446 Part V Maintaining the Linux System

The SUID and GUID permissions must be used carefully, because they are usually set on root-owned programs. Effectively, this means that the user is actually running as the root user when they run that executable. Most hacking attempts involve some attempt at overriding a SUID set executable by feeding it bogus scripts with out-of-range variables. Sometimes, this causes the process to stop, but allows you to exploit the root access. This is called a “buffer overflow” type of bug, and is one of the most common security holes in a system. Check any executable programs, applications, and services that may have this value set if it isn’t necessary.

Summary

This chapter explains many of the basics of Linux system security, and discusses the best security practices. System security is directed at three main areas:

Physical Environment Security

•Ensure that your system is stored in a locked, temperature-controlled room.

•Only those authorized to administer the server should be allowed into the area.

Network Security

•Keep your network separated from the outside world by using a firewall.

•Filter the incoming network traffic to prevent unauthorized users and services from accessing local resources.

System Security

•Create and maintain a proper user account and password policy.

•Keep system files and user files separated on different partitions.

•Enable file and directory permissions to give access to only the files that each user needs.

•Ensure that processes and daemons are using the least privileged accounts necessary for operation.

•Shutdown unnecessary services.

Chapter 14 Study Guide 447

STUDY GUIDE

The Study Guide section provides you with the opportunity to test your knowledge about Linux. The Assessment Questions will help you to understand the basics of Linux, and the Scenarios provide practice with real situations. If you get any questions incorrect, use the answers to determine the part of the chapter that you should review before continuing.

Assessment Questions

1.After the initial installation of a Linux system, what is the first action that you should take to enhance security on your system?

A.Change the root password to be blank

B.Update your kernel and packages

C.Immediately back up the system

D.Turn off the Web and FTP services

2.Which of the following is the least secure way to administer a Linux system remotely?

A.telnet

B.ssh

C.root

D.bash shell

3.A contract employee recently had her contract renewed with the company for another six months. What should the Linux administrator do to enhance security on the employee’s account?

A.Set a minimum password length of eight characters

B.Disable the account

C.Set the expiration date to six months from now

D.Set permissions for the /home directory

448 Chapter 14 Study Guide

4.Which of the following services should be disabled on a server that is acting as both a Web and FTP server?

A.inetd

B.http

C.ftp

D.finger

5.Where should backup tapes be stored to increase security and safety of the data?

A.Administrator’s briefcase

B.Locked server room

C.Offsite storage

D.Locked file cabinet

6.Which of the following is a misconfiguration on an FTP server, thus creating a security risk?

A.Username and password required

B.FTP root directory set to /

C.Anonymous logins disabled

D.FTP server behind a firewall

7.A user is trying to set a new password for their account. They want to use the name of the company “ABC” as their password. Why won’t the system allow this password?

A.Minimum length is set to six characters

B.Characters can’t be in alphabetical order

C.Can’t use capital letters in a password

D.Password is already in use by another user

8.An administrator wants to set the Web server so that it won’t show a directory listing if a user requests a page that is a directory. Which modification should be set in httpd.conf?

A.User

B.ServerName

C.Remove indexes from configuration file

D.Document Root

Chapter 14 Study Guide 449

9.What settings can you enable to ensure that the password file is encrypted and hidden?

A.hide_passwd

B.tar and zip

C.Encrypted ssh

D.shadow passwords

10.Which of the following services should be disabled on a machine that does not use or send e-mail?

A.POP

B.IMAP

C.Sendmail

D.All of the above

11.A Linux system has just been installed. The kernel and packages have been upgraded to the latest versions, and any unnecessary services and daemons have been turned off. What else should you do to enhance security on the system?

A.Change the root password

B.Set up a telnet session

C.Audit your log files

D.Turn off network card

12.While auditing user accounts, an administrator notices that one of the users has a blank password. What should he do to the account?

A.Set an expiration date on the account

B.Ask the user to change it at their convenience

C.Disable the account, and set a temporary password for the user

D.Set up shadow passwords

13.What is the most important security aspect of a server room?

A.Fire extinguishers

B.Proper humidity should be maintained

C.It should have a good air conditioning system

D.It should be secure and locked

450 Chapter 14 Study Guide

14.A company has two system administrators, and one of them has just been terminated from their position. What is the first thing that the current administrator should do to enhance security?

A.Change the employee’s account password

B.Set an expiration date on the employee’s account

C.Disable the employee’s account

D.Change the root password

15.A system administrator is setting up an FTP server. Only company employees are allowed to use the FTP services. What should be configured on the FTP server to enhance security?

A.Disable anonymous logins

B.Set DocumentRoot in httpd.conf

C.Allow only encrypted sessions

D.Create a legal banner that is shown when users log in

16.What permission setting allows a user to run an executable with the permissions of the owner of that file?

A.Read

B.SUID

C.Write

D.SSH

17.A company is concerned about the length of time that employees use their current passwords. What can the system administrator do to help enforce a new password policy?

A.Expiration dates on accounts

B.Maximum password length

C.Set password rotation

D.Set number of allowed login attempts

18.Which of the following is the most secure way of remotely connecting to a system?

A.telnet

B.ssh

C.rlogin

D.ftp