Security Guide Red Hat Enterprise Linux 6 En US

Red_Hat_Enterprise_Linux-6-Security_Guide-en-US

User Manual: Pdf

Open the PDF directly: View PDF .
Page Count: 243

Download
Open PDF In Browser	View PDF

Red Hat Enterprise Linux 6
Security Guide
A Guide to Securing Red Hat Enterprise Linux

Last Updated: 2018-03-06

Red Hat Enterprise Linux 6 Security Guide
A Guide to Securing Red Hat Enterprise Linux
Mirek Jahoda
Red Hat Customer Content Services
mjahoda@redhat.com
Robert Krátký
Red Hat Customer Content Services
Martin Prpič
Red Hat Customer Content Services
Tomáš Čapek
Red Hat Customer Content Services
Stephen Wadeley
Red Hat Customer Content Services
Yoana Ruseva
Red Hat Customer Content Services
Miroslav Svoboda
Red Hat Customer Content Services

Legal Notice
Copyright © 2017 Red Hat, Inc.
This document is licensed by Red Hat under the Creative Commons Attribution-ShareAlike 3.0
Unported License. If you distribute this document, or a modified version of it, you must provide
attribution to Red Hat, Inc. and provide a link to the original. If the document is modified, all Red Hat
trademarks must be removed.
Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert,
Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.
Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, OpenShift, Fedora, the Infinity
logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other
countries.
Linux ® is the registered trademark of Linus Torvalds in the United States and other countries.
Java ® is a registered trademark of Oracle and/or its affiliates.
XFS ® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States
and/or other countries.
MySQL ® is a registered trademark of MySQL AB in the United States, the European Union and
other countries.
Node.js ® is an official trademark of Joyent. Red Hat Software Collections is not formally related to
or endorsed by the official Joyent Node.js open source or commercial project.
The OpenStack ® Word Mark and OpenStack logo are either registered trademarks/service marks
or trademarks/service marks of the OpenStack Foundation, in the United States and other countries
and are used with the OpenStack Foundation's permission. We are not affiliated with, endorsed or
sponsored by the OpenStack Foundation, or the OpenStack community.
All other trademarks are the property of their respective owners.

Abstract
This book assists users and administrators in learning the processes and practices of securing
workstations and servers against local and remote intrusion, exploitation and malicious activity.
Focused on Red Hat Enterprise Linux but detailing concepts and techniques valid for all Linux
systems, this guide details the planning and the tools involved in creating a secured computing
environment for the data center, workplace, and home. With proper administrative knowledge,
vigilance, and tools, systems running Linux can be both fully functional and secured from most
common intrusion and exploit methods.

Table of Contents

Table of Contents
.CHAPTER
. . . . . . . . .1.. .SECURITY
. . . . . . . . . OVERVIEW
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10
...........
1.1. INTRODUCTION TO SECURITY
10
1.1.1. What is Computer Security?
10
1.1.1.1. How did Computer Security come about?
10
1.1.1.2. Security Today
11
1.1.1.3. Standardizing Security
11
1.1.2. SELinux
1.1.3. Security Controls
1.1.3.1. Physical Controls
1.1.3.2. Technical Controls
1.1.3.3. Administrative Controls
1.1.4. Conclusion
1.2. VULNERABILITY ASSESSMENT
1.2.1. Thinking Like the Enemy

11
12
12
12
12
13
13
13

1.2.2. Defining Assessment and Testing
1.2.2.1. Establishing a Methodology
1.2.3. Evaluating the Tools

14
15
15

1.2.3.1. Scanning Hosts with Nmap
1.2.3.1.1. Using Nmap

16
16

1.2.3.2. Nessus
1.2.3.3. Nikto

16
17

1.2.3.4. Anticipating Your Future Needs
1.3. SECURITY THREATS
1.3.1. Threats to Network Security

17
17
17

1.3.1.1. Insecure Architectures
1.3.1.1.1. Broadcast Networks

17
17

1.3.1.1.2. Centralized Servers
1.3.2. Threats to Server Security

18
18

1.3.2.1. Unused Services and Open Ports
1.3.2.2. Inattentive Administration
1.3.2.3. Inherently Insecure Services
1.3.3. Threats to Workstation and Home PC Security
1.3.3.1. Bad Passwords
1.3.3.2. Vulnerable Client Applications
1.4. COMMON EXPLOITS AND ATTACKS
1.5. SECURITY UPDATES
1.5.1. Updating Packages
1.5.2. Verifying Signed Packages
1.5.3. Installing Signed Packages
1.5.4. Applying the Changes

18
18
18
19
19
19
20
22
22
23
24
25

. . . . . . . . . .2.. .SECURING
CHAPTER
. . . . . . . . . .YOUR
. . . . . NETWORK
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .28
...........
2.1. WORKSTATION SECURITY
2.1.1. Evaluating Workstation Security
2.1.2. BIOS and Boot Loader Security
2.1.2.1. BIOS Passwords
2.1.2.1.1. Securing Non-x86 Platforms

28
28
28
28
29

2.1.2.2. Boot Loader Passwords
2.1.2.2.1. Password Protecting GRUB
2.1.2.2.2. Disabling Interactive Startup
2.1.3. Password Security

29
29
30
31

Security Guide
2.1.3.1. Creating Strong Passwords
2.1.4. Creating User Passwords Within an Organization
2.1.4.1. Forcing Strong Passwords

31
32
32

2.1.4.2. Passphrases
2.1.4.3. Password Aging
2.1.5. Locking Inactive Accounts
2.1.6. Customizing Access Control

33
34
37
37

2.1.7. Time-based Restriction of Access
2.1.8. Applying Account Limits
2.1.9. Administrative Controls
2.1.9.1. Allowing Root Access

38
39
39
40

2.1.9.2. Disallowing Root Access
2.1.9.3. Enabling Automatic Logouts
2.1.9.4. Limiting Root Access
2.1.9.5. Account Locking
2.1.10. Session Locking

40
44
45
45
47

2.1.10.1. Locking GNOME Using gnome-screensaver-command
2.1.10.1.1. Automatic Lock on Screen Saver Activation
2.1.10.1.2. Remote Session Locking
2.1.10.2. Locking Virtual Consoles Using vlock
2.1.11. Available Network Services

50
50

2.1.11.1. Risks To Services
2.1.11.2. Identifying and Configuring Services

50
51

2.1.11.3. Insecure Services

2.1.12. Personal Firewalls
2.1.13. Security Enhanced Communication Tools

53
54

2.1.14. Enforcing Read-Only Mounting of Removable Media

Using blockdev to Force Read-Only Mounting of Removable Media
Using udisks to Force Read-Only Mounting of Filesystems
Applying New udev and udisks Settings
2.2. SERVER SECURITY

55
55
55
56

2.2.1. Securing Services With TCP Wrappers and xinetd

2.2.1.1. Enhancing Security With TCP Wrappers
2.2.1.1.1. TCP Wrappers and Connection Banners

56
56

2.2.1.1.2. TCP Wrappers and Attack Warnings
2.2.1.1.3. TCP Wrappers and Enhanced Logging

57
57

2.2.1.2. Enhancing Security With xinetd
2.2.1.2.1. Setting a Trap
2.2.1.2.2. Controlling Server Resources
2.2.2. Securing Portmap
2.2.2.1. Protect portmap With TCP Wrappers
2.2.2.2. Protect portmap With iptables
2.2.3. Securing NIS
2.2.3.1. Carefully Plan the Network

48
48
49

57
58
58
59
59
59
60
60

2.2.3.2. Use a Password-like NIS Domain Name and Hostname

2.2.3.3. Edit the /var/yp/securenets File
2.2.3.4. Assign Static Ports and Use iptables Rules

61
61

2.2.3.5. Use Kerberos Authentication
2.2.4. Securing NFS

62
62

2.2.4.1. Carefully Plan the Network

2.2.4.2. Securing NFS Mount Options
2.2.4.2.1. Review the NFS Server

62
62

2.2.4.2.2. Review the NFS Client

Table of Contents
2.2.4.3. Beware of Syntax Errors
2.2.4.4. Do Not Use the no_root_squash Option
2.2.4.5. NFS Firewall Configuration
2.2.5. Securing the Apache HTTP Server
Removing httpd Modules
httpd and SELinux
2.2.6. Securing FTP

64
64
64
65
66
67
67

2.2.6.1. FTP Greeting Banner

2.2.6.2. Anonymous Access
2.2.6.3. User Accounts

68
69

2.2.6.3.1. Restricting User Accounts
2.2.6.4. Use TCP Wrappers To Control Access

69
69

2.2.7. Securing Postfix

2.2.7.1. Limiting a Denial of Service Attack
2.2.7.2. NFS and Postfix

70
70

2.2.7.3. Mail-only Users
2.2.7.4. Disable Postfix Network Listening

71
71

2.2.7.5. Configuring Postfix to Use SASL

Setting Up Dovecot
Setting Up Postfix
Additional Resources
2.2.8. Securing Sendmail

72
72
73
73

2.2.8.1. Limiting a Denial of Service Attack

2.2.8.2. NFS and Sendmail
2.2.8.3. Mail-only Users

74
74

2.2.8.4. Disable Sendmail Network Listening

2.2.9. Verifying Which Ports Are Listening
2.2.10. Disable Source Routing

74
75

2.2.11. Reverse Path Forwarding
2.2.11.1. Additional Resources

77
77

2.3. SINGLE SIGN-ON (SSO)

2.4. PLUGGABLE AUTHENTICATION MODULES (PAM)
2.5. KERBEROS

78
78

2.6. TCP WRAPPERS AND XINETD
2.6.1. TCP Wrappers

78
79

2.6.1.1. Advantages of TCP Wrappers

2.6.2. TCP Wrappers Configuration Files

2.6.2.1. Formatting Access Rules
2.6.2.1.1. Wildcards

81
82

2.6.2.1.2. Patterns

2.6.2.1.3. Portmap and TCP Wrappers

2.6.2.1.4. Operators

2.6.2.2. Option Fields
2.6.2.2.1. Logging

85
85

2.6.2.2.2. Access Control

2.6.2.2.3. Shell Commands

2.6.2.2.4. Expansions

2.6.3. xinetd

2.6.4. xinetd Configuration Files
2.6.4.1. The /etc/xinetd.conf File

87
88

2.6.4.2. The /etc/xinetd.d/ Directory

2.6.4.3. Altering xinetd Configuration Files

2.6.4.3.1. Logging Options

Security Guide
2.6.4.3.2. Access Control Options
2.6.4.3.3. Binding and Redirection Options

90
92

2.6.4.3.4. Resource Management Options

2.6.5. Additional Resources
2.6.5.1. Installed TCP Wrappers Documentation
2.6.5.2. Related Books
2.7. SECURING VIRTUAL PRIVATE NETWORKS (VPNS)

93
94
94

2.7.1. IPsec VPN Using Libreswan

2.7.2. VPN Configurations Using Libreswan

2.7.3. Host-To-Host VPN Using Libreswan

2.7.3.1. Verify Host-To-Host VPN Using Libreswan
2.7.4. Site-to-Site VPN Using Libreswan

97
98

2.7.4.1. Verify Site-to-Site VPN Using Libreswan

2.7.5. Site-to-Site Single Tunnel VPN Using Libreswan

2.7.6. Subnet Extrusion Using Libreswan

100

2.7.7. Road Warrior Access VPN Using Libreswan

101

2.7.8. Road Warrior Access VPN Using Libreswan and XAUTH with X.509
2.7.9. Additional Resources

102
103

2.7.9.1. Installed Documentation

104

2.7.9.2. Online Documentation

104

2.8. FIREWALLS

104

2.8.1. Netfilter and IPTables
2.8.1.1. IPTables Overview

105
106

2.8.2. Basic Firewall Configuration

106

2.8.2.1. Firewall Configuration Tool

106

2.8.2.2. Enabling and Disabling the Firewall

108

2.8.2.3. Trusted Services
2.8.2.4. Other Ports

108
109

2.8.2.5. Saving the Settings

109

2.8.2.6. Activating the IPTables Service

110

2.8.3. Using IPTables

110

2.8.3.1. IPTables Command Syntax
2.8.3.2. Basic Firewall Policies

110
111

2.8.3.3. Saving and Restoring IPTables Rules

111

2.8.4. Common IPTables Filtering

111

2.8.5. FORWARD and NAT Rules

112

2.8.5.1. Postrouting and IP Masquerading
2.8.5.2. Prerouting

114
114

2.8.5.3. DMZs and IPTables

114

2.8.6. Malicious Software and Spoofed IP Addresses

115

2.8.7. IPTables and Connection Tracking

116

2.8.8. IPv6
2.8.9. IPTables

116
116

2.8.9.1. Packet Filtering

117

2.8.9.2. Command Options for IPTables

119

2.8.9.2.1. Structure of IPTables Command Options

119

2.8.9.2.2. Command Options

120

2.8.9.2.3. IPTables Parameter Options
2.8.9.2.4. IPTables Match Options

121
123

2.8.9.2.5. Target Options

126

2.8.9.2.6. Listing Options

127

2.8.9.3. Saving IPTables Rules

127

2.8.9.4. IPTables Control Scripts

128

Table of Contents
2.8.9.4.1. IPTables Control Scripts Configuration File

130

2.8.9.5. IPTables and IP Sets

131

2.8.9.5.1. Installing ipset

131

2.8.9.5.2. ipset Commands

131

2.8.9.5.3. IP Set Types
2.8.9.6. IPTables and IPv6

133
137

2.8.9.7. Additional Resources

137

2.8.9.7.1. Useful Firewall Websites

137

2.8.9.7.2. Related Documentation

137

2.8.9.7.3. Installed IP Tables Documentation

138

.CHAPTER
. . . . . . . . .3.. .ENCRYPTION
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .139
............
3.1. DATA AT REST
139
3.1.1. Full Disk Encryption

139

3.1.2. File-Based Encryption

139

3.1.3. LUKS Disk Encryption

139

Overview of LUKS

139

3.1.3.1. LUKS Implementation in Red Hat Enterprise Linux
3.1.3.2. Manually Encrypting Directories

140
141

3.1.3.3. Adding a New Passphrase to an Existing Device

143

3.1.3.4. Removing a Passphrase from an Existing Device

143

3.1.3.5. Creating Encrypted Block Devices in Anaconda

144

3.1.3.6. Additional Resources
3.2. DATA IN MOTION

144
144

3.2.1. Virtual Private Networks

145

3.2.2. Secure Shell

145

3.2.2.1. Cryptographic Login

145

3.2.2.2. Multiple Authentication Methods
3.2.2.3. Other Ways of Securing SSH

146
146

Protocol Version

146

Key Types

147

Non-Default Port

147

No Root Login
3.3. OPENSSL INTEL AES-NI ENGINE

147
147

3.4. USING THE RANDOM NUMBER GENERATOR

148

3.5. GNU PRIVACY GUARD (GPG)

149

3.5.1. Creating GPG Keys in GNOME

150

3.5.2. Creating GPG Keys in KDE
3.5.3. Creating GPG Keys Using the Command Line

150
151

3.5.4. About Public Key Encryption

153

3.6. USING STUNNEL

153

3.6.1. Installing stunnel

153

3.6.2. Configuring stunnel as a TLS Wrapper
3.6.3. Starting, Stopping and Restarting stunnel

153
155

3.7. HARDENING TLS CONFIGURATION

156

3.7.1. Choosing Algorithms to Enable

156

Protocol Versions

156

Public Key Length

158

3.7.2. Using Implementations of TLS
3.7.2.1. Working with Cipher Suites in OpenSSL

158
158

3.7.2.2. Working with Cipher Suites in GnuTLS

160

3.7.3. Configuring Specific Applications
3.7.3.1. Configuring the Apache HTTP Server

161
161

Security Guide
3.7.4. Additional Information

162

Installed Documentation

162

Online Documentation

162

. . . . . . . . . .4.. .GENERAL
CHAPTER
. . . . . . . . . PRINCIPLES
. . . . . . . . . . . OF
. . . INFORMATION
. . . . . . . . . . . . . .SECURITY
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .164
............
. . . . . . . . . .5.. .SECURE
CHAPTER
. . . . . . . .INSTALLATION
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .165
............
5.1. DISK PARTITIONS
5.2. UTILIZE LUKS PARTITION ENCRYPTION

165
165

. . . . . . . . . .6.. .SOFTWARE
CHAPTER
. . . . . . . . . . .MAINTENANCE
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .166
............
6.1. INSTALL MINIMAL SOFTWARE

166

6.2. PLAN AND CONFIGURE SECURITY UPDATES

166

6.3. ADJUSTING AUTOMATIC UPDATES

166

6.4. INSTALL SIGNED PACKAGES FROM WELL KNOWN REPOSITORIES

166

. . . . . . . . . .7.. .SYSTEM
CHAPTER
. . . . . . . .AUDITING
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .168
............
Use Cases
7.1. AUDIT SYSTEM ARCHITECTURE

168
169

7.2. INSTALLING THE AUDIT PACKAGES

170

7.3. CONFIGURING THE AUDIT SERVICE

170

7.3.1. Configuring auditd for a CAPP Environment
7.4. STARTING THE AUDIT SERVICE

170
171

7.5. DEFINING AUDIT RULES
7.5.1. Defining Audit Rules with the auditctl Utility
Defining Control Rules

172
172
172

Defining File System Rules
Defining System Call Rules

173
174

7.5.2. Defining Persistent Audit Rules and Controls in the /etc/audit/audit.rules File
Defining Control Rules

175
175

Defining File System and System Call Rules
Preconfigured Rules Files
7.6. UNDERSTANDING AUDIT LOG FILES
First Record
Second Record

176
176
177
177
179

Third Record
7.7. SEARCHING THE AUDIT LOG FILES
7.8. CREATING AUDIT REPORTS

180
181
182

7.9. CONFIGURING PAM FOR AUDITING
7.9.1. Configuring pam_tty_audit

183
183

7.10. ADDITIONAL RESOURCES
Online Sources
Installed Documentation

184
184
184

Manual Pages

184

.CHAPTER
. . . . . . . . .8.. .COMPLIANCE
. . . . . . . . . . . . AND
. . . . .VULNERABILITY
. . . . . . . . . . . . . . .SCANNING
. . . . . . . . . .WITH
. . . . .OPENSCAP
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .186
............
8.1. SECURITY COMPLIANCE IN RED HAT ENTERPRISE LINUX
186
8.2. DEFINING COMPLIANCE POLICY
8.2.1. The XCCDF File Format
8.2.2. The OVAL File Format

186
188
190

8.2.3. The Data Stream Format
8.3. USING SCAP WORKBENCH

193
194

8.3.1. Installing SCAP Workbench
8.3.2. Running SCAP Workbench

194
195

Table of Contents
8.3.3. Scanning the System
8.3.4. Customizing Security Profiles

198
199

8.3.5. Saving SCAP Content
8.3.6. Viewing Scan Results and Generating Scan Reports

201
202

8.4. USING OSCAP
8.4.1. Installing oscap
8.4.2. Displaying SCAP Content

203
203
205

8.4.3. Scanning the System
8.4.4. Generating Reports and Guides

206
207

8.4.5. Validating SCAP Content
8.4.6. Using OpenSCAP to Remediate the System
8.4.6.1. OpenSCAP Online Remediation

209
209
210

8.4.6.2. OpenSCAP Offline Remediation
8.4.6.3. OpenSCAP Remediation Review
8.5. USING OPENSCAP WITH RED HAT SATELLITE
8.6. INSTALLING USGCB-COMPLIANT SYSTEM WITH KICKSTART
8.7. PRACTICAL EXAMPLES
8.7.1. Auditing Security Vulnerabilities of Red Hat Products
8.7.2. Auditing System Settings with SCAP Security Guide
8.8. ADDITIONAL RESOURCES
Installed Documentation
Online Documentation

210
210
211
211
211
211
212
212
212
212

. . . . . . . . . .9.. .CHECKING
CHAPTER
. . . . . . . . . .INTEGRITY
. . . . . . . . . .WITH
. . . . . AIDE
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .214
............
9.1. INTRODUCTION
9.2. INSTALLING AIDE

214
214

9.3. PERFORMING INTEGRITY CHECKS
9.4. UPDATING AN AIDE DATABASE

214
215

9.5. ADDITIONAL RESOURCES

215

.CHAPTER
. . . . . . . . .10.
. . .FEDERAL
. . . . . . . . .STANDARDS
. . . . . . . . . . . .AND
. . . .REGULATIONS
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .216
............
10.1. INTRODUCTION
216
10.2. FEDERAL INFORMATION PROCESSING STANDARD (FIPS)
216
10.2.1. Enabling FIPS Mode
10.2.2. Enabling FIPS Mode for Applications Using NSS
10.3. NATIONAL INDUSTRIAL SECURITY PROGRAM OPERATING MANUAL (NISPOM)
10.4. PAYMENT CARD INDUSTRY DATA SECURITY STANDARD (PCI DSS)
10.5. SECURITY TECHNICAL IMPLEMENTATION GUIDE

216
218
218
218
218

. . . . . . . . . .11.
CHAPTER
. . .REFERENCES
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .220
............
. . . . . . . . . . A.
APPENDIX
. . .ENCRYPTION
. . . . . . . . . . . .STANDARDS
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .222
............
A.1. SYNCHRONOUS ENCRYPTION
A.1.1. Advanced Encryption Standard - AES
A.1.1.1. AES History
A.1.2. Data Encryption Standard - DES
A.1.2.1. DES History
A.2. PUBLIC-KEY ENCRYPTION
A.2.1. Diffie-Hellman

222
222
222
222
222
222
223

A.2.1.1. Diffie-Hellman History
A.2.2. RSA
A.2.3. DSA

223
223
224

A.2.4. SSL/TLS
A.2.5. Cramer-Shoup Cryptosystem

224
224

Security Guide
A.2.6. ElGamal Encryption

224

. . . . . . . . . . B.
APPENDIX
. . .AUDIT
. . . . . .SYSTEM
. . . . . . . REFERENCE
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .226
............
B.1. AUDIT EVENT FIELDS
B.2. AUDIT RECORD TYPES

226
231

. . . . . . . . . . C.
APPENDIX
. . .REVISION
. . . . . . . . .HISTORY
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .239
............

Table of Contents

Security Guide

CHAPTER 1. SECURITY OVERVIEW
Due to the increased reliance on powerful, networked computers to help run businesses and keep track
of our personal information, entire industries have been formed around the practice of network and
computer security. Enterprises have solicited the knowledge and skills of security experts to properly
audit systems and tailor solutions to fit the operating requirements of their organization. Because most
organizations are increasingly dynamic in nature, their workers are accessing critical company IT
resources locally and remotely, hence the need for secure computing environments has become more
pronounced.
Unfortunately, many organizations (as well as individual users) regard security as more of an
afterthought, a process that is overlooked in favor of increased power, productivity, convenience, ease of
use, and budgetary concerns. Proper security implementation is often enacted postmortem — after an
unauthorized intrusion has already occurred. Taking the correct measures prior to connecting a site to an
untrusted network, such as the Internet, is an effective means of thwarting many attempts at intrusion.

NOTE
This document makes several references to files in the /lib directory. When using 64-bit
systems, some of the files mentioned may instead be located in /lib64.

1.1. INTRODUCTION TO SECURITY
1.1.1. What is Computer Security?
Computer security is a general term that covers a wide area of computing and information processing.
Industries that depend on computer systems and networks to conduct daily business transactions and
access critical information regard their data as an important part of their overall assets. Several terms
and metrics have entered our daily business vocabulary, such as total cost of ownership (TCO), return
on investment (ROI), and quality of service (QoS). Using these metrics, industries can calculate aspects
such as data integrity and high-availability (HA) as part of their planning and process management costs.
In some industries, such as electronic commerce, the availability and trustworthiness of data can mean
the difference between success and failure.

1.1.1.1. How did Computer Security come about?
Information security has evolved over the years due to the increasing reliance on public networks not to
disclose personal, financial, and other restricted information. There are numerous instances such as the
Mitnick[1] and the Vladimir Levin[2] cases that prompted organizations across all industries to re-think the
way they handle information, including its transmission and disclosure. The popularity of the Internet was
one of the most important developments that prompted an intensified effort in data security.
An ever-growing number of people are using their personal computers to gain access to the resources
that the Internet has to offer. From research and information retrieval to electronic mail and commerce
transactions, the Internet has been regarded as one of the most important developments of the 20th
century.
The Internet and its earlier protocols, however, were developed as a trust-based system. That is, the
Internet Protocol (IP) was not designed to be secure in itself. There are no approved security standards
built into the TCP/IP communications stack, leaving it open to potentially malicious users and processes
across the network. Modern developments have made Internet communication more secure, but there
are still several incidents that gain national attention and alert us to the fact that nothing is completely
safe.

CHAPTER 1. SECURITY OVERVIEW

1.1.1.2. Security Today
In February of 2000, a Distributed Denial of Service (DDoS) attack was unleashed on several of the most
heavily-trafficked sites on the Internet. The attack rendered yahoo.com, cnn.com, amazon.com, fbi.gov,
and several other sites completely unreachable to normal users, as it tied up routers for several hours
with large-byte ICMP packet transfers, also called a ping flood. The attack was brought on by unknown
attackers using specially created, widely available programs that scanned vulnerable network servers,
installed client applications called Trojans on the servers. Then they timed an attack with every infected
server flooding the victim sites and rendering them unavailable. Many blame the attack on fundamental
flaws in the way routers and the protocols used are structured to accept all incoming data, regardless of
the purpose of the packets or where they were sent to.will possibly be removed
In 2007, a data breach exploiting the widely-known weaknesses of the Wired Equivalent Privacy (WEP)
wireless encryption protocol resulted in the theft from a global financial institution of over 45 million credit
card numbers.
Unfortunately, system and network security can be a difficult proposition, requiring an intricate
knowledge of how an organization regards, uses, manipulates, and transmits its information.
Understanding the way an organization (and the people who make up the organization) conducts
business is paramount to implementing a proper security plan.

1.1.1.3. Standardizing Security
Enterprises in every industry rely on regulations and rules that are set by standards-making bodies such
as the American Medical Association (AMA) or the Institute of Electrical and Electronics Engineers
(IEEE). The same ideals hold true for information security. Many security consultants and vendors agree
upon the standard security model known as CIA, or Confidentiality, Integrity, and Availability. This threetiered model is a generally accepted component to assessing risks of sensitive information and
establishing security policy. The following describes the CIA model in further detail:
Confidentiality — Sensitive information must be available only to a set of pre-defined individuals.
Unauthorized transmission and usage of information should be restricted. For example,
confidentiality of information ensures that a customer's personal or financial information is not
obtained by an unauthorized individual for malicious purposes such as identity theft or credit
fraud.
Integrity — Information should not be altered in ways that render it incomplete or incorrect.
Unauthorized users should be restricted from the ability to modify or destroy sensitive
information.
Availability — Information should be accessible to authorized users any time that it is needed.
Availability is a warranty that information can be obtained with an agreed-upon frequency and
timeliness. This is often measured in terms of percentages and agreed to formally in Service
Level Agreements (SLAs) used by network service providers and their enterprise clients.

1.1.2. SELinux
Red Hat Enterprise Linux includes an enhancement to the Linux kernel called SELinux, which
implements a Mandatory Access Control (MAC) architecture that provides a fine-grained level of control
over files, processes, users and applications in the system. Detailed discussion of SELinux is beyond the
scope of this document; however, for more information on SELinux and its use in Red Hat
Enterprise Linux, see the Red Hat Enterprise Linux SELinux User Guide. For more information on
configuring and running services that are protected by SELinux, see the SELinux Managing Confined
Services Guide. Other available resources for SELinux are listed in Chapter 11, References.

Security Guide

1.1.3. Security Controls
Computer security is often divided into three distinct master categories, commonly referred to as
controls:
Physical
Technical
Administrative
These three broad categories define the main objectives of proper security implementation. Within these
controls are sub-categories that further detail the controls and how to implement them.

1.1.3.1. Physical Controls
Physical control is the implementation of security measures in a defined structure used to deter or
prevent unauthorized access to sensitive material. Examples of physical controls are:
Closed-circuit surveillance cameras
Motion or thermal alarm systems
Security guards
Picture IDs
Locked and dead-bolted steel doors
Biometrics (includes fingerprint, voice, face, iris, handwriting, and other automated methods
used to recognize individuals)

1.1.3.2. Technical Controls
Technical controls use technology as a basis for controlling the access and usage of sensitive data
throughout a physical structure and over a network. Technical controls are far-reaching in scope and
encompass such technologies as:
Encryption
Smart cards
Network authentication
Access control lists (ACLs)
File integrity auditing software

1.1.3.3. Administrative Controls
Administrative controls define the human factors of security. They involve all levels of personnel within an
organization and determine which users have access to what resources and information by such means
as:
Training and awareness
Disaster preparedness and recovery plans

CHAPTER 1. SECURITY OVERVIEW

Personnel recruitment and separation strategies
Personnel registration and accounting

1.1.4. Conclusion
Now that you have learned about the origins, reasons, and aspects of security, you will find it easier to
determine the appropriate course of action with regard to Red Hat Enterprise Linux. It is important to
know what factors and conditions make up security in order to plan and implement a proper strategy.
With this information in mind, the process can be formalized and the path becomes clearer as you delve
deeper into the specifics of the security process.

1.2. VULNERABILITY ASSESSMENT
Given time, resources, and motivation, an attacker can break into nearly any system. All of the security
procedures and technologies currently available cannot guarantee that any systems are completely safe
from intrusion. Routers help secure gateways to the Internet. Firewalls help secure the edge of the
network. Virtual Private Networks safely pass data in an encrypted stream. Intrusion detection systems
warn you of malicious activity. However, the success of each of these technologies is dependent upon a
number of variables, including:
The expertise of the staff responsible for configuring, monitoring, and maintaining the
technologies.
The ability to patch and update services and kernels quickly and efficiently.
The ability of those responsible to keep constant vigilance over the network.
Given the dynamic state of data systems and technologies, securing corporate resources can be quite
complex. Due to this complexity, it is often difficult to find expert resources for all of your systems. While
it is possible to have personnel knowledgeable in many areas of information security at a high level, it is
difficult to retain staff who are experts in more than a few subject areas. This is mainly because each
subject area of information security requires constant attention and focus. Information security does not
stand still.

1.2.1. Thinking Like the Enemy
Suppose that you administer an enterprise network. Such networks commonly comprise operating
systems, applications, servers, network monitors, firewalls, intrusion detection systems, and more. Now
imagine trying to keep current with each of those. Given the complexity of today's software and
networking environments, exploits and bugs are a certainty. Keeping current with patches and updates
for an entire network can prove to be a daunting task in a large organization with heterogeneous
systems.
Combine the expertise requirements with the task of keeping current, and it is inevitable that adverse
incidents occur, systems are breached, data is corrupted, and service is interrupted.
To augment security technologies and aid in protecting systems, networks, and data, you must think like
an attacker and gauge the security of your systems by checking for weaknesses. Preventative
vulnerability assessments against your own systems and network resources can reveal potential issues
that can be addressed before an attacker exploits it.
A vulnerability assessment is an internal audit of your network and system security; the results of which
indicate the confidentiality, integrity, and availability of your network (as explained in Section 1.1.1.3,
“Standardizing Security”). Typically, vulnerability assessment starts with a reconnaissance phase, during

Security Guide

which important data regarding the target systems and resources is gathered. This phase leads to the
system readiness phase, whereby the target is essentially checked for all known vulnerabilities. The
readiness phase culminates in the reporting phase, where the findings are classified into categories of
high, medium, and low risk; and methods for improving the security (or mitigating the risk of vulnerability)
of the target are discussed.
If you were to perform a vulnerability assessment of your home, you would likely check each door to your
home to see if they are closed and locked. You would also check every window, making sure that they
closed completely and latch correctly. This same concept applies to systems, networks, and electronic
data. Malicious users are the thieves and vandals of your data. Focus on their tools, mentality, and
motivations, and you can then react swiftly to their actions.

1.2.2. Defining Assessment and Testing
Vulnerability assessments may be broken down into one of two types: outside looking in and inside
looking around.
When performing an outside-looking-in vulnerability assessment, you are attempting to compromise your
systems from the outside. Being external to your company provides you with the attacker's viewpoint.
You see what an attacker sees — publicly-routable IP addresses, systems on your DMZ, external
interfaces of your firewall, and more. DMZ stands for "demilitarized zone", which corresponds to a
computer or small subnetwork that sits between a trusted internal network, such as a corporate private
LAN, and an untrusted external network, such as the public Internet. Typically, the DMZ contains devices
accessible to Internet traffic, such as Web (HTTP) servers, FTP servers, SMTP (e-mail) servers and
DNS servers.
When you perform an inside-looking-around vulnerability assessment, you are at an advantage since
you are internal and your status is elevated to trusted. This is the viewpoint you and your co-workers
have once logged on to your systems. You see print servers, file servers, databases, and other
resources.
There are striking distinctions between the two types of vulnerability assessments. Being internal to your
company gives you more privileges than an outsider. In most organizations, security is configured to
keep intruders out. Very little is done to secure the internals of the organization (such as departmental
firewalls, user-level access controls, and authentication procedures for internal resources). Typically,
there are many more resources when looking around inside as most systems are internal to a company.
Once you are outside the company, your status is untrusted. The systems and resources available to you
externally are usually very limited.
Consider the difference between vulnerability assessments and penetration tests. Think of a vulnerability
assessment as the first step to a penetration test. The information gleaned from the assessment is used
for testing. Whereas the assessment is undertaken to check for holes and potential vulnerabilities, the
penetration testing actually attempts to exploit the findings.
Assessing network infrastructure is a dynamic process. Security, both information and physical, is
dynamic. Performing an assessment on the system shows an overview, which can turn up false positives
and false negatives. A false positive is a result, where the tool finds vulnerabilities which in reality do not
exist. A false negative is when it omits actual vulnerabilities.
Security administrators are only as good as the tools they use and the knowledge they retain. Take any
of the assessment tools currently available, run them against your system, and it is almost a guarantee
that there are some false positives. Whether by program fault or user error, the result is the same. The
tool may find false positives, or, even worse, false negatives.

CHAPTER 1. SECURITY OVERVIEW

Now that the difference between a vulnerability assessment and a penetration test is defined, take the
findings of the assessment and review them carefully before conducting a penetration test as part of your
new best practices approach.



WARNING
Do not attempt to exploit vulnerabilities on production systems. Doing so can have
adverse effects on productivity and efficiency of your systems and network.

The following list examines some of the benefits to performing vulnerability assessments.
Creates proactive focus on information security.
Finds potential exploits before attackers find them.
Results in systems being kept up to date and patched.
Promotes growth and aids in developing staff expertise.
Abates financial loss and negative publicity.

1.2.2.1. Establishing a Methodology
To aid in the selection of tools for a vulnerability assessment, it is helpful to establish a vulnerability
assessment methodology. Unfortunately, there is no predefined or industry approved methodology at this
time; however, common sense and best practices can act as a sufficient guide.
What is the target? Are we looking at one server, or are we looking at our entire network and everything
within the network? Are we external or internal to the company? The answers to these questions are
important as they help determine not only which tools to select but also the manner in which they are
used.
To learn more about establishing methodologies, see the following websites:
http://www.owasp.org/ The Open Web Application Security Project

1.2.3. Evaluating the Tools
An assessment can start by using some form of an information gathering tool. When assessing the entire
network, map the layout first to find the hosts that are running. Once located, examine each host
individually. Focusing on these hosts requires another set of tools. Knowing which tools to use may be
the most crucial step in finding vulnerabilities.
Just as in any aspect of everyday life, there are many different tools that perform the same job. This
concept applies to performing vulnerability assessments as well. There are tools specific to operating
systems, applications, and even networks (based on the protocols used). Some tools are free; others are
not. Some tools are intuitive and easy to use, while others are cryptic and poorly documented but have
features that other tools do not.
Finding the right tools may be a daunting task and in the end, experience counts. If possible, set up a test
lab and try out as many tools as you can, noting the strengths and weaknesses of each. Read

Security Guide

documentation that comes with the tool (for example, in a README file or a manual page). For more
information, search articles, step-by-step guides, or even mailing lists specific to a tool on the Internet.
The tools discussed below are just a small sampling of the available tools.

1.2.3.1. Scanning Hosts with Nmap
Nmap is a popular tool that can be used to determine the layout of a network. Nmap has been available
for many years and is probably the most often used tool when gathering information. An excellent manual
page is included that provides detailed descriptions of its options and usage. Administrators can use
Nmap on a network to find host systems and open ports on those systems.
Nmap is a competent first step in vulnerability assessment. You can map out all the hosts within your
network and even pass an option that allows Nmap to attempt to identify the operating system running on
a particular host. Nmap is a good foundation for establishing a policy of using secure services and
restricting unused services.
To install Nmap, run the yum install nmap command as the root user.
1.2.3.1.1. Using Nmap
Nmap can be run from a shell prompt by typing the nmap command followed by the host name or IP
address of the machine to scan:
nmap
For example, to scan a machine with host name foo.example.com, type the following at a shell
prompt:
~]$ nmap foo.example.com
The results of a basic scan (which could take up to a few minutes, depending on where the host is
located and other network conditions) look similar to the following:
Interesting ports on foo.example.com:
Not shown: 1710 filtered ports
PORT
STATE SERVICE
22/tcp open
ssh
53/tcp open
domain
80/tcp open
http
113/tcp closed auth
Nmap tests the most common network communication ports for listening or waiting services. This
knowledge can be helpful to an administrator who wants to close down unnecessary or unused services.
For more information about using Nmap, see the official homepage at the following URL:
http://www.insecure.org/

1.2.3.2. Nessus
Nessus is a full-service security scanner. The plug-in architecture of Nessus allows users to customize it
for their systems and networks. As with any scanner, Nessus is only as good as the signature database
it relies upon. Fortunately, Nessus is frequently updated and features full reporting, host scanning, and

CHAPTER 1. SECURITY OVERVIEW

real-time vulnerability searches. Remember that there could be false positives and false negatives, even
in a tool as powerful and as frequently updated as Nessus.

NOTE
The Nessus client and server software requires a subscription to use. It has been
included in this document as a reference to users who may be interested in using this
popular application.
For more information about Nessus, see the official website at the following URL:
http://www.nessus.org/

1.2.3.3. Nikto
Nikto is an excellent common gateway interface (CGI) script scanner. Nikto not only checks for CGI
vulnerabilities but does so in an evasive manner, so as to elude intrusion detection systems. It comes
with thorough documentation which should be carefully reviewed prior to running the program. If you
have Web servers serving up CGI scripts, Nikto can be an excellent resource for checking the security of
these servers.
More information about Nikto can be found at the following URL:
http://cirt.net/nikto2

1.2.3.4. Anticipating Your Future Needs
Depending upon your target and resources, there are many tools available. There are tools for wireless
networks, Novell networks, Windows systems, Linux systems, and more. Another essential part of
performing assessments may include reviewing physical security, personnel screening, or voice/PBX
network assessment. Concepts such as war walking and wardriving, which involves scanning the
perimeter of your enterprise's physical structures for wireless network vulnerabilities, are some concepts
that you should investigate and, if needed, incorporate into your assessments. Imagination and exposure
are the only limits of planning and conducting vulnerability assessments.

1.3. SECURITY THREATS
To plan and implement a good security strategy, first be aware of some of the issues which determined,
motivated attackers exploit to compromise systems.

1.3.1. Threats to Network Security
Bad practices when configuring the following aspects of a network can increase the risk of attack.

1.3.1.1. Insecure Architectures
A misconfigured network is a primary entry point for unauthorized users. Leaving a trust-based, open
local network vulnerable to the highly-insecure Internet is much like leaving a door ajar in a crime-ridden
neighborhood — nothing may happen for an arbitrary amount of time, but eventually someone exploits
the opportunity.
1.3.1.1.1. Broadcast Networks

Security Guide

System administrators often fail to realize the importance of networking hardware in their security
schemes. Simple hardware such as hubs and routers rely on the broadcast or non-switched principle;
that is, whenever a node transmits data across the network to a recipient node, the hub or router sends a
broadcast of the data packets until the recipient node receives and processes the data. This method is
the most vulnerable to address resolution protocol (ARP) or media access control (MAC) address
spoofing by both outside intruders and unauthorized users on local hosts.
1.3.1.1.2. Centralized Servers
Another potential networking pitfall is the use of centralized computing. A common cost-cutting measure
for many businesses is to consolidate all services to a single powerful machine. This can be convenient
as it is easier to manage and costs considerably less than multiple-server configurations. However, a
centralized server introduces a single point of failure on the network. If the central server is
compromised, it may render the network completely useless or worse, prone to data manipulation or
theft. In these situations, a central server becomes an open door which allows access to the entire
network.

1.3.2. Threats to Server Security
Server security is as important as network security because servers often hold a great deal of an
organization's vital information. If a server is compromised, all of its contents may become available for
the attacker to steal or manipulate at will. The following sections detail some of the main issues.

1.3.2.1. Unused Services and Open Ports
A full installation of Red Hat Enterprise Linux 7 contains 1000+ application and library packages.
However, most server administrators do not opt to install every single package in the distribution,
preferring instead to install a base installation of packages, including several server applications.
A common occurrence among system administrators is to install the operating system without paying
attention to what programs are actually being installed. This can be problematic because unneeded
services may be installed, configured with the default settings, and possibly turned on. This can cause
unwanted services, such as Telnet, DHCP, or DNS, to run on a server or workstation without the
administrator realizing it, which in turn can cause unwanted traffic to the server, or even, a potential
pathway into the system for attackers. Refer To Section 2.2, “Server Security” for information on closing
ports and disabling unused services.

1.3.2.2. Inattentive Administration
Administrators who fail to patch their systems are one of the greatest threats to server security.
According to the SysAdmin, Audit, Network, Security Institute (SANS), the primary cause of computer
security vulnerability is to "assign untrained people to maintain security and provide neither the training
nor the time to make it possible to do the job. This applies as much to inexperienced administrators as it
does to overconfident or amotivated administrators.
Some administrators fail to patch their servers and workstations, while others fail to watch log messages
from the system kernel or network traffic. Another common error is when default passwords or keys to
services are left unchanged. For example, some databases have default administration passwords
because the database developers assume that the system administrator changes these passwords
immediately after installation. If a database administrator fails to change this password, even an
inexperienced attacker can use a widely-known default password to gain administrative privileges to the
database. These are only a few examples of how inattentive administration can lead to compromised
servers.

1.3.2.3. Inherently Insecure Services

CHAPTER 1. SECURITY OVERVIEW

Even the most vigilant organization can fall victim to vulnerabilities if the network services they choose
are inherently insecure. For instance, there are many services developed under the assumption that they
are used over trusted networks; however, this assumption fails as soon as the service becomes
available over the Internet — which is itself inherently untrusted.
One category of insecure network services are those that require unencrypted user names and
passwords for authentication. Telnet and FTP are two such services. If packet sniffing software is
monitoring traffic between the remote user and such a service user names and passwords can be easily
intercepted.
Inherently, such services can also more easily fall prey to what the security industry terms the man-inthe-middle attack. In this type of attack, an attacker redirects network traffic by tricking a cracked name
server on the network to point to his machine instead of the intended server. Once someone opens a
remote session to the server, the attacker's machine acts as an invisible conduit, sitting quietly between
the remote service and the unsuspecting user capturing information. In this way an attacker can gather
administrative passwords and raw data without the server or the user realizing it.
Another category of insecure services include network file systems and information services such as
NFS or NIS, which are developed explicitly for LAN usage but are, unfortunately, extended to include
WANs (for remote users). NFS does not, by default, have any authentication or security mechanisms
configured to prevent an attacker from mounting the NFS share and accessing anything contained
therein. NIS, as well, has vital information that must be known by every computer on a network, including
passwords and file permissions, within a plain text ASCII or DBM (ASCII-derived) database. An attacker
who gains access to this database can then access every user account on a network, including the
administrator's account.
By default, Red Hat Enterprise Linux is released with all such services turned off. However, since
administrators often find themselves forced to use these services, careful configuration is critical. Refer
to Section 2.2, “Server Security” for more information about setting up services in a safe manner.

1.3.3. Threats to Workstation and Home PC Security
Workstations and home PCs may not be as prone to attack as networks or servers, but since they often
contain sensitive data, such as credit card information, they are targeted by system attackers.
Workstations can also be co-opted without the user's knowledge and used by attackers as "slave"
machines in coordinated attacks. For these reasons, knowing the vulnerabilities of a workstation can
save users the headache of reinstalling the operating system, or worse, recovering from data theft.

1.3.3.1. Bad Passwords
Bad passwords are one of the easiest ways for an attacker to gain access to a system. For more on how
to avoid common pitfalls when creating a password, see Section 2.1.3, “Password Security”.

1.3.3.2. Vulnerable Client Applications
Although an administrator may have a fully secure and patched server, that does not mean remote users
are secure when accessing it. For instance, if the server offers Telnet or FTP services over a public
network, an attacker can capture the plain text user names and passwords as they pass over the
network, and then use the account information to access the remote user's workstation.
Even when using secure protocols, such as SSH, a remote user may be vulnerable to certain attacks if
they do not keep their client applications updated. For instance, v.1 SSH clients are vulnerable to an Xforwarding attack from malicious SSH servers. Once connected to the server, the attacker can quietly
capture any keystrokes and mouse clicks made by the client over the network. This problem was fixed in
the v.2 SSH protocol, but it is up to the user to keep track of what applications have such vulnerabilities
and update them as necessary.

Security Guide

Section 2.1, “Workstation Security” discusses in more detail what steps administrators and home users
should take to limit the vulnerability of computer workstations.

1.4. COMMON EXPLOITS AND ATTACKS
Table 1.1, “Common Exploits” details some of the most common exploits and entry points used by
intruders to access organizational network resources. Key to these common exploits are the
explanations of how they are performed and how administrators can properly safeguard their network
against such attacks.
Table 1.1. Common Exploits
Exploit

Description

Notes

Null or Default
Passwords

Leaving administrative passwords blank
or using a default password set by the
product vendor. This is most common in
hardware such as routers and firewalls,
but some services that run on Linux can
contain default administrator passwords
as well (though Red Hat Enterprise Linux
does not ship with them).

Commonly associated with networking
hardware such as routers, firewalls,
VPNs, and network attached storage
(NAS) appliances.

Default Shared
Keys

Secure services sometimes package
default security keys for development or
evaluation testing purposes. If these keys
are left unchanged and are placed in a
production environment on the Internet,
all users with the same default keys have
access to that shared-key resource, and
any sensitive information that it contains.

Most common in wireless access points
and preconfigured secure server
appliances.

IP Spoofing

A remote machine acts as a node on your
local network, finds vulnerabilities with
your servers, and installs a backdoor
program or Trojan horse to gain control
over your network resources.

Spoofing is quite difficult as it involves the
attacker predicting TCP/IP sequence
numbers to coordinate a connection to
target systems, but several tools are
available to assist attackers in performing
such a vulnerability.

Common in many legacy operating
systems, especially those that bundle
services (such as UNIX and Windows.)
Administrators sometimes create
privileged user accounts in a rush and
leave the password null, creating a
perfect entry point for malicious users who
discover the account.

Depends on target system running
services (such as rsh, telnet , FTP
and others) that use source-based
authentication techniques, which are not
recommended when compared to PKI or
other forms of encrypted authentication
used in ssh or SSL/TLS.

CHAPTER 1. SECURITY OVERVIEW

Exploit

Description

Notes

Eavesdropping

Collecting data that passes between two
active nodes on a network by
eavesdropping on the connection
between the two nodes.

This type of attack works mostly with
plain text transmission protocols such as
Telnet, FTP, and HTTP transfers.
Remote attacker must have access to a
compromised system on a LAN in order to
perform such an attack; usually the
attacker has used an active attack (such
as IP spoofing or man-in-the-middle) to
compromise a system on the LAN.
Preventative measures include services
with cryptographic key exchange, onetime passwords, or encrypted
authentication to prevent password
snooping; strong encryption during
transmission is also advised.

Service
Vulnerabilities

An attacker finds a flaw or loophole in a
service run over the Internet; through this
vulnerability, the attacker compromises
the entire system and any data that it may
hold, and could possibly compromise
other systems on the network.

HTTP-based services such as CGI are
vulnerable to remote command execution
and even interactive shell access. Even if
the HTTP service runs as a non-privileged
user such as "nobody", information such
as configuration files and network maps
can be read, or the attacker can start a
denial of service attack which drains
system resources or renders it
unavailable to other users.
Services sometimes can have
vulnerabilities that go unnoticed during
development and testing; these
vulnerabilities (such as buffer overflows,
where attackers crash a service using
arbitrary values that fill the memory buffer
of an application, giving the attacker an
interactive command prompt from which
they may execute arbitrary commands)
can give complete administrative control
to an attacker.
Administrators should make sure that
services do not run as the root user, and
should stay vigilant of patches and errata
updates for applications from vendors or
security organizations such as CERT and
CVE.

Security Guide

Exploit

Description

Notes

Application
Vulnerabilities

Attackers find faults in desktop and
workstation applications (such as e-mail
clients) and execute arbitrary code,
implant Trojan horses for future
compromise, or crash systems. Further
exploitation can occur if the compromised
workstation has administrative privileges
on the rest of the network.

Workstations and desktops are more
prone to exploitation as workers do not
have the expertise or experience to
prevent or detect a compromise; it is
imperative to inform individuals of the
risks they are taking when they install
unauthorized software or open unsolicited
email attachments.

Attacker or group of attackers coordinate
against an organization's network or
server resources by sending unauthorized
packets to the target host (either server,
router, or workstation). This forces the
resource to become unavailable to
legitimate users.

Source packets are usually forged (as
well as rebroadcast), making investigation
as to the true source of the attack difficult.

Denial of Service
(DoS) Attacks

Safeguards can be implemented such
that email client software does not
automatically open or execute
attachments. Additionally, the automatic
update of workstation software using
Red Hat Network or other system
management services can alleviate the
burdens of multi-seat security
deployments.

Advances in ingress filtering (IETF
rfc2267) using iptables and Network
Intrusion Detection Systems such as
snort assist administrators in tracking
down and preventing distributed DoS
attacks.

1.5. SECURITY UPDATES
As security vulnerabilities are discovered, the affected software must be updated in order to limit any
potential security risks. If the software is part of a package within a Red Hat Enterprise Linux distribution
that is currently supported, Red Hat is committed to releasing updated packages that fix the vulnerability
as soon as is possible. Often, announcements about a given security exploit are accompanied with a
patch (or source code that fixes the problem). This patch is then applied to the Red Hat Enterprise Linux
package and tested and released as an errata update. However, if an announcement does not include a
patch, a developer first works with the maintainer of the software to fix the problem. Once the problem is
fixed, the package is tested and released as an errata update.
If an errata update is released for software used on your system, it is highly recommended that you
update the affected packages as soon as possible to minimize the amount of time the system is
potentially vulnerable.

1.5.1. Updating Packages
When updating software on a system, it is important to download the update from a trusted source. An
attacker can easily rebuild a package with the same version number as the one that is supposed to fix
the problem but with a different security exploit and release it on the Internet. If this happens, using
security measures such as verifying files against the original RPM does not detect the exploit. Thus, it is
very important to only download RPMs from trusted sources, such as from Red Hat and to check the
signature of the package to verify its integrity.

CHAPTER 1. SECURITY OVERVIEW

NOTE
Red Hat Enterprise Linux includes a convenient panel icon that displays visible alerts
when there is an update available.

1.5.2. Verifying Signed Packages
All Red Hat Enterprise Linux packages are signed with the Red Hat GPG key. GPG stands for GNU
Privacy Guard, or GnuPG, a free software package used for ensuring the authenticity of distributed files.
For example, a private key (secret key) locks the package while the public key unlocks and verifies the
package. If the public key distributed by Red Hat Enterprise Linux does not match the private key during
RPM verification, the package may have been altered and therefore cannot be trusted.
The RPM utility within Red Hat Enterprise Linux 6 automatically tries to verify the GPG signature of an
RPM package before installing it. If the Red Hat GPG key is not installed, install it from a secure, static
location, such as a Red Hat installation CD-ROM or DVD.
Assuming the disc is mounted in /mnt/cdrom, use the following command as the root user to import it
into the keyring (a database of trusted keys on the system):
~]# rpm --import /mnt/cdrom/RPM-GPG-KEY
Now, the Red Hat GPG key is located in the /etc/pki/rpm-gpg/ directory.
To display a list of all keys installed for RPM verification, execute the following command:
~]# rpm -qa gpg-pubkey*
gpg-pubkey-db42a60e-37ea5438
To display details about a specific key, use the rpm -qi command followed by the output from the
previous command, as in this example:
~]# rpm -qi gpg-pubkey-db42a60e-37ea5438
Name
: gpg-pubkey
Relocations: (not relocatable)
Version
: 2fa658e0
Vendor: (none)
Release
: 45700c69
Build Date: Fri 07 Oct 2011
02:04:51 PM CEST
Install Date: Fri 07 Oct 2011 02:04:51 PM CEST
Build Host: localhost
Group
: Public Keys
Source RPM: (none)
[output truncated]
It is extremely important to verify the signature of the RPM files before installing them to ensure that they
have not been altered from the original source of the packages. To verify all the downloaded packages at
once, issue the following command:
~]# rpm -K /root/updates/*.rpm
alsa-lib-1.0.22-3.el6.x86_64.rpm: rsa sha1 (md5) pgp md5 OK
alsa-utils-1.0.21-3.el6.x86_64.rpm: rsa sha1 (md5) pgp md5 OK
aspell-0.60.6-12.el6.x86_64.rpm: rsa sha1 (md5) pgp md5 OK
For each package, if the GPG key verifies successfully, the command returns gpg OK. If it does not,
make sure you are using the correct Red Hat public key, as well as verifying the source of the content.
Packages that do not pass GPG verification should not be installed, as they may have been altered by a
third party.

Security Guide

After verifying the GPG key and downloading all the packages associated with the errata report, install
the packages as root at a shell prompt.
Alternatively, you may use the Yum utility to verify signed packages. Yum provides secure package
management by enabling GPG signature verification on GPG-signed packages to be turned on for all
package repositories (that is, package sources), or for individual repositories. When signature
verification is enabled, Yum will refuse to install any packages not GPG-signed with the correct key for
that repository. This means that you can trust that the RPM packages you download and install on your
system are from a trusted source, such as Red Hat, and were not modified during transfer.
In order to have automatic GPG signature verification enabled when installing or updating packages via
Yum, ensure you have the following option defined under the [main] section of your /etc/yum.conf
file:
gpgcheck=1

1.5.3. Installing Signed Packages
Installation for most packages can be done safely (except kernel packages) by issuing the following
command as root:
rpm -Uvh …
For example, to install all packages in a new directory, called updates/, under the /tmp directory, run:
~]# rpm -Uvh /tmp/updates/*.rpm
Preparing...
###########################################
[100%]
1:alsa-lib
########################################### [
33%]
2:alsa-utils
########################################### [
67%]
3:aspell
###########################################
[100%]
For kernel packages, as root use the command in the following form:
rpm -ivh
For example, to install kernel-2.6.32-220.el6.x86_64.rpm, type the following at a shell prompt:
~]# rpm -ivh /tmp/updates/kernel-2.6.32-220.el6.x86_64.rpm
Preparing...
###########################################
[100%]
1:kernel
###########################################
[100%]
Once the machine has been safely rebooted using the new kernel, the old kernel may be removed using
the following command:
rpm -e
For instance, to remove kernel-2.6.32-206.el6.x86_64, type:

CHAPTER 1. SECURITY OVERVIEW

~]# rpm -e kernel-2.6.32-206.el6.x86_64
Alternatively, to install packages with Yum, run, as root, the following command:
~]# yum install kernel-2.6.32-220.el6.x86_64.rpm
To install local packages with Yum, run, as root, the following command:
~]# yum localinstall /root/updates/emacs-23.1-21.el6_2.3.x86_64.rpm

NOTE
It is not a requirement that the old kernel be removed. The default boot loader, GRUB,
allows for multiple kernels to be installed, then chosen from a menu at boot time.

IMPORTANT
Before installing any security errata, be sure to read any special instructions contained in
the errata report and execute them accordingly. Refer to Section 1.5.4, “Applying the
Changes” for general instructions about applying the changes made by an errata update.

1.5.4. Applying the Changes
After downloading and installing security errata and updates, it is important to halt usage of the older
software and begin using the new software. How this is done depends on the type of software that has
been updated. The following list itemizes the general categories of software and provides instructions for
using the updated versions after a package upgrade.

NOTE
In general, rebooting the system is the surest way to ensure that the latest version of a
software package is used; however, this option is not always required, or available to the
system administrator.
Applications
User-space applications are any programs that can be initiated by a system user. Typically, such
applications are used only when a user, script, or automated task utility launches them and they do
not persist for long periods of time.
Once such a user-space application is updated, halt any instances of the application on the system
and launch the program again to use the updated version.
Kernel
The kernel is the core software component for the Red Hat Enterprise Linux operating system. It
manages access to memory, the processor, and peripherals as well as schedules all tasks.
Because of its central role, the kernel cannot be restarted without also stopping the computer.
Therefore, an updated version of the kernel cannot be used until the system is rebooted.
Shared Libraries

Security Guide

Shared libraries are units of code, such as glibc, which are used by a number of applications and
services. Applications utilizing a shared library typically load the shared code when the application is
initialized, so any applications using the updated library must be halted and relaunched.
To determine which running applications link against a particular library, use the lsof command:
lsof
For example, to determine which running applications link against the libwrap.so library, type:
~]# lsof /lib64/libwrap.so*
COMMAND
PID
USER FD
TYPE DEVICE SIZE/OFF
NODE NAME
sshd
13600 root mem
REG 253,0
43256 400501
/lib64/libwrap.so.0.7.6
sshd
13603 juan mem
REG 253,0
43256 400501
/lib64/libwrap.so.0.7.6
gnome-set 14898 juan mem
REG 253,0
43256 400501
/lib64/libwrap.so.0.7.6
metacity 14925 juan mem
REG 253,0
43256 400501
/lib64/libwrap.so.0.7.6
[output truncated]
This command returns a list of all the running programs which use TCP wrappers for host access
control. Therefore, any program listed must be halted and relaunched if the tcp_wrappers package
is updated.
SysV Services
SysV services are persistent server programs launched during the boot process. Examples of SysV
services include sshd, vsftpd, and xinetd.
Because these programs usually persist in memory as long as the machine is booted, each updated
SysV service must be halted and relaunched after the package is upgraded. This can be done using
the Services Configuration Tool or by logging into a root shell prompt and issuing the
/sbin/service command:
/sbin/service restart
Replace with the name of the service, such as sshd.
xinetd Services
Services controlled by the xinetd super service only run when a there is an active connection.
Examples of services controlled by xinetd include Telnet, IMAP, and POP3.
Because new instances of these services are launched by xinetd each time a new request is
received, connections that occur after an upgrade are handled by the updated software. However, if
there are active connections at the time the xinetd controlled service is upgraded, they are serviced
by the older version of the software.
To kill off older instances of a particular xinetd controlled service, upgrade the package for the
service then halt all processes currently running. To determine if the process is running, use the ps or
pgrep command and then use the kill or killall command to halt current instances of the
service.

CHAPTER 1. SECURITY OVERVIEW

For example, if security errata imap packages are released, upgrade the packages, then type the
following command as root into a shell prompt:
~]# pgrep -l imap
1439 imapd
1788 imapd
1793 imapd
This command returns all active IMAP sessions. Individual sessions can then be terminated by
issuing the following command as root:
kill
If this fails to terminate the session, use the following command instead:
kill -9
In the previous examples, replace with the process identification number (found in the second
column of the pgrep -l command) for an IMAP session.
To kill all active IMAP sessions, issue the following command:
~]# killall imapd

[1] http://law.jrank.org/pages/3791/Kevin-Mitnick-Case-1999.html
[2] http://www.livinginternet.com/i/ia_hackers_levin.htm

Security Guide

CHAPTER 2. SECURING YOUR NETWORK
2.1. WORKSTATION SECURITY
Securing a Linux environment begins with the workstation. Whether locking down a personal machine or
securing an enterprise system, sound security policy begins with the individual computer. A computer
network is only as secure as its weakest node.

2.1.1. Evaluating Workstation Security
When evaluating the security of a Red Hat Enterprise Linux workstation, consider the following:
BIOS and Boot Loader Security — Can an unauthorized user physically access the machine and
boot into single user or rescue mode without a password?
Password Security — How secure are the user account passwords on the machine?
Administrative Controls — Who has an account on the system and how much administrative
control do they have?
Available Network Services — What services are listening for requests from the network and
should they be running at all?
Personal Firewalls — What type of firewall, if any, is necessary?
Security Enhanced Communication Tools — Which tools should be used to communicate
between workstations and which should be avoided?

2.1.2. BIOS and Boot Loader Security
Password protection for the BIOS (or BIOS equivalent) and the boot loader can prevent unauthorized
users who have physical access to systems from booting using removable media or obtaining root
privileges through single user mode. The security measures you should take to protect against such
attacks depends both on the sensitivity of the information on the workstation and the location of the
machine.
For example, if a machine is used in a trade show and contains no sensitive information, then it may not
be critical to prevent such attacks. However, if an employee's laptop with private, unencrypted SSH keys
for the corporate network is left unattended at that same trade show, it could lead to a major security
breach with ramifications for the entire company.
If the workstation is located in a place where only authorized or trusted people have access, however,
then securing the BIOS or the boot loader may not be necessary.

2.1.2.1. BIOS Passwords
The two primary reasons for password protecting the BIOS of a computer are[3]:
1. Preventing Changes to BIOS Settings — If an intruder has access to the BIOS, they can set it to
boot from a CD-ROM or a flash drive. This makes it possible for an intruder to enter rescue
mode or single user mode, which in turn allows them to start arbitrary processes on the system
or copy sensitive data.

CHAPTER 2. SECURING YOUR NETWORK

2. Preventing System Booting — Some BIOSes allow password protection of the boot process.
When activated, an attacker is forced to enter a password before the BIOS launches the boot
loader.
Because the methods for setting a BIOS password vary between computer manufacturers, consult the
computer's manual for specific instructions.
If you forget the BIOS password, it can either be reset with jumpers on the motherboard or by
disconnecting the CMOS battery. For this reason, it is good practice to lock the computer case if
possible. However, consult the manual for the computer or motherboard before attempting to disconnect
the CMOS battery.
2.1.2.1.1. Securing Non-x86 Platforms
Other architectures use different programs to perform low-level tasks roughly equivalent to those of the
BIOS on x86 systems. For instance, Intel® Itanium™ computers use the Extensible Firmware Interface
(EFI) shell.
For instructions on password protecting BIOS-like programs on other architectures, see the
manufacturer's instructions.

2.1.2.2. Boot Loader Passwords
The primary reasons for password protecting a Linux boot loader are as follows:
1. Preventing Access to Single User Mode — If attackers can boot the system into single user
mode, they are logged in automatically as root without being prompted for the root password.



WARNING
Protecting access to single user mode with a password by editing the
SINGLE parameter in the /etc/sysconfig/init file is not
recommended. An attacker can bypass the password by specifying a
custom initial command (using the init= parameter) on the kernel
command line in GRUB. It is recommended to password-protect the GRUB
boot loader as specified in Section 2.1.2.2.1, “Password Protecting GRUB”.

2. Preventing Access to the GRUB Console — If the machine uses GRUB as its boot loader, an
attacker can use the GRUB editor interface to change its configuration or to gather information
using the cat command.
3. Preventing Access to Insecure Operating Systems — If it is a dual-boot system, an attacker can
select an operating system at boot time (for example, DOS), which ignores access controls and
file permissions.
Red Hat Enterprise Linux 6 includes the GRUB boot loader on the x86 platform. For a detailed look at
GRUB, see the Red Hat Enterprise Linux Installation Guide.
2.1.2.2.1. Password Protecting GRUB

Security Guide

You can configure GRUB to address the first two issues listed in Section 2.1.2.2, “Boot Loader
Passwords” by adding a password directive to its configuration file. To do this, first choose a strong
password, open a shell, log in as root, and then type the following command:
/sbin/grub-md5-crypt
When prompted, type the GRUB password and press Enter. This returns an MD5 hash of the
password.
Next, edit the GRUB configuration file /boot/grub/grub.conf. Open the file and below the timeout
line in the main section of the document, add the following line:
password --md5
Replace with the value returned by /sbin/grub-md5-crypt[4].
The next time the system boots, the GRUB menu prevents access to the editor or command interface
without first pressing p followed by the GRUB password.
Unfortunately, this solution does not prevent an attacker from booting into an insecure operating system
in a dual-boot environment. For this, a different part of the /boot/grub/grub.conf file must be
edited.
Look for the title line of the operating system that you want to secure, and add a line with the lock
directive immediately beneath it.
For a DOS system, the stanza should begin similar to the following:
title DOS
lock



WARNING
A password line must be present in the main section of the
/boot/grub/grub.conf file for this method to work properly. Otherwise, an
attacker can access the GRUB editor interface and remove the lock line.

To create a different password for a particular kernel or operating system, add a lock line to the stanza,
followed by a password line.
Each stanza protected with a unique password should begin with lines similar to the following example:
title DOS
lock
password --md5
2.1.2.2.2. Disabling Interactive Startup

CHAPTER 2. SECURING YOUR NETWORK

Pressing the I key at the beginning of the boot sequence allows you to start up your system interactively.
During an interactive startup, the system prompts you to start up each service one by one. However, this
may allow an attacker who gains physical access to your system to disable the security-related services
and gain access to the system.
To prevent users from starting up the system interactively, as root, disable the PROMPT parameter in the
/etc/sysconfig/init file:
PROMPT=no

2.1.3. Password Security
Passwords are the primary method that Red Hat Enterprise Linux uses to verify a user's identity. This is
why password security is so important for protection of the user, the workstation, and the network.
For security purposes, the installation program configures the system to use Secure Hash Algorithm 512
(SHA512) and shadow passwords. It is highly recommended that you do not alter these settings.
If shadow passwords are deselected during installation, all passwords are stored as a one-way hash in
the world-readable /etc/passwd file, which makes the system vulnerable to offline password cracking
attacks. If an intruder can gain access to the machine as a regular user, he can copy the /etc/passwd
file to his own machine and run any number of password cracking programs against it. If there is an
insecure password in the file, it is only a matter of time before the password attacker discovers it.
Shadow passwords eliminate this type of attack by storing the password hashes in the file
/etc/shadow, which is readable only by the root user.
This forces a potential attacker to attempt password cracking remotely by logging into a network service
on the machine, such as SSH or FTP. This sort of brute-force attack is much slower and leaves an
obvious trail as hundreds of failed login attempts are written to system files. Of course, if the attacker
starts an attack in the middle of the night on a system with weak passwords, the cracker may have
gained access before dawn and edited the log files to cover his tracks.
In addition to format and storage considerations is the issue of content. The single most important thing
a user can do to protect his account against a password cracking attack is create a strong password.

2.1.3.1. Creating Strong Passwords
When creating a secure password, the user must remember that long passwords are stronger than short
and complex ones. It is not a good idea to create a password of just eight characters, even if it contains
digits, special characters and uppercase letters. Password cracking tools, such as John The Ripper, are
optimized for breaking such passwords, which are also hard to remember by a person.
In information theory, entropy is the level of uncertainty associated with a random variable and is
presented in bits. The higher the entropy value, the more secure the password is. According to NIST SP
800-63-1, passwords that are not present in a dictionary comprised of 50000 commonly selected
passwords should have at least 10 bits of entropy. As such, a password that consists of four random
words contains around 40 bits of entropy. A long password consisting of multiple words for added
security is also called a passphrase, for example:
randomword1 randomword2 randomword3 randomword4
If the system enforces the use of uppercase letters, digits, or special characters, the passphrase that
follows the above recommendation can be modified in a simple way, for example by changing the first
character to uppercase and appending "1!". Note that such a modification does not increase the security

Security Guide

of the passphrase significantly.
While there are different approaches to creating a secure password, always avoid the following bad
practices:
Using a single dictionary word, a word in a foreign language, an inverted word, or only numbers.
Using less than 10 characters for a password or passphrase.
Using a sequence of keys from the keyboard layout.
Writing down your passwords.
Using personal information in a password, such as birth dates, anniversaries, family member
names, or pet names.
Using the same passphrase or password on multiple machines.
While creating secure passwords is imperative, managing them properly is also important, especially for
system administrators within larger organizations. The following section details good practices for
creating and managing user passwords within an organization.

2.1.4. Creating User Passwords Within an Organization
If an organization has a large number of users, the system administrators have two basic options
available to force the use of good passwords. They can create passwords for the user, or they can let
users create their own passwords, while verifying the passwords are of acceptable quality.
Creating the passwords for the users ensures that the passwords are good, but it becomes a daunting
task as the organization grows. It also increases the risk of users writing their passwords down.
For these reasons, most system administrators prefer to have the users create their own passwords, but
actively verify that the passwords are good and, in some cases, force users to change their passwords
periodically through password aging.

2.1.4.1. Forcing Strong Passwords
To protect the network from intrusion it is a good idea for system administrators to verify that the
passwords used within an organization are strong ones. When users are asked to create or change
passwords, they can use the command line application passwd, which is Pluggable Authentication
Modules (PAM) aware and therefore checks to see if the password is too short or otherwise easy to
crack. This check is performed using the pam_cracklib.so PAM module. In Red Hat Enterprise Linux,
the pam_cracklib PAM module can be used to check a password's strength against a set of rules. It
can be stacked alongside other PAM modules in the password component of the/etc/pam.d/passwd
file to configure a custom set of rules for user login. The pam_cracklib's routine consists of two parts:
it checks whether the password provided is found in a dictionary, and, if that is not the case, it continues
with a number of additional checks. For a complete list of these checks, see the pam_cracklib(8)
manual page.
Example 2.1. Configuring password strength-checking with pam_cracklib
To require a password with a minimum length of 8 characters, including all four classes of characters,
add the following line to the password section of the /etc/pam.d/passwd file:
password

required

pam_cracklib.so retry=3 minlen=8 minclass=4

CHAPTER 2. SECURING YOUR NETWORK

To set a password strength-check for consecutive or repetitive characters, add the following line to
the password section of the /etc/pam.d/passwd file:
password
required
maxrepeat=3

pam_cracklib.so retry=3 maxsequence=3

In this example, the password entered cannot contain more than 3 consecutive characters, such as
"abcd" or "1234". Additionally, the number of identical consecutive characters is limited to 3.

NOTE
As these checks are not performed for the root user, he can set any password for a
regular user, despite the warning messages.
Since PAM is customizable, it is possible to add more password integrity checkers, such as
pam_passwdqc (available from http://www.openwall.com/passwdqc/) or to write a new module. For a list
of available PAM modules, see http://uw714doc.sco.com/en/SEC_pam/pam-6.html. For more
information about PAM, see the Managing Single Sign-On and Smart Cards guide.
The password check that is performed at the time of their creation does not discover bad passwords as
effectively as running a password cracking program against the passwords.
Many password cracking programs are available that run under Red Hat Enterprise Linux, although none
ship with the operating system. Below is a brief list of some of the more popular password cracking
programs:
John The Ripper — A fast and flexible password cracking program. It allows the use of multiple
word lists and is capable of brute-force password cracking. It is available online at
http://www.openwall.com/john/.
Crack — Perhaps the most well known password cracking software, Crack is also very fast,
though not as easy to use as John The Ripper.
Slurpie — Slurpie is similar to John The Ripper and Crack, but it is designed to run on
multiple computers simultaneously, creating a distributed password cracking attack. It can be
found along with a number of other distributed attack security evaluation tools online at
http://www.ussrback.com/distributed.htm.



WARNING
Always get authorization in writing before attempting to crack passwords within an
organization.

2.1.4.2. Passphrases
Passphrases and passwords are the cornerstone to security in most of today's systems. Unfortunately,
techniques such as biometrics and two-factor authentication have not yet become mainstream in many
systems. If passwords are going to be used to secure a system, then the use of passphrases should be

Security Guide

considered. Passphrases are longer than passwords and provide better protection than a password even
when implemented with non-standard characters such as numbers and symbols.

2.1.4.3. Password Aging
Password aging is another technique used by system administrators to defend against bad passwords
within an organization. Password aging means that after a specified period (usually 90 days), the user is
prompted to create a new password. The theory behind this is that if a user is forced to change his
password periodically, a cracked password is only useful to an intruder for a limited amount of time. The
downside to password aging, however, is that users are more likely to write their passwords down.
There are two primary programs used to specify password aging under Red Hat Enterprise Linux: the
chage command or the graphical User Manager (system-config-users) application.

IMPORTANT
Shadow passwords must be enabled to use the chage command. For more information,
see the Red Hat Enterprise Linux 6 Deployment Guide.
The -M option of the chage command specifies the maximum number of days the password is valid. For
example, to set a user's password to expire in 90 days, use the following command:
chage -M 90
In the above command, replace with the name of the user. To disable password expiration,
it is traditional to use a value of 99999 after the -M option (this equates to a little over 273 years).
For more information on the options available with the chage command, see the table below.
Table 2.1. chage command line options

Option

Description

-d days

Specifies the number of days since January 1, 1970 the password was
changed.

-E date

Specifies the date on which the account is locked, in the format YYYY-MMDD. Instead of the date, the number of days since January 1, 1970 can also
be used.

-I days

Specifies the number of inactive days after the password expiration before
locking the account. If the value is 0 , the account is not locked after the
password expires.

-l

Lists current account aging settings.

-m days

Specify the minimum number of days after which the user must change
passwords. If the value is 0 , the password does not expire.

CHAPTER 2. SECURING YOUR NETWORK

Option

Description

-M days

Specify the maximum number of days for which the password is valid. When
the number of days specified by this option plus the number of days
specified with the -d option is less than the current day, the user must
change passwords before using the account.

-W days

Specifies the number of days before the password expiration date to warn
the user.

You can also use the chage command in interactive mode to modify multiple password aging and
account details. Use the following command to enter interactive mode:
chage
The following is a sample interactive session using this command:
~]# chage juan
Changing the aging information for juan
Enter the new value, or press ENTER for the default
Minimum Password Age [0]: 10
Maximum Password Age [99999]: 90
Last Password Change (YYYY-MM-DD) [2006-08-18]:
Password Expiration Warning [7]:
Password Inactive [-1]:
Account Expiration Date (YYYY-MM-DD) [1969-12-31]:
You can configure a password to expire the first time a user logs in. This forces users to change
passwords immediately.
1. Set up an initial password. There are two common approaches to this step: you can either
assign a default password, or you can use a null password.
To assign a default password, type the following at a shell prompt as root:
passwd username
To assign a null password instead, use the following command:
passwd -d username



WARNING
Using a null password, while convenient, is a highly insecure practice, as
any third party can log in first and access the system using the insecure
user name. Always make sure that the user is ready to log in before
unlocking an account with a null password.

Security Guide

2. Force immediate password expiration by running the following command as root:
chage -d 0 username
This command sets the value for the date the password was last changed to the epoch (January
1, 1970). This value forces immediate password expiration no matter what password aging
policy, if any, is in place.
Upon the initial log in, the user is now prompted for a new password.
You can also use the graphical User Manager application to create password aging policies, as follows.
Note: you need Administrator privileges to perform this procedure.
1. Click the System menu on the Panel, point to Administration and then click Users and
Groups to display the User Manager. Alternatively, type the command system-config-users
at a shell prompt.
2. Click the Users tab, and select the required user in the list of users.
3. Click Properties on the toolbar to display the User Properties dialog box (or choose
Properties on the File menu).
4. Click the Password Info tab, and select the check box for Enable password
expiration.
5. Enter the required value in the Days before change required field, and click OK.

Figure 2.1. Specifying password aging options
screenshot needs to be updated

CHAPTER 2. SECURING YOUR NETWORK

2.1.5. Locking Inactive Accounts
The pam_lastlog PAM module is used to lock out users who have not logged in recently enough, or to
display information about the last login attempt of a user. The module does not perform a check on the
root account, so it is never locked out.
The lastlog command displays the last login of the user, аs opposed to the last command, which
displays all current and previous login sessions. The commands read respectively from the
/var/log/lastlog and /var/log/wtmp files where the data is stored in binary format.
To display the number of failed login attempts prior to the last successful login of a user, add, as
root, the following line to the session section in the /etc/pam.d/login file:
session

optional

pam_lastlog.so silent noupdate showfailed

Account locking due to inactivity can be configured to work for the console, GUI, or both:
To lock out an account after 10 days of inactivity, add, as root, the following line to the auth
section of the /etc/pam.d/login file:
auth

required

pam_lastlog.so inactive=10

To lock out an account for the GNOME desktop environment, add, as root, the following line to
the auth section of the /etc/pam.d/gdm file:
auth

required

pam_lastlog.so inactive=10

NOTE
Note that for other desktop environments, the respective files of those environments
should be edited.

2.1.6. Customizing Access Control
The pam_access PAM module allows an administrator to customize access control based on login
names, host or domain names, or IP addresses. By default, the module reads the access rules from the
/etc/security/access.conf file if no other is specified. For a complete description of the format of
these rules, see the access.conf(5) manual page. By default, in Red Hat Enterprise Linux,
pam_access is included in the /etc/pam.d/crond and /etc/pam.d/atd files.
To deny the user john from accessing system from the console and the graphic desktop environment,
follow these steps:
1. Include the following line in the account section of both /etc/pam.d/login and
/etc/pam.d/gdm-* files:
account

required

pam_access.so

2. Specify the following rule in the /etc/security/access.conf file:
- : john : ALL

Security Guide

This rule prohibits all logins from user john from any location.
To grant access to all users attempting to log in using SSH except the user john from the 1.2.3.4 IP
address, follow these steps:
1. Include the following line in the account section of /etc/pam.d/sshd:
account

required

pam_access.so

2. Specify the following rule in the /etc/security/access.conf file:
+ : ALL EXCEPT john : 1.2.3.4
In order to limit access from other services, the pam_access module should be required in the
respective file in the /etc/pam.d directory.
It is possible to call the pam_access module for all services that call the system wide PAM configuration
files (*-auth files in the /etc/pam.d directory) using the following command:
authconfig --enablepamaccess --update
Alternatively, you can enable the pam_access module using the Authentication Configuration utility. To
start this utility, select System → Administration → Authentication from the top menu. From the
Advanced Options tab, check the "enable local access control option". This will add the pam_access
module to the systemwide PAM configuration.

2.1.7. Time-based Restriction of Access
The pam_time PAM module is used to restrict access during a certain time of the day. It can also be
configured to control access based on specific days of a week, user name, usage of a system service,
and more. By default, the module reads the access rules from the /etc/security/time.conf file.
For a complete description of the format of these rules, see the time.conf(5) manual page.
To restrict all users except the root user from logging in from 05:30 PM to 08:00 AM on Monday till
Friday and Saturday and Sunday, follow these steps:
1. Include the following line in the account section of the /etc/pam.d/login file:
account

required

pam_time.so

2. Specify the following rule in the /etc/security/time.conf file:
login ; tty* ; ALL ; !root ; !Wk1730-0800
To allow user john to use the SSH service during working hours and working days only (starting with
Monday), follow these steps:
1. Add the following line to the /etc/pam.d/sshd file:
account

required

pam_time.so

2. Specify the following rule in the /etc/security/time.conf file:

CHAPTER 2. SECURING YOUR NETWORK

sshd ; tty* ; john ; Wk0800-1730

NOTE
For these configurations to be applied to the desktop environment, the pam_time module
should be included in the corresponding files in the /etc/pam.d directory.

2.1.8. Applying Account Limits
The pam_limits PAM module is used to:
apply limits to user login sessions, such as maximum simultaneous login sessions per user,
specify limits to be set by the ulimit utility,
and specify priority to be set by the nice utility.
By default, the rules are read from the/etc/security/limits.conf file. For a complete description
of the format of these rules, see the limits.conf(5) manual page. Additionally, you can create
individual configuration files in the /etc/security/limits.d directory specifically for certain
applications or services. By default, the pam_limits module is included in a number of files in
the/etc/pam.d/ directory. A default limit of user processes is defined in the
/etc/security/limits.d/90-nproc.conf file to prevent malicious denial of service attacks, such
as fork bombs. To change the default limit of user processes to 50, change the value in the
/etc/security/limits.d/90-nproc.conf, following the format in the file:
* soft nproc 50
Example 2.2. Specifying a maximum number of logins per user
1. To set a maximum number of simultaneous logins for each user in a group called office,
specify the following rule in the /etc/security/limits.conf file:
@office - maxlogins 4
2. The following line should be present by default in /etc/pam.d/system-auth. If not, add it
manually.
session

required

pam_limits.so

2.1.9. Administrative Controls
When administering a home machine, the user must perform some tasks as the root user or by acquiring
effective root privileges through a setuid program, such as sudo or su. A setuid program is one that
operates with the user ID (UID) of the program's owner rather than the user operating the program. Such
programs are denoted by an s in the owner section of a long format listing, as in the following example:
~]$ ls -l /bin/su
-rwsr-xr-x. 1 root root 34904 Mar 10

2011 /bin/su

Security Guide

NOTE
The s may be upper case or lower case. If it appears as upper case, it means that the
underlying permission bit has not been set.
For the system administrators of an organization, however, choices must be made as to how much
administrative access users within the organization should have to their machine. Through a PAM
module called pam_console.so, some activities normally reserved only for the root user, such as
rebooting and mounting removable media are allowed for the first user that logs in at the physical
console (see Managing Single Sign-On and Smart Cards for more information about the
pam_console.so module.) However, other important system administration tasks, such as altering
network settings, configuring a new mouse, or mounting network devices, are not possible without
administrative privileges. As a result, system administrators must decide how much access the users on
their network should receive.

2.1.9.1. Allowing Root Access
If the users within an organization are trusted and computer-literate, then allowing them root access may
not be an issue. Allowing root access by users means that minor activities, like adding devices or
configuring network interfaces, can be handled by the individual users, leaving system administrators
free to deal with network security and other important issues.
On the other hand, giving root access to individual users can lead to the following issues:
Machine Misconfiguration — Users with root access can misconfigure their machines and
require assistance to resolve issues. Even worse, they might open up security holes without
knowing it.
Running Insecure Services — Users with root access might run insecure servers on their
machine, such as FTP or Telnet, potentially putting user names and passwords at risk. These
services transmit this information over the network in plain text.
Running Email Attachments As Root — Although rare, email viruses that affect Linux do exist.
The only time they are a threat, however, is when they are run by the root user.
Keeping the audit trail intact — Because the root account is often shared by multiple users, so
that multiple system administrators can maintain the system, it is impossible to figure out which
of those users was root at a given time. When using separate logins, the account a user logs in
with, as well as a unique number for session tracking purposes, is put into the task structure,
which is inherited by every process that the user starts. When using concurrent logins, the
unique number can be used to trace actions to specific logins. When an action generates an
audit event, it is recorded with the login account and the session associated with that unique
number. Use the aulast command to view these logins and sessions. The --proof option of
the aulast command can be used suggest a specific ausearch query to isolate auditable
events generated by a particular session.

2.1.9.2. Disallowing Root Access
If an administrator is uncomfortable allowing users to log in as root for these or other reasons, the root
password should be kept secret, and access to runlevel one or single user mode should be disallowed
through boot loader password protection (see Section 2.1.2.2, “Boot Loader Passwords” for more
information on this topic.)
The following are four different ways that an administrator can further ensure that root logins are
disallowed:

CHAPTER 2. SECURING YOUR NETWORK

Changing the root shell
To prevent users from logging in directly as root, the system administrator can set the root account's
shell to /sbin/nologin in the /etc/passwd file.
Table 2.2. Disabling the Root Shell
Effects

Does Not Affect

Prevents access to the root shell and logs any such
attempts. The following programs are prevented
from accessing the root account:

Programs that do not require a shell, such as FTP
clients, mail clients, and many setuid programs. The
following programs are not prevented from
accessing the root account:

sudo
FTP clients
Email clients

xdm
su
ssh
scp
sftp

Disabling root access through any console device (tty)
To further limit access to the root account, administrators can disable root logins at the console by
editing the /etc/securetty file. This file lists all devices the root user is allowed to log into. If the
file does not exist at all, the root user can log in through any communication device on the system,
whether through the console or a raw network interface. This is dangerous, because a user can log in
to their machine as root through Telnet, which transmits the password in plain text over the network.
By default, Red Hat Enterprise Linux's /etc/securetty file only allows the root user to log in at the
console physically attached to the machine. To prevent the root user from logging in, remove the
contents of this file by typing the following command at a shell prompt as root:
echo > /etc/securetty
To enable securetty support in the KDM, GDM, and XDM login managers, add the following line:
auth [user_unknown=ignore success=ok ignore=ignore default=bad]
pam_securetty.so
to the files listed below:
/etc/pam.d/gdm
/etc/pam.d/gdm-autologin
/etc/pam.d/gdm-fingerprint

Security Guide

/etc/pam.d/gdm-password
/etc/pam.d/gdm-smartcard
/etc/pam.d/kdm
/etc/pam.d/kdm-np
/etc/pam.d/xdm



WARNING
A blank /etc/securetty file does not prevent the root user from logging in
remotely using the OpenSSH suite of tools because the console is not opened
until after authentication.

Table 2.3. Disabling Root Logins
Effects

Does Not Affect

Prevents access to the root account using the
console or the network. The following programs are
prevented from accessing the root account:

Programs that do not log in as root, but perform
administrative tasks through setuid or other
mechanisms. The following programs are not
prevented from accessing the root account:

su
sudo
ssh
scp
sftp

Disabling root SSH logins
To prevent root logins using the SSH protocol, edit the SSH daemon's configuration file,
/etc/ssh/sshd_config, and change the line that reads:
#PermitRootLogin yes
to read as follows:
PermitRootLogin no
Table 2.4. Disabling Root SSH Logins

CHAPTER 2. SECURING YOUR NETWORK

Effects

Does Not Affect

Prevents root access using the OpenSSH suite of
tools. The following programs are prevented from
accessing the root account:

Programs that are not part of the OpenSSH suite of
tools.

ssh
scp
sftp

Using PAM to limit root access to services
PAM, through the /lib/security/pam_listfile.so module, allows great flexibility in denying
specific accounts. The administrator can use this module to reference a list of users who are not
allowed to log in. To limit root access to a system service, edit the file for the target service in the
/etc/pam.d/ directory and make sure the pam_listfile.so module is required for
authentication.
The following is an example of how the module is used for the vsftpd FTP server in the
/etc/pam.d/vsftpd PAM configuration file (the \ character at the end of the first line is not
necessary if the directive is on a single line):
auth
required
/lib/security/pam_listfile.so
item=user \
sense=deny file=/etc/vsftpd.ftpusers onerr=succeed
This instructs PAM to consult the /etc/vsftpd.ftpusers file and deny access to the service for
any listed user. The administrator can change the name of this file, and can keep separate lists for
each service or use one central list to deny access to multiple services.
If the administrator wants to deny access to multiple services, a similar line can be added to the PAM
configuration files, such as /etc/pam.d/pop and /etc/pam.d/imap for mail clients, or
/etc/pam.d/ssh for SSH clients.
For more information about PAM, see the chapter titled Using Pluggable Authentication Modules
(PAM) in the Red Hat Enterprise Linux Managing Single Sign-On and Smart Cards guide.
Table 2.5. Disabling Root Using PAM

Security Guide

Effects

Does Not Affect

Prevents root access to network services that are
PAM aware. The following services are prevented
from accessing the root account:

Programs and services that are not PAM aware.

2.1.9.3. Enabling Automatic Logouts
When the user is logged in as root, an unattended login session may pose a significant security risk. To
reduce this risk, you can configure the system to automatically log out idle users after a fixed period of
time:
1. Make sure the screen package is installed. You can do so by running the following command as
root:
~]# yum install screen
For more information on how to install packages in Red Hat Enterprise Linux, see the Installing
Packages section in the Red Hat Enterprise Linux 6 Deployment Guide.
2. As root, add the following line at the beginning of the /etc/profile file to make sure the
processing of this file cannot be interrupted:
trap "" 1 2 3 15
3. Add the following lines at the end of the /etc/profile file to start a screen session each time
a user logs in to a virtual console or remotely:
SCREENEXEC="screen"
if [ -w $(tty) ]; then
trap "exec $SCREENEXEC" 1 2 3 15
echo -n 'Starting session in 10 seconds'

CHAPTER 2. SECURING YOUR NETWORK

sleep 10
exec $SCREENEXEC
fi
Note that each time a new session starts, a message will be displayed and the user will have to
wait ten seconds. To adjust the time to wait before starting a session, change the value after the
sleep command.
4. Add the following lines to the /etc/screenrc configuration file to close the screen session
after a given period of inactivity:
idle 120 quit
autodetach off
This will set the time limit to 120 seconds. To adjust this limit, change the value after the idle
directive.
Alternatively, you can configure the system to only lock the session by using the following lines
instead:
idle 120 lockscreen
autodetach off
This way, a password will be required to unlock the session.
The changes take effect the next time a user logs in to the system.

2.1.9.4. Limiting Root Access
Rather than completely denying access to the root user, the administrator may want to allow access only
by setuid programs, such as su or sudo. For more information on su and sudo, see the Red Hat
Enterprise Linux 6 Deployment Guide and the su(1) and sudo(8) man pages.

2.1.9.5. Account Locking
In Red Hat Enterprise Linux 6, the pam_faillock PAM module allows system administrators to lock
out user accounts after a specified number of failed attempts. Limiting user login attempts serves mainly
as a security measure that aims to prevent possible brute force attacks targeted to obtain a user's
account password.
With the pam_faillock module, failed login attempts are stored in a separate file for each user in the
/var/run/faillock directory.

NOTE
The order of lines in the failed attempt log files is important. Any change in this order can
lock all user accounts, including the root user account when the even_deny_root option
is used.
Follow these steps to configure account locking:

Security Guide

1. To lock out any non-root user after three unsuccessful attempts and unlock that user after 10
minutes, add the following lines to the auth section of the /etc/pam.d/system-auth and
/etc/pam.d/password-auth files:
auth
required
deny=3 unlock_time=600
auth
sufficient
auth
[default=die]
unlock_time=600

pam_faillock.so preauth silent audit
pam_unix.so nullok try_first_pass
pam_faillock.so authfail audit deny=3

2. Add the following line to the account section of both files specified in the previous step:
account

required

pam_faillock.so

3. To apply account locking for the root user as well, add the even_deny_root option to the
pam_faillock entries in the /etc/pam.d/system-auth and /etc/pam.d/passwordauth files:
auth
required
pam_faillock.so preauth silent audit
deny=3 even_deny_root unlock_time=600
auth
sufficient
pam_unix.so nullok try_first_pass
auth
[default=die] pam_faillock.so authfail audit deny=3
even_deny_root unlock_time=600
account

required

pam_faillock.so

When user john attempts to log in for the fourth time after failing to log in three times previously, his
account is locked upon the fourth attempt:
[user@localhost ~]$ su - john
Account locked due to 3 failed logins
su: incorrect password
To prevent the system from locking users out even after multiple failed logins, add the following line just
above the line where pam_faillock is called for the first time in both /etc/pam.d/system-auth
and /etc/pam.d/password-auth. Also replace user1, user2, user3 with the actual user names.
auth [success=1 default=ignore] pam_succeed_if.so user in
user1:user2:user3
To view the number of failed attempts per user, run, as root, the following command:
[root@localhost ~]# faillock
john:
When
Type Source
Valid
2013-03-05 11:44:14 TTY
pts/0
V
To unlock a user's account, run, as root, the following command:
faillock --user --reset

CHAPTER 2. SECURING YOUR NETWORK

When modifying authentication configuration using the authconfig utility, the system-auth and
password-auth files are overwritten with the settings from the authconfig utility. This can be avoided
by creating symbolic links in place of the configuration files, which authconfig recognizes and does not
overwrite. In order to use custom settings in the configuration files and authconfig simultaneously,
configure account locking using the following steps:
1. Rename the configuration files:
~]# mv /etc/pam.d/system-auth /etc/pam.d/system-auth-local
~]# mv /etc/pam.d/password-auth /etc/pam.d/password-auth-local
2. Create the following symbolic links:
~]# ln -s /etc/pam.d/system-auth-local /etc/pam.d/system-auth
~]# ln -s /etc/pam.d/password-auth-local /etc/pam.d/password-auth
3. The /etc/pam.d/system-auth-local file should contain the following lines:
auth
required
deny=3 unlock_time=600
auth
include
auth
[default=die]
deny=3 unlock_time=600

pam_faillock.so preauth silent audit

account
account

required
include

pam_faillock.so
system-auth-ac

password

include

system-auth-ac

session

include

system-auth-ac

system-auth-ac
pam_faillock.so authfail silent audit

4. The /etc/pam.d/password-auth-local file should contain the following lines:
auth
required
deny=3 unlock_time=600
auth
include
auth
[default=die]
deny=3 unlock_time=600

pam_faillock.so preauth silent audit

account
account

required
include

pam_faillock.so
password-auth-ac

password

include

system-auth-ac

session

include

system-auth-ac

password-auth-ac
pam_faillock.so authfail silent audit

For more information on various pam_faillock configuration options, see the pam_faillock(8) man
page.

2.1.10. Session Locking
Users may need to leave their workstation unattended for a number of reasons during everyday
operation. This could present an opportunity for an attacker to physically access the machine, especially

Security Guide

in environments with insufficient physical security measures (see Section 1.1.3.1, “Physical Controls”).
Laptops are especially exposed since their mobility interferes with physical security. You can alleviate
these risks by using session locking features which prevent access to the system until a correct
password is entered.

NOTE
The main advantage of locking the screen instead of logging out is that a lock allows the
user's processes (such as file transfers) to continue running. Logging out would stop
these processes.

2.1.10.1. Locking GNOME Using gnome-screensaver-command
The default desktop environment for Red Hat Enterprise Linux 6, GNOME, includes a feature which
allows users to lock their screen at any time. There are several ways to activate the lock:
Press the key combination specified in System → Preferences → Keyboard Shortcuts →
Desktop → Lock screen. The default combination is Ctrl+Alt+L.
Select System → Lock screen on the panel.
Execute the following command from a command line interface:
gnome-screensaver-command -l
All of the techniques described have the same result: the screen saver is activated and the screen is
locked. Users can then press any key to deactivate the screen saver, enter their password and continue
working.
Keep in mind that this function requires the gnome-screensaver process to be running. You can
check whether this is the case by using any command which provides information about processes. For
example, execute the following command from the terminal:
pidof gnome-screensaver
If the gnome-screensaver process is currently running, a number denoting its identification number
(PID) will be displayed on the screen after executing the command. If the process is not currently running,
the command will provide no output at all.
Refer to the gnome-screensaver-command(1) man page for additional information.

IMPORTANT
The means of locking the screen described above rely on manual activation.
Administrators should therefore advise their users to lock their computers every time they
leave them unattended, even if only for a short period of time.
2.1.10.1.1. Automatic Lock on Screen Saver Activation
As the name gnome-screensaver-command suggests, the locking functionality is tied to GNOME's
screen saver. It is possible to tie the lock to the screen saver's activation, locking the workstation every
time it is left unattended for a set period of time. This function is activated by default with a five minute
timeout.

CHAPTER 2. SECURING YOUR NETWORK

To change the automatic locking settings, select System → Preferences → Screensaver on the main
panel. This opens a window which allows setting the timeout period (the Regard the computer as
idle after slider) and activating or deactivating the automatic lock (the Lock screen when
screensaver is active check box).

Figure 2.2. Changing the screen saver preferences

NOTE
Disabling the Activate screensaver when computer is idle option in the
Screensaver Preferences dialog prevents the screen saver from starting
automatically. Automatic locking is therefore disabled as well, but it is still possible to lock
the workstation manually using the techniques described in Section 2.1.10.1, “Locking
GNOME Using gnome-screensaver-command”.
2.1.10.1.2. Remote Session Locking
You can also lock a GNOME session remotely using ssh as long as the target workstation accepts
connections over this protocol. To remotely lock the screen on a machine you have access to, execute
the following command:
ssh -X @ "export DISPLAY=:0; gnome-screensaver-command l"

Security Guide

Replace with your user name and with the IP address of the workstation you want
to lock.
Refer to Section 3.2.2, “Secure Shell” for more information regarding ssh.

2.1.10.2. Locking Virtual Consoles Using vlock
Users may also need to lock a virtual console. This can be done using a utility called vlock. To install
this utility, execute the following command as root:
~]# yum install vlock
After installation, any console session can be locked using the vlock command without any additional
parameters. This locks the currently active virtual console session while still allowing access to the
others. To prevent access to all virtual consoles on the workstation, execute the following:
vlock -a
In this case, vlock locks the currently active console and the -a option prevents switching to other
virtual consoles.
Refer to the vlock(1) man page for additional information.

IMPORTANT
There are several known issues relevant to the version of vlock currently available for
Red Hat Enterprise Linux 6:
The program does not currently allow unlocking consoles using the root
password. Additional information can be found in BZ#895066.
Locking a console does not clear the screen and scrollback buffer, allowing
anyone with physical access to the workstation to view previously issued
commands and any output displayed in the console. Refer to BZ#807369 for
more information.

2.1.11. Available Network Services
While user access to administrative controls is an important issue for system administrators within an
organization, monitoring which network services are active is of paramount importance to anyone who
administers and operates a Linux system.
Many services under Red Hat Enterprise Linux 6 behave as network servers. If a network service is
running on a machine, then a server application (called a daemon), is listening for connections on one or
more network ports. Each of these servers should be treated as a potential avenue of attack.

2.1.11.1. Risks To Services
Network services can pose many risks for Linux systems. Below is a list of some of the primary issues:
Denial of Service Attacks (DoS) — By flooding a service with requests, a denial of service attack
can render a system unusable as it tries to log and answer each request.

CHAPTER 2. SECURING YOUR NETWORK

Distributed Denial of Service Attack (DDoS) — A type of DoS attack which uses multiple
compromised machines (often numbering in the thousands or more) to direct a coordinated
attack on a service, flooding it with requests and making it unusable.
Script Vulnerability Attacks — If a server is using scripts to execute server-side actions, as Web
servers commonly do, an attacker can attack improperly written scripts. These script vulnerability
attacks can lead to a buffer overflow condition or allow the attacker to alter files on the system.
Buffer Overflow Attacks — Services that connect to ports numbered 0 through 1023 must run as
an administrative user. If the application has an exploitable buffer overflow, an attacker could
gain access to the system as the user running the daemon. Because exploitable buffer overflows
exist, attackers use automated tools to identify systems with vulnerabilities, and once they have
gained access, they use automated rootkits to maintain their access to the system.

NOTE
The threat of buffer overflow vulnerabilities is mitigated in Red Hat Enterprise Linux by
ExecShield, an executable memory segmentation and protection technology supported by
x86-compatible uni- and multi-processor kernels. ExecShield reduces the risk of buffer
overflow by separating virtual memory into executable and non-executable segments. Any
program code that tries to execute outside of the executable segment (such as malicious
code injected from a buffer overflow exploit) triggers a segmentation fault and terminates.
Execshield also includes support for No eXecute (NX) technology on AMD64 platforms
and eXecute Disable (XD) technology on Itanium and Intel® 64 systems. These
technologies work in conjunction with ExecShield to prevent malicious code from running
in the executable portion of virtual memory with a granularity of 4KB of executable code,
lowering the risk of attack from buffer overflow exploits.

IMPORTANT
To limit exposure to attacks over the network, disable all services that are unused.

2.1.11.2. Identifying and Configuring Services
To enhance security, most network services installed with Red Hat Enterprise Linux are turned off by
default. There are, however, some notable exceptions:
cupsd — The default print server for Red Hat Enterprise Linux.
lpd — An alternative print server.
xinetd — A super server that controls connections to a range of subordinate servers, such as
gssftp and telnet.
sendmail — The Sendmail Mail Transport Agent (MTA) is enabled by default, but only listens
for connections from the localhost.
sshd — The OpenSSH server, which is a secure replacement for Telnet.
When determining whether to leave these services running, it is best to use common sense and avoid
taking any risks. For example, if a printer is not available, do not leave cupsd running. The same is true
for portmap. If you do not mount NFSv3 volumes or use NIS (the ypbind service), then portmap
should be disabled.

Security Guide

Figure 2.3. Services Configuration Tool
If unsure of the purpose for a particular service, the Services Configuration Tool has a description field,
illustrated in Figure 2.3, “Services Configuration Tool”, that provides additional information.
Checking which network services are available to start at boot time is not sufficient. It is recommended to
also check which ports are open and listening. Refer to Section 2.2.9, “Verifying Which Ports Are
Listening” for more information.

2.1.11.3. Insecure Services
Potentially, any network service is insecure. This is why turning off unused services is so important.
Exploits for services are routinely revealed and patched, making it very important to regularly update
packages associated with any network service. Refer to Section 1.5, “Security Updates” for more
information.
Some network protocols are inherently more insecure than others. These include any services that:
Transmit Usernames and Passwords Over a Network Unencrypted — Many older protocols,
such as Telnet and FTP, do not encrypt the authentication session and should be avoided
whenever possible.
Transmit Sensitive Data Over a Network Unencrypted — Many protocols transmit data over the
network unencrypted. These protocols include Telnet, FTP, HTTP, and SMTP. Many network
file systems, such as NFS and SMB, also transmit information over the network unencrypted. It
is the user's responsibility when using these protocols to limit what type of data is transmitted.
Remote memory dump services, like netdump, transmit the contents of memory over the
network unencrypted. Memory dumps can contain passwords or, even worse, database entries
and other sensitive information.

CHAPTER 2. SECURING YOUR NETWORK

Other services like finger and rwhod reveal information about users of the system.
Examples of inherently insecure services include rlogin, rsh, telnet, and vsftpd.
All remote login and shell programs (rlogin, rsh, and telnet) should be avoided in favor of SSH.
Refer to Section 2.1.13, “Security Enhanced Communication Tools” for more information about sshd.
FTP is not as inherently dangerous to the security of the system as remote shells, but FTP servers must
be carefully configured and monitored to avoid problems. Refer to Section 2.2.6, “Securing FTP” for more
information about securing FTP servers.
Services that should be carefully implemented and behind a firewall include:
finger
authd (this was called identd in previous Red Hat Enterprise Linux releases.)
netdump
netdump-server
nfs
rwhod
sendmail
smb (Samba)
yppasswdd
ypserv
ypxfrd
More information on securing network services is available in Section 2.2, “Server Security”.
The next section discusses tools available to set up a simple firewall.

2.1.12. Personal Firewalls
After the necessary network services are configured, it is important to implement a firewall.

IMPORTANT
Configure the necessary services and implement a firewall before connecting to the
Internet or any other network that you do not trust.
Firewalls prevent network packets from accessing the system's network interface. If a request is made to
a port that is blocked by a firewall, the request is ignored. If a service is listening on one of these blocked
ports, it does not receive the packets and is effectively disabled. For this reason, ensure that you block
access to ports not in use when configuring a firewall, while not blocking access to ports used by
configured services.
For most users, the best tool for configuring a simple firewall is the graphical firewall configuration tool

Security Guide

which includes Red Hat Enterprise Linux: the Firewall Configuration Tool (system-configfirewall). This tool creates broad iptables rules for a general-purpose firewall using a control panel
interface.
Refer to Section 2.8.2, “Basic Firewall Configuration” for more information about using this application
and its available options.
For advanced users and server administrators, manually configuring a firewall with iptables is
preferable. Refer to Section 2.8, “Firewalls” for more information. Refer to Section 2.8.9, “IPTables” for a
comprehensive guide to the iptables command.

2.1.13. Security Enhanced Communication Tools
As the size and popularity of the Internet has grown, so has the threat of communication interception.
Over the years, tools have been developed to encrypt communications as they are transferred over the
network.
Red Hat Enterprise Linux 6 includes two basic tools that use high-level, public-key-cryptography-based
encryption algorithms to protect information as it travels over the network.
OpenSSH — A free implementation of the SSH protocol for encrypting network communication.
Gnu Privacy Guard (GPG) — A free implementation of the PGP (Pretty Good Privacy)
encryption application for encrypting data.
OpenSSH is a safer way to access a remote machine and replaces older, unencrypted services like
telnet and rsh. OpenSSH includes a network service called sshd and three command line client
applications:
ssh — A secure remote console access client.
scp — A secure remote copy command.
sftp — A secure pseudo-ftp client that allows interactive file transfer sessions.
Refer to Section 3.2.2, “Secure Shell” for more information regarding OpenSSH.

IMPORTANT
Although the sshd service is inherently secure, the service must be kept up-to-date to
prevent security threats. Refer to Section 1.5, “Security Updates” for more information.
GPG is one way to ensure private email communication. It can be used both to email sensitive data over
public networks and to protect sensitive data on hard drives.

2.1.14. Enforcing Read-Only Mounting of Removable Media
To enforce read-only mounting of removable media (such as USB flash disks), the administrator can use
a udev rule to detect removable media and configure them to be mounted read-only using the blockdev
utility. Starting with Red Hat Enterprise Linux 6.7, a special parameter can be also passed to the udisks
disk manager to force read-only mounting of file systems.

CHAPTER 2. SECURING YOUR NETWORK

While the udev rule that triggers the blockdev utility is sufficient for enforcing read-only mounting of
physical media, the udisks parameter can be used to enforce read-only mounting of filesystems on
read-write mounted media.

Using blockdev to Force Read-Only Mounting of Removable Media

To force all removable media to be mounted read-only, create a new udev configuration file named, for
example, 80-readonly-removables.rules in the /etc/udev/rules.d/ directory with the
following content:
SUBSYSTEM=="block",ATTRS{removable}=="1",RUN{program}="/sbin/blockdev -setro %N"
The above udev rule ensures that any newly connected removable block (storage) device is
automatically configured as read-only using the blockdev utility.

Using udisks to Force Read-Only Mounting of Filesystems

To force all file systems to be mounted read-only, a special udisks parameter needs to be set through
udev. Create a new udev configuration file named, for example, 80-udisks.rules in the
/etc/udev/rules.d/ directory with the following content (or add the following lines to this file if it
already exists):
ENV{UDISKS_MOUNT_OPTIONS}="ro,noexec"
ENV{UDISKS_MOUNT_OPTIONS_ALLOW}="noexec,nodev,nosuid,atime,noatime,nodirat
ime,ro,sync,dirsync"
Note that a default 80-udisks.rules file is installed with the udisks package in the
/lib/udev/rules.d/ directory. This file contains the above rules, but they are commented out.
The above udev rules instruct the udisks disk manager to only allow read-only mounting of file
systems. Also, the noexec parameter forbids direct execution of any binaries on the mounted file
systems. This policy is enforced regardless of the way the actual physical device is mounted. That is, file
systems are mounted read-only even on read-write mounted devices.

Applying New udev and udisks Settings

For these settings to take effect, the new udev rules need to be applied. The udev service automatically
detects changes to its configuration files, but new settings are not applied to already existing devices.
Only newly connected devices are affected by the new settings. Therefore, you need to unmount and
unplug all connected removable media to ensure that the new settings are applied to them when they are
next plugged in.
To force udev to re-apply all rules to already existing devices, enter the following command as root:
~# udevadm trigger
Note that forcing udev to re-apply all rules using the above command does not affect any storage
devices that are already mounted.
To force udev to reload all rules (in case the new rules are not automatically detected for some reason),
use the following command:
~# udevadm control --reload

Security Guide

2.2. SERVER SECURITY
When a system is used as a server on a public network, it becomes a target for attacks. Hardening the
system and locking down services is therefore of paramount importance for the system administrator.
Before delving into specific issues, review the following general tips for enhancing server security:
Keep all services current, to protect against the latest threats.
Use secure protocols whenever possible.
Serve only one type of network service per machine whenever possible.
Monitor all servers carefully for suspicious activity.

2.2.1. Securing Services With TCP Wrappers and xinetd
TCP Wrappers provide access control to a variety of services. Most modern network services, such as
SSH, Telnet, and FTP, make use of TCP Wrappers, which stand guard between an incoming request
and the requested service.
The benefits offered by TCP Wrappers are enhanced when used in conjunction with xinetd, a super
server that provides additional access, logging, binding, redirection, and resource utilization control.

NOTE
It is a good idea to use iptables firewall rules in conjunction with TCP Wrappers and
xinetd to create redundancy within service access controls. Refer to Section 2.8,
“Firewalls” for more information about implementing firewalls with iptables commands.
The following subsections assume a basic knowledge of each topic and focus on specific security
options.

2.2.1.1. Enhancing Security With TCP Wrappers
TCP Wrappers are capable of much more than denying access to services. This section illustrates how
they can be used to send connection banners, warn of attacks from particular hosts, and enhance
logging functionality. Refer to the hosts_options man page for information about the TCP Wrapper
functionality and control language. Refer to the xinetd.conf man page available online at
http://linux.die.net/man/5/xinetd.conf for available flags, which act as options you can apply to a service.
2.2.1.1.1. TCP Wrappers and Connection Banners
Displaying a suitable banner when users connect to a service is a good way to let potential attackers
know that the system administrator is being vigilant. You can also control what information about the
system is presented to users. To implement a TCP Wrappers banner for a service, use the banner
option.
This example implements a banner for vsftpd. To begin, create a banner file. It can be anywhere on
the system, but it must have same name as the daemon. For this example, the file is called
/etc/banners/vsftpd and contains the following lines:
220-Hello, %c
220-All activity on ftp.example.com is logged.

CHAPTER 2. SECURING YOUR NETWORK

220-Inappropriate use will result in your access privileges
being removed.
The %c token supplies a variety of client information, such as the user name and hostname, or the user
name and IP address to make the connection even more intimidating.
For this banner to be displayed to incoming connections, add the following line to the
/etc/hosts.allow file:
vsftpd : ALL : banners /etc/banners/
2.2.1.1.2. TCP Wrappers and Attack Warnings
If a particular host or network has been detected attacking the server, TCP Wrappers can be used to
warn the administrator of subsequent attacks from that host or network using the spawn directive.
In this example, assume that an attacker from the 206.182.68.0/24 network has been detected
attempting to attack the server. Place the following line in the /etc/hosts.deny file to deny any
connection attempts from that network, and to log the attempts to a special file:
ALL : 206.182.68.0 : spawn /bin/echo `date` %c %d >>
/var/log/intruder_alert
The %d token supplies the name of the service that the attacker was trying to access.
To allow the connection and log it, place the spawn directive in the /etc/hosts.allow file.

NOTE
Because the spawn directive executes any shell command, it is a good idea to create a
special script to notify the administrator or execute a chain of commands in the event that
a particular client attempts to connect to the server.
2.2.1.1.3. TCP Wrappers and Enhanced Logging
If certain types of connections are of more concern than others, the log level can be elevated for that
service using the severity option.
For this example, assume that anyone attempting to connect to port 23 (the Telnet port) on an FTP
server is an attacker. To denote this, place an emerg flag in the log files instead of the default flag,
info, and deny the connection.
To do this, place the following line in /etc/hosts.deny:
in.telnetd : ALL : severity emerg
This uses the default authpriv logging facility, but elevates the priority from the default value of info to
emerg, which posts log messages directly to the console.

2.2.1.2. Enhancing Security With xinetd
This section focuses on using xinetd to set a trap service and using it to control resource levels
available to any given xinetd service. Setting resource limits for services can help thwart Denial of

Security Guide

Service (DoS) attacks. Refer to the man pages for xinetd and xinetd.conf for a list of available
options.
2.2.1.2.1. Setting a Trap
One important feature of xinetd is its ability to add hosts to a global no_access list. Hosts on this list
are denied subsequent connections to services managed by xinetd for a specified period or until
xinetd is restarted. You can do this using the SENSOR attribute. This is an easy way to block hosts
attempting to scan the ports on the server.
The first step in setting up a SENSOR is to choose a service you do not plan on using. For this example,
Telnet is used.
Edit the file /etc/xinetd.d/telnet and change the flags line to read:
flags

= SENSOR

Add the following line:
deny_time

= 30

This denies any further connection attempts to that port by that host for 30 minutes. Other acceptable
values for the deny_time attribute are FOREVER, which keeps the ban in effect until xinetd is
restarted, and NEVER, which allows the connection and logs it.
Finally, the last line should read:
disable

= no

This enables the trap itself.
While using SENSOR is a good way to detect and stop connections from undesirable hosts, it has two
drawbacks:
It does not work against stealth scans.
An attacker who knows that a SENSOR is running can mount a Denial of Service attack against
particular hosts by forging their IP addresses and connecting to the forbidden port.
2.2.1.2.2. Controlling Server Resources
Another important feature of xinetd is its ability to set resource limits for services under its control.
It does this using the following directives:
cps = — Limits the rate of incoming
connections. This directive takes two arguments:
— The number of connections per second to handle. If the
rate of incoming connections is higher than this, the service is temporarily disabled. The
default value is fifty (50).
— The number of seconds to wait before re-enabling the service after it
has been disabled. The default interval is ten (10) seconds.

CHAPTER 2. SECURING YOUR NETWORK

instances = — Specifies the total number of connections
allowed to a service. This directive accepts either an integer value or UNLIMITED.
per_source = — Specifies the number of connections
allowed to a service by each host. This directive accepts either an integer value or UNLIMITED.
rlimit_as = — Specifies the amount of memory address space the service
can occupy in kilobytes or megabytes. This directive accepts either an integer value or
UNLIMITED.
rlimit_cpu = — Specifies the amount of time in seconds that a
service may occupy the CPU. This directive accepts either an integer value or UNLIMITED.
Using these directives can help prevent any single xinetd service from overwhelming the system,
resulting in a denial of service.

2.2.2. Securing Portmap
The portmap service is a dynamic port assignment daemon for RPC services such as NIS and NFS. It
has weak authentication mechanisms and has the ability to assign a wide range of ports for the services
it controls. For these reasons, it is difficult to secure.

NOTE
Securing portmap only affects NFSv2 and NFSv3 implementations, since NFSv4 no
longer requires it. If you plan to implement an NFSv2 or NFSv3 server, then portmap is
required, and the following section applies.
If running RPC services, follow these basic rules.

2.2.2.1. Protect portmap With TCP Wrappers
It is important to use TCP Wrappers to limit which networks or hosts have access to the portmap
service since it has no built-in form of authentication.
Further, use only IP addresses when limiting access to the service. Avoid using hostnames, as they can
be forged by DNS poisoning and other methods.

2.2.2.2. Protect portmap With iptables
To further restrict access to the portmap service, it is a good idea to add iptables rules to the server and
restrict access to specific networks.
Below are two example iptables commands. The first allows TCP connections to the port 111 (used by
the portmap service) from the 192.168.0.0/24 network. The second allows TCP connections to the
same port from the localhost. This is necessary for the sgi_fam service used by Nautilus. All other
packets are dropped.
~]# iptables -A INPUT -p tcp -s ! 192.168.0.0/24 --dport 111 -j DROP
~]# iptables -A INPUT -p tcp -s 127.0.0.1 --dport 111 -j ACCEPT
To similarly limit UDP traffic, use the following command:

Security Guide

~]# iptables -A INPUT -p udp -s ! 192.168.0.0/24 --dport 111 -j DROP

NOTE
Refer to Section 2.8, “Firewalls” for more information about implementing firewalls with
iptables commands.

2.2.3. Securing NIS
The Network Information Service (NIS) is an RPC service, called ypserv, which is used in conjunction
with portmap and other related services to distribute maps of user names, passwords, and other
sensitive information to any computer claiming to be within its domain.
A NIS server is comprised of several applications. They include the following:
/usr/sbin/rpc.yppasswdd — Also called the yppasswdd service, this daemon allows
users to change their NIS passwords.
/usr/sbin/rpc.ypxfrd — Also called the ypxfrd service, this daemon is responsible for
NIS map transfers over the network.
/usr/sbin/yppush — This application propagates changed NIS databases to multiple NIS
servers.
/usr/sbin/ypserv — This is the NIS server daemon.
NIS is somewhat insecure by today's standards. It has no host authentication mechanisms and transmits
all of its information over the network unencrypted, including password hashes. As a result, extreme care
must be taken when setting up a network that uses NIS. This is further complicated by the fact that the
default configuration of NIS is inherently insecure.
It is recommended that anyone planning to implement a NIS server first secure the portmap service as
outlined in Section 2.2.2, “Securing Portmap”, then address the following issues, such as network
planning.

2.2.3.1. Carefully Plan the Network
Because NIS transmits sensitive information unencrypted over the network, it is important the service be
run behind a firewall and on a segmented and secure network. Whenever NIS information is transmitted
over an insecure network, it risks being intercepted. Careful network design can help prevent severe
security breaches.

2.2.3.2. Use a Password-like NIS Domain Name and Hostname
Any machine within a NIS domain can use commands to extract information from the server without
authentication, as long as the user knows the NIS server's DNS hostname and NIS domain name.
For instance, if someone either connects a laptop computer into the network or breaks into the network
from outside (and manages to spoof an internal IP address), the following command reveals the
/etc/passwd map:
ypcat -d -h passwd
If this attacker is a root user, they can obtain the /etc/shadow file by typing the following command:

CHAPTER 2. SECURING YOUR NETWORK

ypcat -d -h shadow

NOTE
If Kerberos is used, the /etc/shadow file is not stored within a NIS map.
To make access to NIS maps harder for an attacker, create a random string for the DNS hostname, such
as o7hfawtgmhwg.domain.com. Similarly, create a different randomized NIS domain name. This
makes it much more difficult for an attacker to access the NIS server.

2.2.3.3. Edit the /var/yp/securenets File
If the /var/yp/securenets file is blank or does not exist (as is the case after a default installation),
NIS listens to all networks. One of the first things to do is to put netmask/network pairs in the file so that
ypserv only responds to requests from the appropriate network.
Below is a sample entry from a /var/yp/securenets file:
255.255.255.0



192.168.0.0

WARNING
Never start a NIS server for the first time without creating the
/var/yp/securenets file.

This technique does not provide protection from an IP spoofing attack, but it does at least place limits on
what networks the NIS server services.

2.2.3.4. Assign Static Ports and Use iptables Rules
All of the servers related to NIS can be assigned specific ports except for rpc.yppasswdd — the
daemon that allows users to change their login passwords. Assigning ports to the other two NIS server
daemons, rpc.ypxfrd and ypserv, allows for the creation of firewall rules to further protect the NIS
server daemons from intruders.
To do this, add the following lines to /etc/sysconfig/network:
YPSERV_ARGS="-p 834"
YPXFRD_ARGS="-p 835"
The following iptables rules can then be used to enforce which network the server listens to for these
ports:
~]# iptables -A INPUT -p ALL -s ! 192.168.0.0/24 --dport 834 -j DROP
~]# iptables -A INPUT -p ALL -s ! 192.168.0.0/24 --dport 835 -j DROP

Security Guide

This means that the server only allows connections to ports 834 and 835 if the requests come from the
192.168.0.0/24 network, regardless of the protocol.

NOTE
Refer to Section 2.8, “Firewalls” for more information about implementing firewalls with
iptables commands.

2.2.3.5. Use Kerberos Authentication
One of the issues to consider when NIS is used for authentication is that whenever a user logs into a
machine, a password hash from the /etc/shadow map is sent over the network. If an intruder gains
access to a NIS domain and sniffs network traffic, they can collect user names and password hashes.
With enough time, a password cracking program can guess weak passwords, and an attacker can gain
access to a valid account on the network.
Since Kerberos uses secret-key cryptography, no password hashes are ever sent over the network,
making the system far more secure. Refer to Managing Single Sign-On and Smart Cards for more
information about Kerberos.

2.2.4. Securing NFS
IMPORTANT
The version of NFS included in Red Hat Enterprise Linux 6, NFSv4, no longer requires
the portmap service as outlined in Section 2.2.2, “Securing Portmap”. NFS traffic now
utilizes TCP in all versions, rather than UDP, and requires it when using NFSv4. NFSv4
now includes Kerberos user and group authentication, as part of the RPCSEC_GSS kernel
module. Information on portmap is still included, since Red Hat Enterprise Linux 6
supports NFSv2 and NFSv3, both of which utilize portmap.

2.2.4.1. Carefully Plan the Network
NFSv2 and NFSv3 traditionally passed data insecurely. All versions of NFS now have the ability to
authenticate (and optionally encrypt) ordinary file system operations using Kerberos. Under NFSv4 all
operations can use Kerberos; under v2 or v3, file locking and mounting still do not use it. When using
NFSv4.0, delegations may be turned off if the clients are behind NAT or a firewall. Refer to the section on
pNFS in the Storage Administration Guide for information on the use of NFSv4.1 to allow delegations to
operate through NAT and firewalls.

2.2.4.2. Securing NFS Mount Options
The use of the mount command in the /etc/fstab file is explained in the Storage Administration
Guide. From a security administration point of view it is worthwhile to note that the NFS mount options
can also be specified in /etc/nfsmount.conf, which can be used to set custom default options.
2.2.4.2.1. Review the NFS Server

CHAPTER 2. SECURING YOUR NETWORK



WARNING
Only export entire file systems. Exporting a subdirectory of a file system can be a
security issue. It is possible in some cases for a client to "break out" of the exported
part of the file system and get to unexported parts (see the section on subtree
checking in the exports(5) man page.

Use the ro option to export the file system as read-only whenever possible to reduce the number of
users able to write to the mounted file system. Only use the rw option when specifically required. Refer
to the man exports(5) page for more information. Allowing write access increases the risk from
symlink attacks for example. This includes temporary directories such as /tmp and /usr/tmp.
Where directories must be mounted with the rw option avoid making them world-writable whenever
possible to reduce risk. Exporting home directories is also viewed as a risk as some applications store
passwords in clear text or weakly encrypted. This risk is being reduced as application code is reviewed
and improved. Some users do not set passwords on their SSH keys so this too means home directories
present a risk. Enforcing the use of passwords or using Kerberos would mitigate that risk.
Restrict exports only to clients that need access. Use the showmount -e command on an NFS server to
review what the server is exporting. Do not export anything that is not specifically required.
Do not use the no_root_squash option and review existing installations to make sure it is not used.
Refer to Section 2.2.4.4, “Do Not Use the no_root_squash Option” for more information.
The secure option is the server-side export option used to restrict exports to “reserved” ports. By
default, the server allows client communication only from “reserved” ports (ports numbered less than
1024), because traditionally clients have only allowed “trusted” code (such as in-kernel NFS clients) to
use those ports. However, on many networks it is not difficult for anyone to become root on some client,
so it is rarely safe for the server to assume that communication from a reserved port is privileged.
Therefore the restriction to reserved ports is of limited value; it is better to rely on Kerberos, firewalls, and
restriction of exports to particular clients.
Most clients still do use reserved ports when possible. However, reserved ports are a limited resource,
so clients (especially those with a large number of NFS mounts) may choose to use higher-numbered
ports as well. Linux clients may do this using the “noresvport” mount option. If you want to allow this on
an export, you may do so with the “insecure” export option.
It is good practice not to allow users to login to a server. While reviewing the above settings on an NFS
server conduct a review of who and what can access the server.
2.2.4.2.2. Review the NFS Client
Use the nosuid option to disallow the use of a setuid program. The nosuid option disables the setuser-identifier or set-group-identifier bits. This prevents remote users from gaining higher
privileges by running a setuid program. Use this option on the client and the server side.
The noexec option disables all executable files on the client. Use this to prevent users from
inadvertently executing files placed in the file system being shared. The nosuid and noexec options
are standard options for most, if not all, file systems.

Security Guide

Use the nodev option to prevent “device-files” from being processed as a hardware device by the client.
The resvport option is a client-side mount option and secure is the corresponding server-side export
option (see explanation above). It restricts communication to a "reserved port". The reserved or "well
known" ports are reserved for privileged users and processes such as the root user. Setting this option
causes the client to use a reserved source port to communicate with the server.
All versions of NFS now support mounting with Kerberos authentication. The mount option to enable this
is: sec=krb5.
NFSv4 supports mounting with Kerberos using krb5i for integrity and krb5p for privacy protection.
These are used when mounting with sec=krb5, but need to be configured on the NFS server. Refer to
the man page on exports (man 5 exports) for more information.
The NFS man page (man 5 nfs) has a “SECURITY CONSIDERATIONS” section which explains the
security enhancements in NFSv4 and contains all the NFS specific mount options.

2.2.4.3. Beware of Syntax Errors
The NFS server determines which file systems to export and which hosts to export these directories to
by consulting the /etc/exports file. Be careful not to add extraneous spaces when editing this file.
For instance, the following line in the /etc/exports file shares the directory /tmp/nfs/ to the host
bob.example.com with read/write permissions.
/tmp/nfs/

bob.example.com(rw)

The following line in the /etc/exports file, on the other hand, shares the same directory to the host
bob.example.com with read-only permissions and shares it to the world with read/write permissions
due to a single space character after the hostname.
/tmp/nfs/

bob.example.com (rw)

It is good practice to check any configured NFS shares by using the showmount command to verify what
is being shared:
showmount -e

2.2.4.4. Do Not Use the no_root_squash Option
By default, NFS shares change the root user to the nfsnobody user, an unprivileged user account. This
changes the owner of all root-created files to nfsnobody, which prevents uploading of programs with
the setuid bit set.
If no_root_squash is used, remote root users are able to change any file on the shared file system and
leave applications infected by Trojans for other users to inadvertently execute.

2.2.4.5. NFS Firewall Configuration
The ports used for NFS are assigned dynamically by rpcbind, which can cause problems when creating
firewall rules. To simplify this process, use the /etc/sysconfig/nfs file to specify which ports are to be
used:

CHAPTER 2. SECURING YOUR NETWORK

MOUNTD_PORT — TCP and UDP port for mountd (rpc.mountd)
STATD_PORT — TCP and UDP port for status (rpc.statd)
LOCKD_TCPPORT — TCP port for nlockmgr (rpc.lockd)
LOCKD_UDPPORT — UDP port nlockmgr (rpc.lockd)
Port numbers specified must not be used by any other service. Configure your firewall to allow the port
numbers specified, as well as TCP and UDP port 2049 (NFS).
Run the rpcinfo -p command on the NFS server to see which ports and RPC programs are being
used.

2.2.5. Securing the Apache HTTP Server
The Apache HTTP Server is one of the most stable and secure services that ships with Red Hat
Enterprise Linux. A large number of options and techniques are available to secure the Apache HTTP
Server — too numerous to delve into deeply here. The following section briefly explains good practices
when running the Apache HTTP Server.
Always verify that any scripts running on the system work as intended before putting them into
production. Also, ensure that only the root user has write permissions to any directory containing scripts
or CGIs. To do this, run the following commands as the root user:
chown root
chmod 755
System administrators should be careful when using the following configuration options (configured in
/etc/httpd/conf/httpd.conf):
FollowSymLinks
This directive is enabled by default, so be sure to use caution when creating symbolic links to the
document root of the Web server. For instance, it is a bad idea to provide a symbolic link to /.
Indexes
This directive is enabled by default, but may not be desirable. To prevent visitors from browsing files
on the server, remove this directive.
UserDir
The UserDir directive is disabled by default because it can confirm the presence of a user account
on the system. To enable user directory browsing on the server, use the following directives:
UserDir enabled
UserDir disabled root
These directives activate user directory browsing for all user directories other than /root/. To add
users to the list of disabled accounts, add a space-delimited list of users on the UserDir disabled
line.
ServerTokens

Security Guide

The ServerTokens directive controls the server response header field which is sent back to clients.
It includes various information which can be customized using the following parameters:
ServerTokens Full (default option) — provides all available information (OS type and
used modules), for example:
Apache/2.0.41 (Unix) PHP/4.2.2 MyMod/1.2
ServerTokens Prod or ServerTokens ProductOnly — provides the following
information:
Apache
ServerTokens Major — provides the following information:
Apache/2
ServerTokens Minor — provides the following information:
Apache/2.0
ServerTokens Min or ServerTokens Minimal — provides the following information:
Apache/2.0.41
ServerTokens OS — provides the following information:
Apache/2.0.41 (Unix)
It is recommended to use the ServerTokens Prod option so that a possible attacker does not gain
any valuable information about your system.

IMPORTANT
Do not remove the IncludesNoExec directive. By default, the Server-Side Includes
(SSI) module cannot execute commands. It is recommended that you do not change this
setting unless absolutely necessary, as it could, potentially, enable an attacker to execute
commands on the system.

Removing httpd Modules

In certain scenarios, it is beneficial to remove certain httpd modules to limit the functionality of the
HTTP Server. To do so, simply comment out the entire line which loads the module you want to remove
in the /etc/httpd/conf/httpd.conf file. For example, to remove the proxy module, comment out
the following line by prepending it with a hash sign:
#LoadModule proxy_module modules/mod_proxy.so
Note that the /etc/httpd/conf.d/ directory contains configuration files which are used to load
modules as well.

CHAPTER 2. SECURING YOUR NETWORK

httpd and SELinux

For information regarding the Apache HTTP Server and SELinux, see the Managing Confined Services
Guide.

2.2.6. Securing FTP
The File Transfer Protocol (FTP) is an older TCP protocol designed to transfer files over a network.
Because all transactions with the server, including user authentication, are unencrypted, it is considered
an insecure protocol and should be carefully configured.
Red Hat Enterprise Linux provides three FTP servers.
gssftpd — A Kerberos-aware xinetd-based FTP daemon that does not transmit
authentication information over the network.
Red Hat Content Accelerator (tux) — A kernel-space Web server with FTP capabilities.
vsftpd — A standalone, security oriented implementation of the FTP service.
The following security guidelines are for setting up the vsftpd FTP service.

2.2.6.1. FTP Greeting Banner
Before submitting a user name and password, all users are presented with a greeting banner. By default,
this banner includes version information useful to attackers trying to identify weaknesses in a system.
To change the greeting banner for vsftpd, add the following directive to the
/etc/vsftpd/vsftpd.conf file:
ftpd_banner=
Replace in the above directive with the text of the greeting message.
For mutli-line banners, it is best to use a banner file. To simplify management of multiple banners, place
all banners in a new directory called /etc/banners/. The banner file for FTP connections in this
example is /etc/banners/ftp.msg. Below is an example of what such a file may look like:
######### Hello, all activity on ftp.example.com is logged. #########

NOTE
It is not necessary to begin each line of the file with 220 as specified in Section 2.2.1.1.1,
“TCP Wrappers and Connection Banners”.
To reference this greeting banner file for vsftpd, add the following directive to the
/etc/vsftpd/vsftpd.conf file:
banner_file=/etc/banners/ftp.msg
It also is possible to send additional banners to incoming connections using TCP Wrappers as described
in Section 2.2.1.1.1, “TCP Wrappers and Connection Banners”.

Security Guide

2.2.6.2. Anonymous Access
The presence of the /var/ftp/ directory activates the anonymous account.
The easiest way to create this directory is to install the vsftpd package. This package establishes a
directory tree for anonymous users and configures the permissions on directories to read-only for
anonymous users.
By default the anonymous user cannot write to any directories.



WARNING
If enabling anonymous access to an FTP server, be aware of where sensitive data is
stored.

Procedure 2.1. Anonymous Upload
1. To allow anonymous users to upload files, it is recommended to create a write-only directory
within the /var/ftp/pub/ directory. Run the following command as root to create such
directory named /upload/:
~]# mkdir /var/ftp/pub/upload
2. Next, change the permissions so that anonymous users cannot view the contents of the
directory:
~]# chmod 730 /var/ftp/pub/upload
A long format listing of the directory should look like this:
~]# ls -ld /var/ftp/pub/upload
drwx-wx---. 2 root ftp 4096 Nov 14 22:57 /var/ftp/pub/upload

NOTE
Administrators who allow anonymous users to read and write in directories often
find that their servers become a repository of stolen software.
3. Under vsftpd, add the following line to the /etc/vsftpd/vsftpd.conf file:
anon_upload_enable=YES
4. In Red Hat Enterprise Linux, the SELinux is running in Enforcing mode by default. Therefore, the
allow_ftpd_anon_write Boolean must be enabled in order to allow vsftpd to upload files:
~]# setsebool -P allow_ftpd_anon_write=1

CHAPTER 2. SECURING YOUR NETWORK

5. Label the /upload/ directory and its files with the public_content_rw_t SELinux context:
~]# semanage fcontext -a -t public_content_rw_t
'/var/ftp/pub/upload(/.*)'

NOTE
The semanage utility is provided by the policycoreutils-python package, which is
not installed by default. To install it, use the following command as root:
~]# yum install policycoreutils-python
6. Use the restorecon utility to change the type of /upload/ and its files:
~]# restorecon -R -v /var/ftp/pub/upload
The directory is now properly labeled with public_content_rw_t so that SELinux in
Enforcing mode allows anonymous users to upload files to it:
~]$ ls -dZ /var/ftp/pub/upload
drwx-wx---. root root unconfined_u:object_r:public_content_t:s0
/var/ftp/pub/upload/
For further information about using SELinux, see the Security-Enhanced Linux User Guide and
Managing Confined Services guides.

2.2.6.3. User Accounts
Because FTP transmits unencrypted user names and passwords over insecure networks for
authentication, it is a good idea to deny system users access to the server from their user accounts.
To disable all user accounts in vsftpd, add the following directive to /etc/vsftpd/vsftpd.conf:
local_enable=NO
2.2.6.3.1. Restricting User Accounts
To disable FTP access for specific accounts or specific groups of accounts, such as the root user and
those with sudo privileges, the easiest way is to use a PAM list file as described in Section 2.1.9.2,
“Disallowing Root Access”. The PAM configuration file for vsftpd is /etc/pam.d/vsftpd.
It is also possible to disable user accounts within each service directly.
To disable specific user accounts in vsftpd, add the user name to /etc/vsftpd/ftpusers

2.2.6.4. Use TCP Wrappers To Control Access
Use TCP Wrappers to control access to either FTP daemon as outlined in Section 2.2.1.1, “Enhancing
Security With TCP Wrappers”.

2.2.7. Securing Postfix

Security Guide

Postfix is a Mail Transfer Agent (MTA) that uses the Simple Mail Transfer Protocol (SMTP) to deliver
electronic messages between other MTAs and to email clients or delivery agents. Although many MTAs
are capable of encrypting traffic between one another, most do not, so sending email over any public
networks is considered an inherently insecure form of communication.
It is recommended that anyone planning to implement a Postfix server address the following issues.

2.2.7.1. Limiting a Denial of Service Attack
Because of the nature of email, a determined attacker can flood the server with mail fairly easily and
cause a denial of service. The effectiveness of such attacks can be limited by setting limits of the
directives in the /etc/postfix/main.cf file. You can change the value of the directives which are
already there or you can add the directives you need with the value you want in the following format:
=
The following is a list of directives that can be used for limiting a denial of service attack:
smtpd_client_connection_rate_limit — The maximum number of connection attempts
any client is allowed to make to this service per time unit (described below). The default value is
0, which means a client can make as many connections per time unit as Postfix can accept. By
default, clients in trusted networks are excluded.
anvil_rate_time_unit — This time unit is used for rate limit calculations. The default value
is 60 seconds.
smtpd_client_event_limit_exceptions — Clients that are excluded from the connection
and rate limit commands. By default, clients in trusted networks are excluded.
smtpd_client_message_rate_limit — The maximum number of message deliveries a
client is allowed to request per time unit (regardless of whether or not Postfix actually accepts
those messages).
default_process_limit — The default maximum number of Postfix child processes that
provide a given service. This limit can be overruled for specific services in the master.cf file.
By default the value is 100.
queue_minfree — The minimum amount of free space in bytes in the queue file system that is
needed to receive mail. This is currently used by the Postfix SMTP server to decide if it will
accept any mail at all. By default, the Postfix SMTP server rejects MAIL FROM commands when
the amount of free space is less than 1.5 times the message_size_limit. To specify a higher
minimum free space limit, specify a queue_minfree value that is at least 1.5 times the
message_size_limit. By default the queue_minfree value is 0.
header_size_limit — The maximum amount of memory in bytes for storing a message
header. If a header is larger, the excess is discarded. By default the value is 102400.
message_size_limit — The maximum size in bytes of a message, including envelope
information. By default the value is 10240000.

2.2.7.2. NFS and Postfix
Never put the mail spool directory, /var/spool/postfix/, on an NFS shared volume.

CHAPTER 2. SECURING YOUR NETWORK

Because NFSv2 and NFSv3 do not maintain control over user and group IDs, two or more users can
have the same UID, and receive and read each other's mail.

NOTE
With NFSv4 using Kerberos, this is not the case, since the SECRPC_GSS kernel module
does not utilize UID-based authentication. However, it is still considered good practice not
to put the mail spool directory on NFS shared volumes.

2.2.7.3. Mail-only Users
To help prevent local user exploits on the Postfix server, it is best for mail users to only access the
Postfix server using an email program. Shell accounts on the mail server should not be allowed and all
user shells in the /etc/passwd file should be set to /sbin/nologin (with the possible exception of
the root user).

2.2.7.4. Disable Postfix Network Listening
By default, Postfix is set up to only listen to the local loopback address. You can verify this by viewing
the file /etc/postfix/main.cf.
View the file /etc/postfix/main.cf to ensure that only the following inet_interfaces line
appears:
inet_interfaces = localhost
This ensures that Postfix only accepts mail messages (such as cron job reports) from the local system
and not from the network. This is the default setting and protects Postfix from a network attack.
For removal of the localhost restriction and allowing Postfix to listen on all interfaces the
inet_interfaces = all setting can be used.

2.2.7.5. Configuring Postfix to Use SASL
The Red Hat Enterprise Linux version of Postfix can use the Dovecot or Cyrus SASL implementations
for SMTP Authentication (or SMTP AUTH). SMTP Authentication is an extension of the Simple Mail
Transfer Protocol. When enabled, SMTP clients are required to authenticate to the SMTP server
using an authentication method supported and accepted by both the server and the client. This section
describes how to configure Postfix to make use of the Dovecot SASL implementation.
To install the Dovecot POP/IMAP server, and thus make the Dovecot SASL implementation available on
your system, issue the following command as the root user:
~]# yum install dovecot
The Postfix SMTP server can communicate with the Dovecot SASL implementation using either a UNIXdomain socket or a TCP socket. The latter method is only needed in case the Postfix and Dovecot
applications are running on separate machines. This guide gives preference to the UNIX-domain socket
method, which affords better privacy.
In order to instruct Postfix to use the Dovecot SASL implementation, a number of configuration changes
need to be performed for both applications. Follow the procedures below to effect these changes.

Security Guide

Setting Up Dovecot
1. Modify the main Dovecot configuration file, /etc/dovecot/conf.d/10-master.conf, to
include the following lines (the default configuration file already includes most of the relevant
section, and the lines just need to be uncommented):
service auth {
unix_listener /var/spool/postfix/private/auth {
mode = 0660
user = postfix
group = postfix
}
}
The above example assumes the use of UNIX-domain sockets for communication between
Postfix and Dovecot. It also assumes default settings of the Postfix SMTP server, which include
the mail queue located in the /var/spool/postfix/ directory, and the application running
under the postfix user and group. In this way, read and write permissions are limited to the
postfix user and group.
Alternatively, you can use the following configuration to set up Dovecot to listen for Postfix
authentication requests via TCP:
service auth {
inet_listener {
port = 12345
}
}
In the above example, replace 12345 with the number of the port you want to use.
2. Edit the /etc/dovecot/conf.d/10-auth.conf configuration file to instruct Dovecot to
provide the Postfix SMTP server with the plain and login authentication mechanisms:
auth_mechanisms = plain login
Setting Up Postfix
In the case of Postfix, only the main configuration file, /etc/postfix/main.cf, needs to be modified.
Add or edit the following configuration directives:
1. Enable SMTP Authentication in the Postfix SMTP server:
smtpd_sasl_auth_enable = yes
2. Instruct Postfix to use the Dovecot SASL implementation for SMTP Authentication:
smtpd_sasl_type = dovecot
3. Provide the authentication path relative to the Postfix queue directory (note that the use of a
relative path ensures that the configuration works regardless of whether the Postfix server runs
in a chroot or not):
smtpd_sasl_path = private/auth

CHAPTER 2. SECURING YOUR NETWORK

This step assumes that you want to use UNIX-domain sockets for communication between
Postfix and Dovecot. To configure Postfix to look for Dovecot on a different machine in case
you use TCP sockets for communication, use configuration values similar to the following:
smtpd_sasl_path = inet:127.0.0.1:12345
In the above example, 127.0.0.1 needs to be substituted by the IP address of the Dovecot
machine and 12345 by the port specified in Dovecot's /etc/dovecot/conf.d/10master.conf configuration file.
4. Specify SASL mechanisms that the Postfix SMTP server makes available to clients. Note that
different mechanisms can be specified for encrypted and unencrypted sessions.
smtpd_sasl_security_options = noanonymous, noplaintext
smtpd_sasl_tls_security_options = noanonymous
The above example specifies that during unencrypted sessions, no anonymous authentication is
allowed and no mechanisms that transmit unencrypted usernames or passwords are allowed.
For encrypted sessions (using TLS), only non-anonymous authentication mechanisms are
allowed.
See http://www.postfix.org/SASL_README.html#smtpd_sasl_security_options for a list of all
supported policies for limiting allowed SASL mechanisms.
Additional Resources
The following online resources provide additional information useful for configuring Postfix SMTP
Authentication through SASL.
http://wiki2.dovecot.org/HowTo/PostfixAndDovecotSASL — Contains information on how to set
up Postfix to use the Dovecot SASL implementation for SMTP Authentication.
http://www.postfix.org/SASL_README.html#server_sasl — Contains information on how to set
up Postfix to use either the Dovecot or Cyrus SASL implementations for SMTP Authentication.

2.2.8. Securing Sendmail
Sendmail is a Mail Transfer Agent (MTA) that uses the Simple Mail Transfer Protocol (SMTP) to deliver
electronic messages between other MTAs and to email clients or delivery agents. Although many MTAs
are capable of encrypting traffic between one another, most do not, so sending email over any public
networks is considered an inherently insecure form of communication.
It is recommended that anyone planning to implement a Sendmail server address the following issues.

2.2.8.1. Limiting a Denial of Service Attack
Because of the nature of email, a determined attacker can flood the server with mail fairly easily and
cause a denial of service. By setting limits to the following directives in /etc/mail/sendmail.mc, the
effectiveness of such attacks is limited.
confCONNECTION_RATE_THROTTLE — The number of connections the server can receive per
second. By default, Sendmail does not limit the number of connections. If a limit is set and
reached, further connections are delayed.

Security Guide

confMAX_DAEMON_CHILDREN — The maximum number of child processes that can be
spawned by the server. By default, Sendmail does not assign a limit to the number of child
processes. If a limit is set and reached, further connections are delayed.
confMIN_FREE_BLOCKS — The minimum number of free blocks which must be available for
the server to accept mail. The default is 100 blocks.
confMAX_HEADERS_LENGTH — The maximum acceptable size (in bytes) for a message
header.
confMAX_MESSAGE_SIZE — The maximum acceptable size (in bytes) for a single message.

2.2.8.2. NFS and Sendmail
Never put the mail spool directory, /var/spool/mail/, on an NFS shared volume. Because NFSv2
and NFSv3 do not maintain control over user and group IDs, two or more users can have the same UID,
and receive and read each other's mail.

2.2.8.3. Mail-only Users
To help prevent local user exploits on the Sendmail server, it is best for mail users to only access the
Sendmail server using an email program. Shell accounts on the mail server should not be allowed and all
user shells in the /etc/passwd file should be set to /sbin/nologin (with the possible exception of
the root user).

2.2.8.4. Disable Sendmail Network Listening
By default, Sendmail is set up to only listen to the local loopback address. You can verify this by viewing
the file /etc/mail/sendmail.mc to ensure that the following line appears:
DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA')dnl
This ensures that Sendmail only accepts mail messages (such as cron job reports) from the local system
and not from the network. This is the default setting and protects Sendmail from a network attack.
For removal of the localhost restriction, the Addr=127.0.0.1 string needs to be removed. Changing
Sendmail's configuration requires installing the sendmail-cf package, then editing the .mc file, running
/etc/mail/make and finally restarting sendmail. The .cf configuration file will be regenerated. Note
that the system clock must be correct and working and that there must not be any system clock time
shifts between these actions in order for the configuration file to be automatically regenerated.

2.2.9. Verifying Which Ports Are Listening
Unnecessary open ports should be avoided because it increases the attack surface of your system. If
after the system has been in service you find unexpected open ports in listening state, that might be
signs of intrusion and it should be investigated.

CHAPTER 2. SECURING YOUR NETWORK

Issue the following command, as root, from the console to determine which ports are listening for
connections from the network:
~]# netstat -tanp | grep LISTEN
tcp
0
0 0.0.0.0:45876
LISTEN
1193/rpc.statd
tcp
0
0 192.168.122.1:53
LISTEN
1241/dnsmasq
tcp
0
0 127.0.0.1:631
LISTEN
1783/cupsd
tcp
0
0 127.0.0.1:25
LISTEN
7696/sendmail
tcp
0
0 0.0.0.0:111
LISTEN
1167/rpcbind
tcp
0
0 127.0.0.1:30003
LISTEN
1118/tcsd
tcp
0
0 :::631
LISTEN
1/init
tcp
0
0 :::35018
LISTEN
1193/rpc.statd
tcp
0
0 :::111
LISTEN
1167/rpcbind

0.0.0.0:*
0.0.0.0:*
0.0.0.0:*
0.0.0.0:*
0.0.0.0:*
0.0.0.0:*
:::*
:::*
:::*

Review the output of the command with the services needed on the system, turn off what is not
specifically required or authorized, repeat the check. Proceed then to make external checks using nmap
from another system connected via the network to the first system. This can be used verify the rules in
iptables. Make a scan for every IP address shown in the netstat output (except for localhost 127.0.0.0
or ::1 range) from an external system. Use the -6 option for scanning an IPv6 address. See man
nmap(1) for more information.
The following is an example of the command to be issued from the console of another system to
determine which ports are listening for TCP connections from the network:
~]# nmap -sT -O 192.168.122.1
See the netstat(8), nmap(1), and services(5) manual pages for more information.

2.2.10. Disable Source Routing
Source routing is an Internet Protocol mechanism that allows an IP packet to carry information, a list of
addresses, that tells a router the path the packet must take. There is also an option to record the hops as
the route is traversed. The list of hops taken, the "route record", provides the destination with a return
path to the source. This allows the source (the sending host) to specify the route, loosely or strictly,
ignoring the routing tables of some or all of the routers. It can allow a user to redirect network traffic for
malicious purposes. Therefore, source-based routing should be disabled.
The accept_source_route option causes network interfaces to accept packets with the Strict Source
Route (SSR) or Loose Source Routing (LSR) option set. The acceptance of source routed packets is
controlled by sysctl settings. Issue the following command as root to drop packets with the SSR or LSR
option set:
~]# /sbin/sysctl -w net.ipv4.conf.all.accept_source_route=0

Security Guide

Disabling the forwarding of packets should also be done in conjunction with the above when possible
(disabling forwarding may interfere with virtualization). Issue the commands listed below as root:
These commands disable forwarding of IPv4 and IPv6 packets on all interfaces.
~]# /sbin/sysctl -w net.ipv4.conf.all.forwarding=0
~]# /sbin/sysctl -w net.ipv6.conf.all.forwarding=0
These commands disable forwarding of all multicast packets on all interfaces.
~]# /sbin/sysctl -w net.ipv4.conf.all.mc_forwarding=0
~]# /sbin/sysctl -w net.ipv6.conf.all.mc_forwarding=0
Accepting ICMP redirects has few legitimate uses. Disable the acceptance and sending of ICMP
redirected packets unless specifically required.
These commands disable acceptance of all ICMP redirected packets on all interfaces.
~]# /sbin/sysctl -w net.ipv4.conf.all.accept_redirects=0
~]# /sbin/sysctl -w net.ipv6.conf.all.accept_redirects=0
This command disables acceptance of secure ICMP redirected packets on all interfaces.
~]# /sbin/sysctl -w net.ipv4.conf.all.secure_redirects=0
This command disables sending of all IPv4 ICMP redirected packets on all interfaces.
~]# /sbin/sysctl -w net.ipv4.conf.all.send_redirects=0
There is only a directive to disable sending of IPv4 redirected packets. Refer to RFC4294 for an
explanation of “IPv6 Node Requirements”, which resulted in this difference between IPv4 and IPv6.
In order to make the settings permanent they must be added to /etc/sysctl.conf.
See the sysctl(8) manual page for more information. Refer to RFC791 for an explanation of the Internet
options related to source based routing and its variants.


76

WARNING
Ethernet networks provide additional ways to redirect traffic, such as ARP or MAC
address spoofing, unauthorized DHCP servers, and IPv6 router or neighbor
advertisements. In addition, unicast traffic is occasionally broadcast, causing
information leaks. These weaknesses can only be addressed by specific
countermeasures implemented by the network operator. Host-based
countermeasures are not fully effective.

CHAPTER 2. SECURING YOUR NETWORK

2.2.11. Reverse Path Forwarding
Reverse Path Forwarding is used to prevent packets that arrived via one interface from leaving via a
different interface. When outgoing routes and incoming routes are different, it is sometimes referred to
as asymmetric routing. Routers often route packets this way, but most hosts should not need to do this.
Exceptions are such applications that involve sending traffic out over one link and receiving traffic over
another link from a different service provider. For example, using leased lines in combination with xDSL
or satellite links with 3G modems. If such a scenario is applicable to you, then turning off reverse path
forwarding on the incoming interface is necessary. In short, unless you know that it is required, it is best
enabled as it prevents users spoofing IP addresses from local subnets and reduces the opportunity for
DDoS attacks.

NOTE
Red Hat Enterprise Linux 6 (unlike Red Hat Enterprise Linux 5) defaults to using Strict
Reverse Path Forwarding. Red Hat Enterprise Linux 6 follows the Strict Reverse Path
recommendation from RFC 3704, Ingress Filtering for Multihomed Networks. This
currently only applies to IPv4 in Red Hat Enterprise Linux 6.



WARNING
If forwarding is enabled, then Reverse Path Forwarding should only be disabled if
there are other means for source-address validation (such as iptables rules for
example).

rp_filter
Reverse Path Forwarding is enabled by means of the rp_filter directive. The rp_filter option
is used to direct the kernel to select from one of three modes.
It takes the following form when setting the default behavior:
~]# /sbin/sysctl -w net.ipv4.conf.default.rp_filter=INTEGER
where INTEGER is one of the following:
0 — No source validation.
1 — Strict mode as defined in RFC 3704.
2 — Loose mode as defined in RFC 3704.
The setting can be overridden per network interface using net.ipv4.interface.rp_filter. To
make these settings persistent across reboot, modify the /etc/sysctl.conf file.

2.2.11.1. Additional Resources
The following are resources that explain more about Reverse Path Forwarding.

Security Guide

Installed Documentation
usr/share/doc/kernel-doc-version/Documentation/networking/ip-sysctl.txt
— This file contains a complete list of files and options available in the /proc/sys/net/ipv4/
directory.
Useful Websites
https://access.redhat.com/knowledge/solutions/53031 — The Red Hat Knowledgebase article
about rp_filter.
See RFC 3704 for an explanation of Ingress Filtering for Multihomed Networks.

2.3. SINGLE SIGN-ON (SSO)
The Red Hat Enterprise Linux SSO functionality reduces the number of times Red Hat Enterprise Linux
desktop users have to enter their passwords. Several major applications leverage the same underlying
authentication and authorization mechanisms so that users can log in to Red Hat Enterprise Linux from
the log-in screen, and then not need to re-enter their passwords. These applications are detailed below.
For more information on Pluggable Authentication Modules, see the Red Hat Enterprise Linux 6
Managing Single Sign-On and Smart Cards guide.

2.4. PLUGGABLE AUTHENTICATION MODULES (PAM)
Pluggable authentication modules are a common framework for authentication and security. Both of
Red Hat Enterprise Linux's single sign-on methods — Kerberos and smart cards — depend on
underlying PAM configuration.
For more information on Pluggable Authentication Modules, see the corresponding chapter in the Red
Hat Enterprise Linux 6 Managing Single Sign-On and Smart Cards guide.

2.5. KERBEROS
Maintaining system security and integrity within a network is critical, and it encompasses every user,
application, service, and server within the network infrastructure. It requires an understanding of
everything that is running on the network and the manner in which these services are used. At the core of
maintaining this security is maintaining access to these applications and services and enforcing that
access.
Kerberos provides a mechanism that allows both users and machines to identify themselves to network
and receive defined, limited access to the areas and services that the administrator configured. Kerberos
authenticates entities by verifying their identity, and Kerberos also secures this authenticating data so
that it cannot be accessed and used or tampered with by an outsider.
For more information on Pluggable Authentication Modules, see the corresponding chapter in the Red
Hat Enterprise Linux 6 Managing Single Sign-On and Smart Cards guide.

2.6. TCP WRAPPERS AND XINETD
Controlling access to network services is one of the most important security tasks facing a server
administrator. Red Hat Enterprise Linux provides several tools for this purpose. For example, an
iptables-based firewall filters out unwelcome network packets within the kernel's network stack. For
network services that utilize it, TCP Wrappers add an additional layer of protection by defining which

CHAPTER 2. SECURING YOUR NETWORK

hosts are or are not allowed to connect to "wrapped" network services. One such wrapped network
service is the xinetd super server. This service is called a super server because it controls
connections to a subset of network services and further refines access control.
Figure 2.4, “Access Control to Network Services” is a basic illustration of how these tools work together
to protect network services.

Figure 2.4. Access Control to Network Services
For more information about using firewalls with iptables, see Section 2.8.9, “IPTables”.

2.6.1. TCP Wrappers
The TCP Wrappers packages (tcp_wrappers and tcp_wrappers-libs) are installed by default and provide
host-based access control to network services. The most important component within the package is the
/lib/libwrap.so or /lib64/libwrap.so library. In general terms, a TCP-wrapped service is one
that has been compiled against the libwrap.so library.
When a connection attempt is made to a TCP-wrapped service, the service first references the host's
access files (/etc/hosts.allow and /etc/hosts.deny) to determine whether or not the client is
allowed to connect. In most cases, it then uses the syslog daemon (syslogd) to write the name of the

Security Guide

requesting client and the requested service to /var/log/secure or /var/log/messages.
If a client is allowed to connect, TCP Wrappers release control of the connection to the requested service
and take no further part in the communication between the client and the server.
In addition to access control and logging, TCP Wrappers can execute commands to interact with the
client before denying or releasing control of the connection to the requested network service.
Because TCP Wrappers are a valuable addition to any server administrator's arsenal of security tools,
most network services within Red Hat Enterprise Linux are linked to the libwrap.so library. Such
applications include /usr/sbin/sshd, /usr/sbin/sendmail, and /usr/sbin/xinetd.

NOTE
To determine if a network service binary is linked to libwrap.so, type the following
command as the root user:
ldd | grep libwrap
Replace with the name of the network service binary. If the command
returns straight to the prompt with no output, then the network service is not linked to
libwrap.so.
The following example indicates that /usr/sbin/sshd is linked to libwrap.so:
~]# ldd /usr/sbin/sshd | grep libwrap
libwrap.so.0 => /lib/libwrap.so.0 (0x00655000)

2.6.1.1. Advantages of TCP Wrappers
TCP Wrappers provide the following advantages over other network service control techniques:
Transparency to both the client and the wrapped network service — Both the connecting client
and the wrapped network service are unaware that TCP Wrappers are in use. Legitimate users
are logged and connected to the requested service while connections from banned clients fail.
Centralized management of multiple protocols — TCP Wrappers operate separately from the
network services they protect, allowing many server applications to share a common set of
access control configuration files, making for simpler management.

2.6.2. TCP Wrappers Configuration Files
To determine if a client is allowed to connect to a service, TCP Wrappers reference the following two
files, which are commonly referred to as hosts access files:
/etc/hosts.allow
/etc/hosts.deny
When a TCP-wrapped service receives a client request, it performs the following steps:
1. It references /etc/hosts.allow — The TCP-wrapped service sequentially parses the
/etc/hosts.allow file and applies the first rule specified for that service. If it finds a matching
rule, it allows the connection. If not, it moves on to the next step.

CHAPTER 2. SECURING YOUR NETWORK

2. It references /etc/hosts.deny — The TCP-wrapped service sequentially parses the
/etc/hosts.deny file. If it finds a matching rule, it denies the connection. If not, it grants
access to the service.
The following are important points to consider when using TCP Wrappers to protect network services:
Because access rules in hosts.allow are applied first, they take precedence over rules
specified in hosts.deny. Therefore, if access to a service is allowed in hosts.allow, a rule
denying access to that same service in hosts.deny is ignored.
The rules in each file are read from the top down and the first matching rule for a given service is
the only one applied. The order of the rules is extremely important.
If no rules for the service are found in either file, or if neither file exists, access to the service is
granted.
TCP-wrapped services do not cache the rules from the hosts access files, so any changes to
hosts.allow or hosts.deny take effect immediately, without restarting network services.



WARNING
If the last line of a hosts access file is not a newline character (created by pressing
the Enter key), the last rule in the file fails and an error is logged to either
/var/log/messages or /var/log/secure. This is also the case for a rule that
spans multiple lines without using the backslash character. The following example
illustrates the relevant portion of a log message for a rule failure due to either of
these circumstances:
warning: /etc/hosts.allow, line 20: missing newline or line
too long

2.6.2.1. Formatting Access Rules
The format for both /etc/hosts.allow and /etc/hosts.deny is identical. Each rule must be on its
own line. Blank lines or lines that start with a hash (#) are ignored.
Each rule uses the following basic format to control access to network services:
: [:

Source Exif Data:

File Type                       : PDF
File Type Extension             : pdf
MIME Type                       : application/pdf
PDF Version                     : 1.4
Linearized                      : No
Title                           : Security Guide
Creator                         : wkhtmltopdf 0.12.2.1
Producer                        : Qt 4.8.6
Create Date                     : 2018:03:06 10:52:20-05:00
Page Count                      : 243
Page Mode                       : UseOutlines

EXIF Metadata provided by EXIF.tools

Security Guide Red Hat Enterprise Linux 6 En US

Red_Hat_Enterprise_Linux-6-Security_Guide-en-US

Navigation menu

Versions of this User Manual:

Views

Navigation