1 |
Anders Bruun Olsen wrote: |
2 |
> On Tue, Nov 08, 2005 at 04:47:49PM -0600, Nathanael Hoyle wrote: |
3 |
> |
4 |
>>grsecurity does offer several things that I would look into here, |
5 |
>>notably the things dealing with restricting users to only see their own |
6 |
>>processes and the like. In general though, you need to be careful about |
7 |
>>the security basics: |
8 |
> |
9 |
> |
10 |
> Ahh yes, I remember that from playing around with grsecurity some years |
11 |
> back. That would be very nice to have on my server. |
12 |
> |
13 |
> |
14 |
>>1) Don't run *anything* setuid root that you don't trust 100%. Even |
15 |
>>then, avoid it if possible. |
16 |
> |
17 |
> |
18 |
> I am fairly certain I don't run anything at all setuid. |
19 |
> |
20 |
> |
21 |
>>2) Don't use a global 'nobody' account for daemons (as this allows one |
22 |
>>daemon running as nobody to compromise another one if compromised). Use |
23 |
>>separate uids/gids for each daemon process and make sure they have |
24 |
>>minimal priviledges to run. |
25 |
> |
26 |
> |
27 |
> I use the default Gentoo accounts for daemons - fairly certain none of |
28 |
> them use "nobody". I may be wrong? |
29 |
> |
30 |
|
31 |
Can't answer that question for all gentoo ebuilds. There are probably |
32 |
some that do. I haven't run all of the daemons that you are running, |
33 |
but rather than assume, check them out individually. As one example, I |
34 |
was dismayed to realize when I emerged pdns that by default it just runs |
35 |
root. I manually added a user and group for pdns and modified the |
36 |
config to run as those users after binding the port initially (since |
37 |
port 53 is priviledged). I'd verify user id's for each daemon. |
38 |
> |
39 |
>>3) Chroot jail daemon processes wherever possible. |
40 |
> |
41 |
> |
42 |
> Hmm.. any good guides or pointers to get Apache, MySQL, Postfix, |
43 |
> Courier-imap, rsyncd, ventrilo, cs-server, zope and so on to run in |
44 |
> jails? |
45 |
> |
46 |
As another poster has mentioned, mod_chroot for apache is worth looking |
47 |
into. rsyncd on gentoo comes with options to chroot in the conf.d as I |
48 |
recall. Postfix is quite happy to chroot after setting a config option |
49 |
as long as the jail is set up properly. The docs on postfix.org go into |
50 |
this setup pretty carefully. |
51 |
|
52 |
> |
53 |
>>4) Consider a shell for use with ssh which allows for restricting users |
54 |
>>to their home dirs (a la jail-shell). |
55 |
> |
56 |
> |
57 |
> That's a very good idea, only they still need to be able to start their |
58 |
> programs as they are used to. I can't seem to find jail-shell anywhere. |
59 |
> Is it just a concept for configuring i.e. Bash or is it actually |
60 |
> available somewhere? |
61 |
|
62 |
Googling "jail shell" turns up several different shells designed for this. |
63 |
> |
64 |
> |
65 |
>>5) Log everything possible about user logins and commands. Consider |
66 |
>>moving logs to a second system on a regular basis to avoid potential log |
67 |
>>compromises. |
68 |
> |
69 |
> |
70 |
> Unfortunately I don't have a second system to move logs to, but I can |
71 |
> see why it would be a very good idea. |
72 |
> |
73 |
> |
74 |
>>6) Deny remote root login via ssh. Further consider using |
75 |
>>public/private key pair authentication for ssh. |
76 |
> |
77 |
> |
78 |
> All Linux installations with sshd running I have ever setup (quite a |
79 |
> few) have had root-login via ssh blocked :). |
80 |
> |
81 |
> |
82 |
>>How secure you want to be is up to you in the end. vservers, while |
83 |
>>nice, are usually not required if you are diligent about the basics. |
84 |
> |
85 |
> |
86 |
> I see your point - if I get grsecurity up and running, do sensible |
87 |
> configurations and jail as many processes as possible I should be fine. |
88 |
> And anyway, this isn't exactly Pentagon or NASA - my server does not |
89 |
> hold any secrets worth breaking into, so the biggest threat is likely to |
90 |
> be scriptkiddies who should be easily twarted by sensible configuration, |
91 |
> grsec, jails and up-to-date program versions. |
92 |
> |
93 |
> Thanks! |
94 |
> |
95 |
|
96 |
Good luck, |
97 |
-- |
98 |
Nathanael Hoyle |
99 |
Systems and Networking |
100 |
Speed Express Networks, LLC |
101 |
nhoyle@××××××××××××.net |
102 |
432.837.2811 |
103 |
|
104 |
-- |
105 |
gentoo-security@g.o mailing list |