, that’s a lot, isn’t it? π But by consistently checking and managing these items, your Linux server will become much more secure. Remember that security is a ‘process,’ not an ‘event.’ Why not check your server right away today?
Leave a Reply