Securing and optimizing Linux

1

This book is dedicated to OpenNA staff. Thanks, guys (no-gender)!!

--Gerhard Mourani

This book is printed on acid-free paper with 85% recycled content, 15% post-consumer waste.

Open Network Architecture is commited to using paper with the highest recycled content

available consistent with high quality.

Copyright © 2002 by Gerhard Mourani and Open Network Architecture, Inc.

All rights reserved. No part of this publication may be reproduced, stored in a retrieval system or

transmitted in any form or by any means, electronic, mechanical, photocopying, recording,

scanning or otherwise, except as permitted by Canada Copyright Act, without either the prior

written permission of the Publisher, or authorization through payment of the appropriate per-copy

fee to the copyright holders Gerhard Mourani and Open Network Architecture, Inc. 11090

Drouart, Montreal, PQ H3M 2S3, (514) 978-6183, fax (514) 333-0236. Requests to the Publisher

for permission should be addressed to the Publishing Manager, at Open Network Architecture,

Inc., E-mail: [email protected]

This publication is designed to provide accurate and authoritative information in regard to the

subject matter covered. It is sold with the understanding that some grammatical mistakes could

have occurred but this won’t jeopardize the content or the issue raised herewith.

Title: Securing and Optimizing Linux: The Hacking Solution

Page Count: 1100

Version: 3.0

Last Revised: 2002-06-26

Publisher: Open Network Architecture, Inc.

Editor: Ted Nackad

Text Design & Drawings (Graphics): Bruno Mourani

Printing History: June 2000: First Publication.

Author's: Gerhard Mourani

Mail: [email protected]

Website: http://www.openna.com/

National Library Act. R.S., c. N-11, s. 1.

Legal Deposit, 2002

Securing and Optimizing Linux: The Hacking Solution / Open Network Architecture, Inc.

Published by Open Network Architecture, Inc., 11090 Drouart, Montreal, H3M 2S3, Canada.

Includes Index.

ISBN 0-9688793-1-4

Printed in Canada

2

Overview

Part I Installation Security

Chapter 1 Introduction

Chapter 2 Installation Issues

Part II System Security & Optimization

Chapter 3 General Security

Chapter 4 Pluggable Authentication Modules

Chapter 5 General Optimization

Chapter 6 Kernel Security & Optimization

Chapter 7 Process File System Management

Part III Network Security

Chapter 8 TCP/IP Network Management

Chapter 9 Firewall Basic Concept

Chapter 10 GIPTables Firewall

Chapter 11 Squid Proxy Server

Chapter 12 SquidGuard Filter

Chapter 13 FreeS/WAN VPN

Part IV Cryptography & Authentication

Chapter 14 GnuPG

Chapter 15 OpenSSL

Chapter 16 OpenSSH

Chapter 17 Sudo

Part V Monitoring & System Integrity

Chapter 18 sXid

Chapter 19 LogSentry

Chapter 20 HostSentry

Chapter 21 PortSentry

Chapter 22 Snort

Chapter 23 Tripwire

Part VI Super-Server

Chapter 24 UCSPI-TCP

Chapter 25 Xinetd

Part VII Management & Limitation

Chapter 26 NTP

Chapter 27 Quota

Part VIII Domain Name System & Dynamic Host Protocol

Chapter 28 ISC BIND & DNS

Chapter 29 ISC DHCP

Part IX Mail Transfer Agent Protocol

Chapter 30 Exim

Chapter 31 Qmail

3

Part X Internet Message Access Protocol

Chapter 32 tpop3d

Chapter 33 UW IMAP

Chapter 34 Qpopper

Part XI Anti-Spam & Anti-Virus

Chapter 35 SpamAssassin

Chapter 36 Sophos

Chapter 37 AMaViS

Part XII Database Server

Chapter 38 MySQL

Chapter 39 PostgreSQL

Chapter 40 OpenLDAP

Part XIII File Transfer Protocol

Chapter 41 ProFTPD

Chapter 42 vsFTPD

Part XIV Hypertext Transfer Protocol

Chapter 43 Apache

Chapter 44 PHP

Chapter 45 Mod_Perl

Part XV NetBios Protocol

Chapter 46 Samba

Part XVI Backup

Chapter 47 Tar & Dump

Part XVII Appendixes

Appendix A

Tweaks, Tips and Administration Tasks

Appendix B

Port list

4

Contents

Steps of installation.................................................................................................................... 13

Author note................................................................................................................................. 13

Audience .................................................................................................................................... 14

These installation instructions assume...................................................................................... 15

Obtaining the example configuration files.................................................................................. 15

Problem with Securing & Optimizing Linux................................................................................ 15

Acknowledgments...................................................................................................................... 15

Introduction 16

What is Linux?............................................................................................................................ 17

Some good reasons to use Linux .............................................................................................. 17

Let's dispel some of the fear, uncertainty, and doubt about Linux ............................................ 17

Why choose pristine source?..................................................................................................... 18

Compiling software on your system........................................................................................... 18

Build & install software on your system ..................................................................................... 19

Editing files with the vi editor tool............................................................................................. 20

Recommended software to include in each type of servers ...................................................... 21

Installation Issues 24

Know your Hardware! ................................................................................................................ 25

Creating the Linux Boot Disk ..................................................................................................... 25

Beginning the installation of Linux ............................................................................................. 27

Installation Class and Method (Install Options) ......................................................................... 28

Partition your system for Linux................................................................................................... 29

Disk Partition (Manual Partitioning) ........................................................................................... 33

Selecting Package Groups ........................................................................................................ 44

Boot Disk Creation ..................................................................................................................... 47

How to use RPM Commands ...................................................................................................... 47

Starting and stopping daemon services..................................................................................... 50

Software that must be uninstalled after installation of the server .............................................. 51

Remove unnecessary documentation files................................................................................ 59

Remove unnecessary/empty files and directories ..................................................................... 60

Software that must be installed after installation of the server .................................................. 60

General Security 64

BIOS........................................................................................................................................... 65

Unplug your server from the network......................................................................................... 65

Security as a policy .................................................................................................................... 66

Choose a right password ........................................................................................................... 66

The root account ........................................................................................................................ 67

Set login time out for the root account ....................................................................................... 67

Shell logging............................................................................................................................... 68

The single-user login mode of Linux.......................................................................................... 69

Disabling Ctrl-Alt-Delete keyboard shutdown command ................................................. 69

Limiting the default number of started ttys on the server........................................................ 70

The LILO and /etc/lilo.conf file ....................................................................................... 70

The GRUB and /boot/grub/grub.conf file .......................................................................... 72

The /etc/services file .......................................................................................................... 74

5

The /etc/securetty file........................................................................................................ 75

Special accounts........................................................................................................................ 75

Control mounting a file system................................................................................................... 78

Mounting the /usr directory of Linux as read-only ................................................................... 79

Tighten scripts under /etc/init.d......................................................................................... 81

Tighten scripts under /etc/cron.daily/.............................................................................. 81

Bits from root-owned programs.................................................................................................. 81

Don’t let internal machines tell the server what their MAC address is ........................................ 83

Unusual or hidden files .............................................................................................................. 84

Finding Group and World Writable files and directories ............................................................ 85

Unowned files............................................................................................................................. 86

Finding .rhosts files................................................................................................................ 86

Physical hard copies of all-important logs ................................................................................. 87

Getting some more security by removing manual pages .......................................................... 89

System is compromised!............................................................................................................ 90

Pluggable Authentication Modules 91

The password length.................................................................................................................. 92

Disabling console program access ............................................................................................ 94

Disabling all console access...................................................................................................... 94

The Login access control table .................................................................................................. 95

Tighten console permissions for privileged users...................................................................... 96

Putting limits on resource........................................................................................................... 98

Controlling access time to services ......................................................................................... 100

Blocking; su to root, by one and sundry .................................................................................. 101

Using sudo instead of su for logging as super-user ............................................................... 102

General Optimization 104

Static vs. shared libraries......................................................................................................... 105

The Glibc 2.2 library of Linux ............................................................................................... 106

Why Linux programs are distributed as source ....................................................................... 107

Some misunderstanding in the compiler flags options ............................................................ 108

The gcc specs file.................................................................................................................. 109

Striping all binaries and libraries files ...................................................................................... 114

Tuning IDE Hard Disk Performance........................................................................................ 115

Kernel Security & Optimization 121

Difference between a Modularized Kernel and a Monolithic Kernel........................................ 122

Making an emergency boot floppy........................................................................................... 125

Preparing the Kernel for the installation................................................................................... 126

Applying the Grsecurity kernel patch.................................................................................. 128

Obtaining and Installing Grsecurity..................................................................................... 128

Tuning the Kernel..................................................................................................................... 129

Cleaning up the Kernel ............................................................................................................ 130

Configuring the Kernel ............................................................................................................. 132

Compiling the Kernel................................................................................................................ 177

Installing the Kernel ................................................................................................................. 177

Verifying or upgrading your boot loader................................................................................... 179

Reconfiguring /etc/modules.conf file ............................................................................... 181

Rebooting your system to load the new kernel........................................................................ 182

Delete programs, edit files pertaining to modules.................................................................... 182

6

Making a new rescue floppy for Modularized Kernel............................................................... 183

Making a emergency boot floppy disk for Monolithic Kernel ................................................... 183

Process file system management 185

What is sysctl? ..................................................................................................................... 187

/proc/sys/vm: The virtual memory subsystem of Linux ...................................................... 187

/proc/sys/fs: The file system data of Linux...................................................................... 194

/proc/sys/net/ipv4: IPV4 settings of Linux.................................................................... 196

Other possible optimization of the system............................................................................... 204

TCP/IP Network Management 208

TCP/IP security problem overview ......................................................................................... 210

Installing more than one Ethernet Card per Machine .............................................................. 214

Files-Networking Functionality................................................................................................. 215

Testing TCP/IP Networking .................................................................................................... 219

The last checkup...................................................................................................................... 222

Firewall Basic Concept 223

What is the IANA?.................................................................................................................... 224

The ports numbers................................................................................................................... 224

What is a Firewall?................................................................................................................... 226

Packet Filter vs. Application Gateway ..................................................................................... 226

What is a Network Firewall Security Policy?............................................................................ 228

The Demilitarized Zone............................................................................................................ 229

Linux IPTables Firewall Packet Filter.................................................................................... 230

The Netfilter Architecture ......................................................................................................... 230

GIPTables Firewall 236

Building a kernel with IPTables support................................................................................ 239

Compiling - Optimizing & Installing GIPTables...................................................................... 242

Configuring GIPTables .......................................................................................................... 243

/etc/giptables.conf: The GIPTables Configuration File............................................. 243

/etc/rc.d/rc.giptables.blocked: The GIPTables Blocked File ............................. 254

/etc/init.d/giptables: The GIPTables Initialization File........................................... 255

The GIPTables Firewall Module Files ................................................................................... 256

How GIPTables parameters work? ....................................................................................... 257

Running the type of GIPTables firewall that you need .......................................................... 263

The GIPTables configuration file for a Gateway/Proxy Server.............................................. 264

GIPTables-Firewall Administrative Tools ........................................................................ 282

Squid Proxy Server 284

Compiling - Optimizing & Installing Squid .............................................................................. 287

Configuring Squid................................................................................................................... 291

Running Squid with Users Authentication Support ................................................................ 304

Securing Squid ....................................................................................................................... 308

Optimizing Squid .................................................................................................................... 311

Squid Administrative Tools..................................................................................................... 311

The cachemgr.cgi program utility of Squid ........................................................................ 313

7

SquidGuard Filter 315

Compiling - Optimizing & Installing SquidGuard ................................................................... 317

Configuring SquidGuard........................................................................................................ 319

Testing SquidGuard............................................................................................................... 327

Optimizing SquidGuard ......................................................................................................... 328

FreeS/WAN VPN 331

Compiling - Optimizing & Installing FreeS/WAN...................................................................... 335

Configuring FreeS/WAN .......................................................................................................... 338

Configuring RSA private keys secrets ..................................................................................... 342

Requiring network setup for IPSec ......................................................................................... 347

Testing the FreeS/WAN installation......................................................................................... 349

GnuPG 352

Compiling - Optimizing & Installing GnuPG .............................................................................. 354

Using GnuPG under Linux terminal .......................................................................................... 356

OpenSSL 362

Compiling - Optimizing & Installing OpenSSL.......................................................................... 366

Configuring OpenSSL............................................................................................................... 368

OpenSSL Administrative Tools ................................................................................................ 374

Securing OpenSSL................................................................................................................... 379

OpenSSH 380

Compiling - Optimizing & Installing OpenSSH.......................................................................... 382

Configuring OpenSSH............................................................................................................... 385

Running OpenSSH in a chroot jail ............................................................................................ 395

Creating OpenSSH private & public keys ................................................................................. 400

OpenSSH Users Tools.............................................................................................................. 402

Sudo 404

Compiling - Optimizing & Installing Sudo ................................................................................ 406

Configuring Sudo..................................................................................................................... 408

A more complex sudoers configuration file ........................................................................... 410

Securing Sudo ......................................................................................................................... 413

Sudo Users Tools .................................................................................................................... 413

sXid 415

Compiling - Optimizing & Installing sXid ................................................................................ 417

Configuring sXid..................................................................................................................... 418

sXid Administrative Tools....................................................................................................... 420

LogSentry 421

Compiling - Optimizing & Installing LogSentry...................................................................... 423

8

Configuring LogSentry .......................................................................................................... 427

HostSentry 428

Compiling - Optimizing & Installing HostSentry ................................................................... 430

Configuring HostSentry........................................................................................................ 434

PortSentry 440

Compiling - Optimizing & Installing PortSentry ................................................................... 442

Configuring PortSentry........................................................................................................ 445

Removing hosts that have been blocked by PortSentry ..................................................... 452

Snort 453

Compiling - Optimizing & Installing Snort .............................................................................. 456

Configuring Snort................................................................................................................... 458

Running Snort in a chroot jail................................................................................................. 464

Tripwire 468

Compiling - Optimizing & Installing Tripwire........................................................................ 470

Configuring Tripwire ............................................................................................................ 473

Running Tripwire for the first time ....................................................................................... 482

Securing Tripwire................................................................................................................. 484

Tripwire Administrative Tools .............................................................................................. 484

ucspi-tcp 486

Compiling - Optimizing & Installing ucsip-tcp...................................................................... 488

Using ucsip-tcp ................................................................................................................... 490

Xinetd 492

Compiling - Optimizing & Installing Xinetd............................................................................ 494

Configuring Xinetd................................................................................................................. 496

The /etc/xinetd.d directory............................................................................................... 497

NTP 507

Compiling - Optimizing & Installing NTP................................................................................... 511

Configuring NTP ....................................................................................................................... 513

Running NTP in Client Mode .................................................................................................... 513

Running NTP in Server Mode................................................................................................... 519

Running NTP in a chroot jail..................................................................................................... 521

NTP Administrative Tools ......................................................................................................... 525

Quota 527

Build a kernel with Quota support enable............................................................................... 529

Compiling - Optimizing & Installing Quota .............................................................................. 529

Modifying the /etc/fstab file ............................................................................................... 531

9

Creating the aquota.user and aquota.group files ........................................................... 532

Assigning Quota for Users and Groups .................................................................................. 532

Quota Administrative Tools..................................................................................................... 535

ISC BIND & DNS 536

Compiling - Optimizing & Installing ISC BIND & DNS .............................................................. 540

Configuring ISC BIND & DNS................................................................................................... 542

Running ISC BIND & DNS as Caching-Only Name Server .................................................. 543

Running ISC BIND & DNS as Primary Master Name Server................................................ 552

Running ISC BIND & DNS as Secondary Slave Name Server............................................. 557

Running ISC BIND & DNS in a chroot jail ................................................................................ 559

Securing ISC BIND & DNS....................................................................................................... 563

Optimizing ISC BIND & DNS .................................................................................................... 580

ISC BIND & DNS Administrative Tools..................................................................................... 583

ISC BIND & DNS Users Tools.................................................................................................. 585

ISC DHCP 587

Building a kernel with ISC DHCP support................................................................................. 590

Compiling - Optimizing & Installing ISC DHCP......................................................................... 591

Configuring ISC DHCP.............................................................................................................. 595

Testing the DHCP server........................................................................................................... 603

Running ISC DHCP in a chroot jail ........................................................................................... 605

Securing ISC DHCP.................................................................................................................. 616

Running the DHCP client for Linux............................................................................................ 617

Exim 622

Compiling - Optimizing & Installing Exim ................................................................................ 626

Configuring Exim..................................................................................................................... 631

Testing Exim............................................................................................................................ 654

Allowing Users to authenticate with Exim before relaying ...................................................... 657

Running Exim with SSL support.............................................................................................. 660

Running Exim with Virtual Hosts support ......................................................................... 667

Running Exim with Maildir support ..................................................................................... 670

Running Exim with mail quota support.................................................................................. 672

Running Exim as a Null Client Mail Server ............................................................................. 673

Exim Administrative Tools....................................................................................................... 676

Qmail 678

Compiling, Optimizing & Installing Qmail ............................................................................... 681

Configuring Qmail................................................................................................................... 687

Testing Qmail.......................................................................................................................... 691

Allowing Users to authenticate with Qmail before relaying .................................................... 692

Running Qmail with SSL support............................................................................................ 696

Running Qmail with Virtual Hosts support ....................................................................... 701

Running Qmail as a Null Client Mail Server ........................................................................... 705

Running Qmail as a Mini-Qmail Mail Server .......................................................................... 709

Running qmail-pop3d with SSL support............................................................................... 713

Qmail Administrative Tools..................................................................................................... 716

10

Qmail Users Tools .................................................................................................................. 717

tpop3d 719

Compiling - Optimizing & Installing tpop3d............................................................................ 723

Configuring tpop3d................................................................................................................. 724

Securing tpop3d..................................................................................................................... 728

UW IMAP 730

Compiling - Optimizing & Installing UW IMAP........................................................................... 733

Configuring UW IMAP................................................................................................................ 737

Enable IMAP or POP services via UCSPI-TCP........................................................................ 739

Enable IMAP or POP services via Xinetd............................................................................... 740

Securing UW IMAP.................................................................................................................... 742

Running UW IMAP with SSL support......................................................................................... 743

Qpopper 747

Compiling - Optimizing & Installing Qpopper.......................................................................... 750

Configuring Qpopper............................................................................................................... 752

Securing Qpopper................................................................................................................... 756

Running Qpopper with SSL support ....................................................................................... 758

SpamAssassin 763

Compiling - Optimizing & Installing SpamAssassin............................................................... 766

Configuring SpamAssassin.................................................................................................... 767

Testing SpamAssassin .......................................................................................................... 769

Running SpamAssassin with Exim........................................................................................ 770

Running SpamAssassin with Qmail ..................................................................................... 771

Sophos 775

Compiling & Installing Sophos ................................................................................................ 778

Configuring Sophos................................................................................................................. 779

Testing Sophos ....................................................................................................................... 780

AMaViS 781

Verifying & installing all the additional prerequisites to run AMaViS ....................................... 783

Compiling - Optimizing & Installing AMaViS............................................................................ 795

Running AMaViS with Exim..................................................................................................... 798

Running AMaViS with Qmail .................................................................................................. 800

Testing AMaViS ....................................................................................................................... 801

MySQL 802

Compiling - Optimizing & Installing MySQL .............................................................................. 806

Configuring MySQL................................................................................................................... 808

Securing MySQL ....................................................................................................................... 813

Optimizing MySQL .................................................................................................................... 814

11

MySQL Administrative Tools..................................................................................................... 819

PostgreSQL 826

Compiling - Optimizing & Installing PostgreSQL ................................................................... 828

Configuring PostgreSQL........................................................................................................ 831

Running PostgreSQL with SSL support................................................................................. 836

Securing PostgreSQL ............................................................................................................ 842

Optimizing PostgreSQL ......................................................................................................... 846

PostgreSQL Administrative Tools.......................................................................................... 847

OpenLDAP 853

Compiling - Optimizing & Installing OpenLDAP........................................................................ 857

Configuring OpenLDAP ............................................................................................................ 862

Running OpenLDAP with TLS/SSL support............................................................................. 867

Running OpenLDAP in a chroot jail.......................................................................................... 871

Securing OpenLDAP................................................................................................................. 878

Optimizing OpenLDAP.............................................................................................................. 879

OpenLDAP Administrative Tools .............................................................................................. 880

OpenLDAP Users Tools............................................................................................................ 884

ProFTPD 885

Compiling - Optimizing & Installing ProFTPD.......................................................................... 889

Configuring ProFTPD............................................................................................................... 893

Creating an account for FTP client to connect to the FTP server ............................................ 905

Setup an anonymous FTP server............................................................................................ 906

Allow anonymous users to upload to the FTP server .............................................................. 910

Running ProFTPD with SSL support ....................................................................................... 913

Securing ProFTPD................................................................................................................... 918

ProFTPD Administrative Tools ................................................................................................ 919

vsFTPd 921

Compiling - Optimizing & Installing vsFTPd............................................................................ 925

Configuring vsFTPd................................................................................................................. 926

Creating an account for FTP client to connect to the FTP server ............................................ 932

Setup an anonymous FTP server............................................................................................ 933

Allow anonymous users to upload to the FTP server .............................................................. 935

Apache 937

Compiling - Optimizing & Installing Apache............................................................................ 941

Configuring Apache................................................................................................................. 947

Running Apache with TLS/SSL support................................................................................. 958

Running Apache in a chroot jail .............................................................................................. 962

Running Apache with users authentication support................................................................ 970

Caching frequently requested static files................................................................................. 972

Some statistics about Apache and Linux ................................................................................ 973

12

PHP 976

Compiling - Optimizing & Installing PHP................................................................................... 979

Configuring PHP ....................................................................................................................... 982

Running PHP in a chroot jail..................................................................................................... 990

Running PHP with the PHP Accelerator program............................................................... 991

Mod_Perl 994

Compiling - Optimizing & Installing Mod_Perl........................................................................ 997

Configuring Mod_Perl ............................................................................................................ 998

Running Mod_Perl in a chroot jail.......................................................................................... 999

Samba 1000

Compiling - Optimizing & Installing Samba ............................................................................ 1004

Configuring Samba................................................................................................................. 1006

Running Samba with TLS/SSL support ................................................................................. 1016

Securing Samba ..................................................................................................................... 1021

Optimizing Samba .................................................................................................................. 1023

Samba Administrative Tools................................................................................................... 1025

Samba Users Tools ................................................................................................................ 1026

Tar & Dump 1027

The tar backup program ...................................................................................................... 1028

Making backups with tar ...................................................................................................... 1029

Automating tasks of backups made with tar........................................................................ 1031

Restoring files with tar ......................................................................................................... 1033

The dump backup program .................................................................................................... 1035

Making backups with dump.................................................................................................... 1036

Restoring files with dump ....................................................................................................... 1038

Backing up and restoring over the network ........................................................................... 1040

APPENDIX A 1045

APPENDIX B 1050

Preface

13

Steps of installation

Depending of your level of knowledge in Linux, you can read this book from the beginning

through to the end of the chapters that interest you. Each chapter and section of this book

appears in a manner that lets you read only the parts of your interest without the need to

schedule one day of reading. Too many books on the market take myriad pages to explain

something that can be explained in two lines, I’m sure that a lot of you agree with my opinion.

This book tries to be different by talking about only the essential and important information that

the readers want to know by eliminating all the nonsense.

Although you can read this book in the order you want, there is a particular order that you could

follow if something seems to be confusing you. The steps shown below are what I recommend:

9 Setup Linux in your computer.

9 Remove all the unnecessary RPM’s packages.

9 Install the necessary RPM’s packages for compilation of software (if needed).

9 Secure the system in general.

9 Optimize the system in general.

9 Reinstall, recompile and customize the Kernel to fit your specific system.

9 Configure firewall script according to which services will be installed in your system.

9 Install OpenSSL to be able to use encryption with the Linux server.

9 Install OpenSSH to be able to make secure remote administration tasks.

9 Install Sudo.

9 Install sXid.

9 Install LogSentry.

9 Install PortSentry.

9 Install Tripwire.

9 Install ICS BIND/DNS.

9 Install Exim or Qmail.

9 Install any software you need after to enable specific services into the server.

Author note

According to some surveys on the Internet, Linux will be the number one operating system for a

server platform in year 2003. Presently it is number two and no one at one time thought that it

would be in this second place. Many organizations, companies, universities, governments, and

the military, etc, kept quiet about it. Crackers use it as the operating system by excellence to

crack computers around the world. Why do so many people use it instead of other well know

operating systems? The answer is simple, Linux is free and the most powerful, reliable, and

secure operating system in the world, providing it is well configured. Millions of programmers,

home users, hackers, developers, etc work to develop on a voluntary basis, different programs

related to security, services, and share their work with other people to improve it without

expecting anything in return. This is the revolution of the Open Source movement that we see

and hear about so often on the Internet and in the media.

14

If crackers can use Linux to penetrate servers, security specialists can use the same means to

protect servers (to win a war, you should at least have equivalent weapons to what your enemy

may be using). When security holes are encountered, Linux is the one operating system that has

a solution and that is not by chance. Now someone may say: with all these beautiful features why

is Linux not as popular as other well know operating system? There are many reasons and

different answers on the Internet. I would just say that like everything else in life, anything that we

are to expect the most of, is more difficult to get than the average and easier to acquire. Linux

and *NIX are more difficult to learn than any other operating system. It is only for those who want

to know computers in depth and know what they doing. People prefer to use other OS’s, which

are easy to operate but hard to understand what is happening in the background since they only

have to click on a button without really knowing what their actions imply. Every UNIX operating

system like Linux will lead you unconsciously to know exactly what you are doing because if you

pursue without understanding what is happening by the decision you made, then nothing will

surely work as expected. This is why with Linux; you will know the real meaning of a computer

and especially a server environment where every decision warrants an action which will closely

impact on the security of your organization and employees.

Many Web sites are open to all sorts of "web hacking." According to the Computer Security

Institute and the FBI's joint survey, 90% of 643 computer security practitioners from government

agencies, private corporations, and universities detected cyber attacks last year. Over

$265,589,940 in financial losses was reported by 273 organizations.

Many readers of the previous version of this book told me that the book was an easy step by step

guide for newbie’s, I am flattered but I prefer to admit that it was targeting for a technical audience

and I assumed the reader had some background in Linux, UNIX systems. If this is not true in your

case, I highly recommend you to read some good books in network administration related to

UNIX and especially to Linux before venturing into this book. Remember talking about security

and optimization is a very serious endeavor. It is very important to be attentive and understand

every detail in this book and if difficulties arise, try to go back and reread the explanation will save

a lot of frustration. Once again, security is not a game and crackers await only one single error

from your part to enter your system. A castle has many doors and if just one stays open, will be

enough to let intruders into your fortress. You have been warned.

Many efforts went into the making of this book, making sure that the results were as accurate as

possible. If you find any abnormalities, inconsistent results, errors, omissions or anything else that

doesn't look right, please let me know so I can investigate the problem and/or correct the error.

Suggestions for future versions are also welcome and appreciated. A web site dedicated to this

book is available on the Internet for your convenience. If you any have problem, question,

recommendation, etc, please go to the following URL: http://www.openna.com/. We made this

site for you.

Audience

This book is intended for a technical audience and system administrators who manage Linux

servers, but it also includes material for home users and others. It discusses how to install and

setup a Linux server with all the necessary security and optimization for a high performance Linux

specific machine. It can also be applied with some minor changes to other Linux variants without

difficulty. Since we speak of optimization and security configuration, we will use a source

distribution (tar.gz) program for critical server software like Apache, ISC BIND/DNS, Samba,

Squid, OpenSSL etc. Source packages give us fast upgrades; security updates when necessary,

and better compilation, customization, and optimization options for specific machines that often

aren’t available with RPM packages.

Preface

15

These installation instructions assume

You have a CD-ROM drive on your computer and the Official Red Hat Linux or OpenNA Linux

CD-ROM. Installations were tested on the Official Red Hat Linux version 7.3 and OpenNA Linux.

You should familiarize yourself with the hardware on which the operating system will be installed.

After examining the hardware, the rest of this document guides you, step-by-step, through the

installation process.

Obtaining the example configuration files

In a true server environment and especially when Graphical User Interface is not installed, we will

often use text files, scripts, shell, etc. Throughout this book we will see shell commands, script

files, configuration files and many other actions to execute on the terminal of the server. You can

enter them manually or use the compressed archive file that I made which contains all

configuration examples and paste them directly to your terminal. This seems to be useful in many

cases to save time.

The example configuration files in this book are available electronically via HTTP from this URL:

ftp://ftp.openna.com/ConfigFiles-v3.0/floppy-3.0.tgz

• In either case, extract the files into your Linux server from the archive by typing:

[root@deep /]# cd /var/tmp

[root@deep tmp]# tar xzpf floppy-3.0.tgz

If you cannot get the examples from the Internet, please contact the author at this email address:

[email protected]

Problem with Securing & Optimizing Linux

When you encounter a problem in "Securing & Optimizing Linux" we want to hear about it. Your

reports are an important part in making the book more reliable, because even with the utmost

care we cannot guarantee that every part of the book will work on every platform under every

circumstance.

We cannot promise to fix every error right away. If the problem is obvious, critical, or affects a lot

of users, chances are that someone will look into it. It could also happen that we tell you to

update to a newer version to see if the problem persists there. Or we might decide that the

problem cannot be fixed until some major rewriting has been done. If you need help immediately,

consider obtaining a commercial support contract or try our Q&A archive from the mailing list for

an answer.

Below are some important links:

OpenNA web site: http://www.openna.com/

Mailing list: http://www.openna.com/support/mailing/mailing.php

Support: http://www.openna.com/support/support.php

RPM Download: http://www.openna.com/downloads/downloads.php

Acknowledgments

I would like to thank all the OpenNA staff for their hard works and patience. A special gratitude

and many thanks to Colin Henry who made tremendous efforts to make this book grammatically

and orthographically sound in a professional manner. Adrian Pascalau for its time and help in the

open source community and all Linux users around the world who have participated by providing

good comments, ideas, recommendations and suggestions.