| Crossroads | The ACM's First Electronic Publication |
|
|
|
| Plain HTML Site Map | ||
| Crossroads | The ACM's First Electronic Publication |
|
|
|
|
| Plain HTML Site Map | ||
Introduction to Linux Networking and Securityby Wei-Mei Shyr and Brian Borowski
Congratulations to ACM Crossroads and Wei-Mei Shyr and Brian Borowski! This article was given an Academic Excellence Award by StudyWeb and a link back to this article can be found on the StudyWeb site under the category Computer Science: Operating Systems: Linux Linux is a member of the UNIX family but is different than most UNIX implementations because it provides a great UNIX server/workstation environment at a low cost, can be run on a wide variety of platforms, and contains no proprietary code. In this article, we will give a brief introduction to the IP networking services, how to configure them, and how to set up a relatively secure Linux workstation. Please note that the examples given here are from the Slackware distribution. The paths of the files might be different on other distributions of Linux. Linux TCP/IP Network ServicesLinux supports a full and high quality implementation of the TCP/IP networking protocols. With a network interface card or a modem and PPP, one can connect a machine to a local area network or the Internet and have access to many additional services and network utilities. Linux provides two methods of establishing host-network services. Servers can either run stand-alone or under the control of a program called inetd. Heavily used services will usually run stand-alone. This means the service does all the management and listening on a socket or port. The most common stand-alone services are inetd, syslogd, portmapper, named, and routed. The file /etc/rc.d/rc.inet2 configures the stand-alone services. Here is an example of /etc/rc.d/rc.inet2 #!/bin/sh
#
# rc.inet2 This shell script boots up the entire INET system.
# Constants.
NET="/usr/sbin"
IN_SERV="lpd"
LPSPOOL="/var/spool/lpd"
echo -n "Starting daemons:"
# Start the SYSLOGD/Klogd daemons. These must come first.
if [ -f ${NET}/syslogd ]; then
echo -n " syslogd"
${NET}/syslogd & # Backgrounded to avoid an ugly notice from bash-2.0
echo -n " klogd"
${NET}/klogd
fi
...
# Start the INET SuperServer
if [ -f ${NET}/inetd ]; then
echo -n " inetd"
${NET}/inetd
else
echo "no INETD found. INET cancelled!"
exit 1
fi
....
However, most services run through inetd. inetd is a daemon or background process that starts up near the beginning of the boot sequence in Linux. inetd listens on many ports, and when a connection to a port is requested, it starts up the process associated with that port. Examples of services run from inetd are ftp, telnet, finger, pop, imap, and mail/smtp. inetd is like a switch-board operator who receives calls at the main number of an organization (the IP address of the machine), and then connects the caller to the extension they have requested (the port or socket). There are two files that configure inetd: /etc/services and /etc/inetd.conf (which may be in /etc/inet/inetd.conf). Below is an example of /etc/inetd.conf # See "man 8 inetd" for more information. # # <service_name <sock_type Configuring Network ServicesTo configure the stand-alone services, edit /etc/rc.inet2. Disable a service by commenting out the lines related to that service. A line is commented out by placing a # before it. Here is an example of a commented out service: # Start the ROUTEd server.
# if [ -f ${NET}/routed ]; then
# echo -n " routed"
# ${NET}/routed -g -s
# fi
To configure the inetd services, edit /etc/services and /etc/inetd.conf. The /etc/services file associates services with their ports. It lists the name of the service, the port number for that service, and the protocol (udp or tcp). Here is the line for the ftp service: ftp 21/tcp /etc/inetd.conf contains parameters that determine how the services runs. Here is an example of the line for the ftp server:ftp stream tcp nowait root /usr/sbin/tcpd wu.ftpd -l -i -a To disable the ftp program, comment it out by putting a # at the beginning of the line. To activate the change, reload inetd. This is done by finding the process-id (PID) of inetd, and then sending it the hangup signal known as SIGHUP or just HUP. {find out the PID}
$ ps -aux | grep inetd
root 479 0.0 0.2 1944 1520 ? S Mar 02 1:18 /usr/sbin/inetd
{ ^ this is the PID}
$ kill -HUP 479
The file /etc/services will most likely only need to be edited when adding new services. This might be necessary when installing network utilities. Note that we use tcpd to control access to the ftp daemon. The tcpd program is a wrapper program that can be set up to monitor incoming requests for telnet, finger, ftp and other Internet services. It works as follows: whenever a request for service arrives, the inetd daemon runs tcpd, which logs the request and does some checking. When all is well, tcpd runs the appropriate server program and goes away. For details, see the tcpd manual page. Access control for tcpd is configured using the /etc/hosts.allow and /etc/hosts.deny files. tcpd looks at hosts.allow then hosts.deny. It stops at the first match. Consequently, one can permit a few machines to have ftp or telnet access and then deny access to everybody else in hosts.deny. Here is a sample /etc/hosts.allow: ALL: 10.100.10.0/255.255.255.0 The ALL refers to all wrapped inetd services. This does not include stand-alone services. The second field 10.100.10.0/255.255.255.0 means all machines on the 10.100.10.0 subnet have access to all the services. Now we want to disallow access for everybody else. Put the following line into /etc/hosts.deny: ALL: ALL The non-existence of the /etc/hosts.* files or empty /etc/hosts.* means no restriction. This is an insecure configuration unless legitimate connections might come from many diverse networks. Security: An OverviewPeople often ask, "How secure is my machine?" The answer is that any publicly accessible machine is necessarily insecure and vulnerable to security problems. Hence, we should take proper steps to minimize the vulnerability. There are three different aspects of security: physical, system, and network. Physical security is the first layer of security. Home users probably need not worry about this too much. However, in a public environment, this aspect of security is a much larger concern. Keep in mind that re-booting the system is only a ctl-alt-del away if users have access to the console. If users can reboot the system, it is trivial to manipulate the data on the system. Whenever possible limit user access to the console. System Security is a topic all by itself and addresses issues such as restricting user accounts to the minimal necessary privileges. For example do users really need a full shell environment or will a restricted menu system do? System security also involves choosing secure, hard-to-guess passwords; reading CERT bulletins and applying patches when necessary; and not allowing root to log in from any terminal except the console. This means the file /etc/securetty should have only one line in it: console System administrators have to log in as themselves first, then run Network security is the most vulnerable part of your system. The following recommendations will significantly improve network security:
Under Linux, system processes are started at boot time by adding and removing files in /etc/rc.d. For example, sendmail is started from the file rc.M. To disable such a service, you comment out the corresponding lines. In some Linux distributions, these services are in /etc/rc.d/rcN.d, where N is a number (the system run level). Disable services by deleting or renaming the files in the /etc/rc.d/rcN.d directory. Other candidates are named, routed, and httpd.
Some services to possibly leave enabled are: ftp (in.ftpd), but configure ftp not to permit anonymous access unless absolutely necessary; telnet (in.telnetd), the user interface for remote access; and auth (in.identd), the user identification program.
Recent Security IncidentsThe following are a few Linux security advisories that have been announced recently. You can find more in-depth descriptions of the incidents at cert.org . Buffer-Overflows 99-03: FTP-Buffer-Overflows 98-12: Buffer Overflow in Some Implementations of IMAP Servers Remotely Exploitable Buffer Overflow Vulnerability in mountd "sscan" Scanning Tool Denial of Service Attacks ConclusionBecause Linux supports so many avenues of networking, care should be taken to secure your Linux server. The general rule of thumb is "Only turn on the services you need". Edit down /etc/inetd.conf, rc.inet2 and /etc/rc.d/rcN.d. Keep up with the security patches. Use good password policies. Most of the recent Linux distributions include 'passwd' programs that do not allow you to set an easily guessed password. Make sure your passwd program is up to date and has these features. Check your system's logs daily for abnormal activities like port scanning. Become familiar with the processes that normally run on your system and check regularly for unusual processes (beware of processes with names that might be very close to regularly running tasks). Scan your systems for unusual or suspicious files or directories. For example, filenames that start with '.', directories named '...', and unusual device names like '/dev/ttypx'. Use SSH instead of telnet and FTP for more secure communication. There are many web sites and mailing lists on UNIX Security in general and Linux security in particular. It is important to keep current with the security issues happening around the Internet; this might include becoming familiar with the latest tools. Here are a few useful sites: UNIX Configuration Guidelines Security Tools Bugtraq References
|
|
|
|
|
|
|
|
| Plain HTML Site Map | ||
This ACM Crossroads Readers Ring
site owned by ACM Crossroads
