Overview of Linux Security

Avinash Meetoo

avinash@mauritius-linux.org

Mauritius Linux User Group

http://www.mauritius-linux.org

What is computer security ?

Philosophy

Your applications, data and computers are very sensitive

They must always be protected against

Good intentional people but with catastrophic ideas

Bad intentional people (Crackers)

This requires a lot of discipline and method

“The more secure your system is, the more intrusive it becomes”

What is a policy ?

A document having 2 parts :

How much security is required ?

What auditing will you do ?

Must ALWAYS start with :

“That which is not permitted is prohibited”

Check RFC1244 and RFC1281 for more information

Part 1 - Securing a workstation

Physical security

Who has access to the machine ? Should they ?

BIOS security

Boot Loader Security (LILO)

Resources and permissions

Ideally, each resource (file, printer...) has :

One owner (called the user) and a group

A set of permissions set up by the owner. e.g.

File X can be read and written by the owner	(U)

Read by people in the same group	(G)

And other people have no rights at all	(O)

Corresponding to “rw-r-----”

User authentication

The real identity of a user must always be known

User authentication

What is required

Secure and impossible to guess Passwords

Use Crack to check vulnerabilities

Other authentication techniques

PAM

Set limits on brute-force attack

Users can only login at specific times at specific places

Kerberos

Developed by the MIT

Can be used in Linux, Windows 2000...

Part 2 - Securing a network

Essential when connected to the Internet

First steps

Disable all non required services

Use TCP wrappers

Verify if the host requesting the service is “genuine”

Use a scanner to scan local ports

Security Administrator's Tool for Analyzing Networks

Detect port scans from the internet

Rina's home network

Homer

Bart

Lisa

Repeater

192.168.1.1

192.168.1.2

192.168.1.3

Modem

Printer

Internet

What is a Firewall ?

A Linux box with specific software (ipchains)

Controls what gets in and out of a local network

Is the only machine connected to the Internet

All other machines must pass through it

A role that can be done by Homer in Rina's network

What is a Firewall ?

Quote from Firewall-HOWTO

Firewalls are intended to keep the flames of Internet hell out of your private network.

Or, to keep the members of your network pure and chaste by denying them access the all the evil Internet temptations ;-)

How does it work ?

Based on Rules

IP packets are only allowed to leave the Firewall if rules allow it

Limit accessible sites and services

Arriving IP packets are filtered by their type, source address, destination address and port information

Prevent intrusions

For more information

Configuring a firewall is complicated, read :

IP-Masquerade-HOWTO

Firewall-HOWTO

IPCHAINS-HOWTO for more information

The latest Linux kernel (2.4) has a new facility, NetFilter, destined to replace ipchains

Check http://netfilter.kernel­notes.org

Conclusion

With Linux,

the limit is YOUR imagination

2001-02-04T12:17:52