60 Securing the Fort

with Bastille

Technique

Save Time By

Using Bastille to build a strong line of defense

Using the Bastille firewall to create robust customized security

Setting up psad to keep an eye on your ports

Keeping an eye on the official computer security experts

Faith-based security isn’t too dependable when it comes to computer systems. Building a strong line of defense is your system’s best protection from hackers. The open-source project, Bastille, is a real

asset to have in your repertoire of security programs.

Bastille uses a question-and-answer session to choose a series of configuration changes for your system. Bastille implements these changes after the questions end. You could make all the changes manually, one file at a time, but the process is much quicker (and easier) with Bastille leading the way.

In addition to making some basic security changes to take away unneeded privileges from non-root users and tightening account security, Bastille can create a very tight firewall and an optional port scan detector to tell you if intruders are probing your system for vulnerabilities. You can use Bastille to harden your entire security system in a fraction of the time it would take you to find all the individual files and tools to create the same level of security. You can also go back and modify the changes that Bastille has implemented on your system if you find security to be too tight for your users. With Bastille, you have flexibility.

In this technique, we walk you through the question-and-answer session to set up Bastille on your system. The defaults recommended by Bastille are usually pretty good, but we point out a few things that you might want to change to tighten up your system even more.

Hardening Your Hat with Bastille

The open-source movement has spawned a lot of admirable projects, among them is the security implementation tool Bastille. Bastille is a security wizard, guiding you through a series of questions and deciding on a course of action that will create a secure but usable system for you and your users.

456 Technique 60: Securing the Fort with Bastille

Bastille is a tremendous timesaver. It takes a while to thoughtfully answer all of its questions, but if you had to track down each security issue that Bastille handles, it would take you days!

Downloading and installing Bastille and its dependencies

Use Synaptic to download and install Bastille in one easy step. Start Synaptic and then enter bastille in the Find box. Install the bastille-linux package, and you’re ready to go! Technique 19 is all about installing and using Synaptic — check it out!

To download and install the Bastille RPM package without Synaptic, follow these steps:

1. Open your browser and surf to the official

Bastille Web site:

www.bastille-linux.org/

2. Scroll down the page, and click the Download link labeled Bastille RPM.

You’re escorted to the download page for the Bastille RPM package at SourceForge.net.

3. Click the download link nearest to your geographical location to download the following package:

Bastille-2.1.1-1.0.i386.rpm

4. When the download manager opens, save the package to your home directory.

To run Bastille with a graphical interface, you also need to install the Perl toolkit. To download the Perl toolkit RPM package, follow these steps:

1. Return to the Download/Install Bastille 2.x page.

You can use your browser’s Back button if you just followed the preceding steps.

2. Click the Consulting This Table link. Then click the link for the most recent perl-Tk (Graphical) package for your Linux distribution.

3. Save the package to your home directory.

Now you’re done downloading the packages you need and can begin installing them.

To install the packages, open a terminal window and give yourself superuser privileges with the su - command. Return to your home directory and install

the packages you’ve just downloaded with the command:

# rpm -Uhv packagenames

Use command completion (described in Technique 5) to make quick work of typing in complex commands. Enter the rpm -Uhv portion of the command, then a space, and then the first few letters of the package name. Then press the Tab key to complete the name.

Welcome to the Bastille

To run Bastille, open a terminal window and give yourself superuser privileges with the su - command. Enter bastille and press Enter.

The first time you run Bastille, you’ll see a Copyright and Disclaimer notice. Read the document quickly (you have just five minutes to respond), type accept at the > prompt, and press Enter.

The Bastille window opens, as shown in Figure 60-1.

The Title Screen contains a simple explanation of the navigational rules for Bastille. Check them out and then click OK.

You’ll find the configuration questions in the Question frame, which is the top frame of the window. The Explanation frame displays a brief explanation of the question to help guide your choices.

Hardening Your Hat with Bastille

457

Enter your answers to questions in the Answer frame, which is located below the explanation. The Modules frame on the left side of the window shows your progress as you move through the series of analysis questions. As you complete the questions in each module, Bastille places a check mark next to the module name to show your progress.

• Figure 60-1: Welcome to Bastille.

Brace yourself — we’re moving on to the questions.

Addressing file permission issues

Would you like to set more restrictive permissions on the administration utilities?

(see Figure 60-2).

If you live on a good-sized system (or a small system with crafty users), it’s a good idea to select the Yes radio button in the Answer frame of the window. You can hand out the privileges that your users need individually with sudo (see Techniques 31 and 32).

Click the OK button to continue.

Clamping down on SUID privileges

The next series of questions guides Bastille through disabling SUID permissions for some programs so that only user root can run those programs. Click OK to move on.

• Figure 60-2: Moving on to the questions.

Would you like to disable SUID status for mount/umount?

If you choose to disable SUID status, only user root can mount or unmount drives (including floppies, CDs, and tape drives). If your users don’t need access to removable media in their daily work, it’s generally a good idea to accept the default of Yes and click OK. This ensures that you won’t have any surprise software loaded onto your system (or have media mysteriously vanish from the drives).

Would you like to disable SUID status for ping?

If ping is working properly, it’s not a dangerous program. However, if some hacker finds a vulnerability in ping, you don’t want ping granting superuser privileges to someone who exploits the security hole. Unless your users really need to check out the status of the network, accept the default response of Yes and click OK. You can still ping as long as you give yourself superuser privileges first.

Would you like to disable SUID status for at?

This is generally a good idea. Hackers can easily exploit at (a program that schedules jobs for later execution), and you can use Task Scheduler to do the scheduling work much quicker. Accept the default of Yes and click OK.

458 Technique 60: Securing the Fort with Bastille

Technique 20 is all about setting up automatic services with Task Scheduler. You don’t need at when you have a tool like Task Scheduler.

Would you like to disable the r-tools?

The r-tools make remote connections that are often less than secure. The r-tools are as follows:

rsh

remsh

rcp

rlogin

rdist

Disable the SUID status for the tools — user root can still use them if need be. Insist that the non-root users on your system use ssh or distribute individual privileges to the r-tools as they’re needed.

Would you like to disable SUID status for usernetctl?

usernetcl allows users to change network interfaces. Really, only the system administrator needs to control network interfaces. It’s a good idea to accept the default answer of Yes and click OK.

Would you like to disable SUID status for traceroute?

Like ping, traceroute is a safe program — until someone finds a vulnerability. Unless your users are debugging your network, accept the default answer of Yes and click OK. The fewer SUID programs you leave lying around the better.

Would you like to disable SUID status for Xfree86?

If you’re sure that a nonprivileged user will never log in to the console of your workstation, you can disable SUID for the Xfree86 server. We recommend answering No to this question.

Moving on to account security

Should Bastille disable clear-text r-protocols that use IP-based authentication?

The r-protocols use an authentication method that sends unencrypted passwords across your network where they can be intercepted and used by hackers to gain access to your network. The r-protocols also use IP-based authentication (an authentication protocol based on the address of the client). IP addresses are easily faked by crafty hackers.

If the r-protocols are enabled, your users can accidentally help a hacker access your system. We recommend that you disable the r-protocol tools altogether: Click Yes and then click OK.

Would you like to enforce password aging?

If a nefarious user manages to get a copy of your system password file, that person can attack your passwords with a cracker program that cycles through random (or not so random) combinations, trying to find a cleartext password that matches one of your encrypted passwords.

Programs that try to crack encrypted passwords can take weeks to run. If you use password aging, passwords are likely to expire before an intruder can crack them. It’s a good idea to accept the default answer of Yes and click OK. If you enable password aging, you (and your users) will be prompted to change your password shortly before the password expires (or after it expires, if you haven’t logged in for a while).

Would you like to restrict the use of cron to administrative accounts?

You should probably accept the default answer of Yes and click OK. The power of cron can be abused, and it’s likely that most of your users won’t need it.

Do you want to set the default umask?