Hardening Your Hat with Bastille

459

The umask for every process is inherited from the user account that starts the process. The umask controls the permissions for a file; the permissions are assigned when the file is created. If the umask lets everyone read and write everything, your system isn’t very secure. Accept the default answer of Yes and click OK.

What umask would you like to set for users on the system?

The umask setting affects file permissions. The default answer, 077, is the most secure setting. With a umask of 077, new files are protected so that only the file’s owner is allowed read, write, or execute access. You may want to relax this setting a bit, depending on your work environment. If you’re a tight-knit, trustworthy group that knows better than to keep any sensitive information in unencrypted files, you’ll be safe enough with a lower umask setting. Technique 27 contains helpful information about interpreting and setting file permissions. Enter your umask level and click OK.

Check out Technique 28 for some helpful ideas about encrypting documents.

Should we disallow root login on tty’s 1-6?

This question is phrased a little strangely. If you answer Yes to this question (which we recommend), you must have physical access to your computer to log in as user root. That’s a good idea because if intruders manage to steal your root password, they’ll need to be seated at the console before they can use it (or, they’ll have to steal a second, nonprivileged password as well).

Disabling root login on tty lines does not prevent you from gaining superuser privileges when you’re logging in remotely; you’ll just have to log in with a nonprivileged account first and then use su to give yourself superuser privileges.

We think this one’s a good idea, so check the Yes box and click OK.

Making the boot process more secure

Would you like to password protect the GRUB prompt?

This is a touchy one. If you enable it, you’ve got a really secure system. But if you forget the boot password, you’re out of luck; you pretty much need to reload the operating system at that point. We suggest choosing No, for safety’s sake. While this may seem like you’re leaving your boot process unprotected, you’re really ensuring that you can get back in without completely reinstalling Linux from scratch if you accidentally forget your boot password. Click OK when you’ve made your choice.

If you do choose to not password protect your boot prompt, be sure that you control physical access to your workstation. Anyone with physical access to your machine will be able to boot it if there is no GRUB password.

Would you like to disable CTRL-ALT-DELETE rebooting?

Many of these questions have to do with the physical security of your system. If your system is behind a locked door, you may want to leave some of these loopholes open for your use. We usually accept the default answer of No for the sake of convenience. That way, anyone with physical access to the workstation keyboard can reboot your computer.

Would you like to password protect single-user mode?

It’s a good idea to protect single-user mode, especially if you’ve left Ctrl-Alt-Delete rebooting active. If single-user mode is unprotected, anyone with physical access to your computer can reboot your system, lock out all users (including you), and change the root password. If you do choose to password protect single-user mode, anyone choosing to boot into single-user mode will be prompted for a password at boot time. Accept the default answer of Yes and click OK.

460 Technique 60: Securing the Fort with Bastille

Securing connection broker

The secureInetd server (xinetd) acts as a connection broker for a number of network services. xinetd listens for client requests coming in on specific ports and starts the associated server when a request arrives.

Would you like to set a default-deny on TCP Wrappers and xinetd?

If your computer has multiple network interfaces, you can define a default policy that determines whether your services are offered only to your local network, or provided to the world. It’s a good idea to follow Bastille’s recommendation and choose No. Click OK to continue.

Should Bastille ensure the telnet service does not run on this system?

Yes, please. telnet is very insecure and can give a hacker an easy way to break into your computer. You and your users will benefit from using ssh instead. Accept the default answer (Yes) and click OK.

Should Bastille ensure inetd’s FTP service does not run on this system?

Unless you really need an FTP server, it’s a good idea to accept the default answer of Yes. You can use the scp program to copy files securely instead (see Technique 33). Click OK.

Would you like to display “Authorized Use” messages at log-in time?

This isn’t a bad idea. If you catch a cracker in your system, a “legaleeze” banner may help if you choose to prosecute. Accept the default answer of Yes and click OK.

The banner is placed in /etc/issue. Add specific information about your site to the banner. If you’re running a corporate site, it’s a good idea to seek legal advice about the banner verbiage.

Click OK to continue.

Who is responsible for granting authorization to use this machine?

Enter contact information in the Answer field and click OK.

Limiting compiler access

Would you like to disable the gcc compiler?

If you choose to disable the gcc compiler, hackers who do get into your system won’t be able to compile troublemaking software without the root password. However, if your users regularly compile programs, they’ll need access to gcc. Check the box next to the answer that best suits your company’s scenario and then click OK.

Limiting access to hackers

Would you like to put limits on system resource usage?

A denial of service attack shuts down your system by tying up system resources. Limiting system resource usage can make most denial of service attacks somewhat ineffective. If you’re on a machine shared by many users, it’s a good idea to limit system resources. On your own personal machine, you may want to accept the default of No. Check the appropriate box and click OK.

Should we restrict console access to a small group of user accounts?

On some systems, if you log in at a console (as opposed to logging in across the Net), you gain special privileges (such as the ability to mount drives). Accept the default of No and click OK to continue.

Logging extra information

Would you like to add additional logging?

If you choose Yes, this setting enables additional logging. Kernel messages are sent to /var/log/ kernel, and system errors and warnings are sent to

Hardening Your Hat with Bastille

461

/var/log/syslog. You can also view the optional logs by pressing Ctrl-Alt-F7 and Ctrl-Alt-F8. These files won’t interfere with the regular log files. Accept the default answer of Yes and click OK. Then click OK

to continue.

Do you have remote host logging?

You really only need to have sendmail running in daemon mode if you’re running a mail server. If you’re not running a mail server, accept the default answer of Yes and click OK.

Would you like to run sendmail via cron to process the queue?

If you’ve configured your computer to write system log files to a remote host, click Yes. If not, click No and click OK to continue.

What is the IP address of the machine you want to log to?

If you answered Yes to the last question, enter the IP address of the remote machine and click OK.

Keeping the daemons in check

Bastille uses the answers to your questions in this module to decide if it’s safe to disable daemons (background server processes) running on your system that might leave an open door for a hacker.

Would you like to disable apmd?

This daemon monitors battery power on notebook computers. If you frequently work off the grid, you may want to leave apmd turned on; otherwise, click OK to accept the default answer of Yes.

Would you like to disable GPM?

GPM is a daemon that makes the mouse work when you’re running in console mode (that is, when you’re not using X Windows). If you’re planning on working in console mode, but want to retain your mouse functionality, click No; otherwise, choose Yes and click OK.

Securing sendmail

Do you want to stop sendmail from running in

If an outbound message doesn’t make it through to its destination on the first try, choosing Yes schedules a cron job telling the mail queue to try again in 15 minutes. Accept the default answer of Yes and click OK.

Would you like to bind the web server to listen only to the localhost?

If you choose this option, only your machine can access your Apache Web server. It’s kind of pointless unless you do a lot of Web development and need to preview your pages in a live server. Accept the default answer of No and click OK.

Would you like to bind the web server to a particular interface?

If you have two network cards, choose Yes to tell Apache to listen to only one card. This is particularly useful if you’re hosting a Web server for inhouse data distribution. Make your choice and click OK.

If you chose Yes, enter your card’s IP address and click OK.

Closing the gaps in Apache

If you have an Apache server running on your system, you’ll be prompted to answer a series of questions designed to better tailor the security surrounding your server.

The next few questions help close specific security gaps in Apache. Click OK to continue.

daemon mode?

462 Technique 60: Securing the Fort with Bastille

Would you like to deactivate the following of symbolic links?

Deactivating symbolic links helps prevent visitors from viewing files that are not included in the Web page directories. Accept the default answer of Yes and click OK.

Would you like to deactivate server-side includes?

A server-side include (SSI) is a program that generates or modifies an HTML Web page. If intruders manage to inject a Trojan server-side include program on your system, they can exploit your Web server to their liking. If you disable server-side includes, it’s one less security risk. Accept the default answer of Yes and click OK.

Would you like to disable CGI scripts, at least for now?

If you’re not using them, shut ’em down. Accept the default answer of Yes and click OK.

Would you like to disable indexes?

If you turn off the indexes, people can’t discover the things that you’ve left lying around on your Web server. To access any page, the visitor needs to start with a specific address and then browse using links that you provide. If you leave automatic indexes enabled, Apache will happily create indexes on the fly, possibly exposing your dirty laundry. As a rule, we think it’s a good idea to turn off automatic indexes. Check the box next to Yes and click OK.

Keeping temporary files safe

Would you like to install TMPDIR/TMP scripts?

This creates a safe temporary directory for each user. If you can’t all share one temporary directory, you have the option to create individual directories. Based on your system usage, choose your option and click OK.

Building a better firewall

Would you like to run the packet filtering script?

If you choose this option, you’re led through a series of questions to build and customize your firewall. Choose Yes and click OK if you want to configure a Bastille firewall. The Bastille firewall is a very robust and highly customized piece of software. We’ll try to offer some guidance as you go, but you’ll need to keep the requirements of your network in mind as you answer the questions.

Do you need the advanced networking options?

Generally, answer No if you’re on a small system, and Yes if you deal with multiple interfaces or provide IP Masquerading services. Enter your choice and click OK.

DNS Servers:

Most Linux distributions use kernel version 2.4 (or later), so you can safely ignore this question. Just accept the default value and click OK.

Public Interfaces:

List the names of all the network interfaces connected to public networks. If you have an Ethernet card in your computer, type eth+. If you have a modem attached to your computer, type ppp+ slip+. If you have both, enter eth0 ppp+ slip+. Click OK to continue.

TCP services to audit:

Bastille wants to know which TCP services you want to log. Bastille logs connection attempts on the following services by default:

telnet ftp imap pop3 finger sunrpc exec login linuxconf ssh

But you can customize it to better suit your needs. Accept the default or customize the answer, and then click OK.

Hardening Your Hat with Bastille

463

UDP services to audit:

Specify any UDP services that you want to log. The default connection is 31337, a well-known security hole. Add any ports you want to monitor or accept the default and then click OK.

ICMP services to audit:

Specify any ICMP services that you want to audit. This includes logging for connection attempts from services like ping. Unless you have a specific security concern that you want to address, accept the default and click OK.

TCP service names or port numbers to allow on public interfaces:

If you’re running a Web server and want to allow public access, you need to make port 80 accessible to the public. Another port you may want to leave open is 22 — ssh gains access through port 22. Enter the port numbers in the Answer field (separated by a blank space) and click OK.

UDP service names or port numbers to allow on public interfaces:

If you’re running caching or DNS servers, you need to allow access to port 53. For most workstations, leave this blank and click OK.

You’ve likely just hit a blank window — no questions, no answers. This is a good time to get a cup of coffee and stretch. More questions are coming when you click OK.

Force passive mode?

This option determines how FTP clients on your system access other servers. Forcing passive mode is more secure, but is also somewhat inconvenient for your users. Unless you have a very high-profile network with serious security risks, it’s probably a good idea to accept the default of No and click OK.

Bastille recommends a series of services you should consider blocking. You can find the names that correspond to the default entries in the file /etc/protocols. As Bastille says, this question is not important for 2.4 (and higher) kernels. Most distributions use a 2.4 (or higher) kernel, so we recommend accepting the default entry.

UDP services to block:

Like the TCP services, Bastille recommends the UDP services you should block. Click OK to accept the default.

ICMP allowed types:

The default recommendations from Bastille are good:

destination-unreachable: Allows other servers to inform you when a connection fails

echo-reply: Must be enabled for ping to work

time-exceeded: Must be enabled for traceroute to work

Enable source address verification?

Enabling source address verification helps the kernel block traffic with falsified addresses. It’s a very good idea to accept the default answer of Yes and click OK.

Break time again. Click OK to continue.

Reject method:

The reject method determines how the kernel deals with blocked traffic.

If you choose to reject the traffic, a remote machine feeling around for a connection gets a polite reply stating that the requested service is not available. The disadvantage of this kindness? Now potential intruders know you’re out there if they want to launch an attack.

TCP services to block: