Securing Linux Servers for Service Providers

Short Description
Step by Step, Kurt Seifried’s Linux Administrator’s Security Guide, …. For a very good tutorial, see “Avoiding security holes when developing an …

Website: www.jalix.org | Filesize: 1044kb

Content
Securing Linux Servers for Service Providers
December 21, 2001
Bill Hilf
Sr. Consulting I/T Architect
IBM Corporation
billhilf@us.ibm.com
. Copyright IBM. Corp. 2001. All rights reserved. - 1 -Table of Contents
Overview of Linux in the Service Provider, or xSP, Space……………………………………………………………..3
Intent and Background………………………………………………………………………………………………………………4
SANS/FBI Top 20……………………………………………………………………………………………………………….5
Security Philosophy………………………………………………………………………………………………………………….6
Securing Linux Servers……………………………………………………………………………………………………………..6
General Practices…………………………………………………………………………………………………………………6
Develop a patch and upgrade strategy……………………………………………………………………………………..7
Understand which programs have Set-UID and Set-GID……………………………………………………………8
Develop a password strategy…………………………………………………………………………………………………..9
If you are not using a service, turn it off…………………………………………………………………………………11
Log intelligently…………………………………………………………………………………………………………………12
Use tools where possible………………………………………………………………………………………………………14
Application security is critical………………………………………………………………………………………………16
Kernel level security…………………………………………………………………………………………………………..18
Know Your Enemy…………………………………………………………………………………………………………….20
Linux Firewalls………………………………………………………………………………………………………………………24
What is a packet filter?………………………………………………………………………………………………………..24
Identification and Testing…………………………………………………………………………………………………….27
Linux FTP Servers………………………………………………………………………………………………………………….30
Non-Anonymous FTP………………………………………………………………………………………………………….30
Anonymous FTP………………………………………………………………………………………………………………..30
General Linux FTP Server suggestions…………………………………………………………………………………..31
Linux Mail Servers…………………………………………………………………………………………………………………32
Sendmail…………………………………………………………………………………………………………………………..32
Postfix………………………………………………………………………………………………………………………………34
Qmail……………………………………………………………………………………………………………………………….35
Linux Mail Virus and Spam Filters………………………………………………………………………………………..36
Linux Web and Application Servers…………………………………………………………………………………………..37
Apache Security Configuration Tips………………………………………………………………………………………38
Web server diagnosis………………………………………………………………………………………………………….43
Web Services…………………………………………………………………………………………………………………….44
Web proxies………………………………………………………………………………………………………………………45
Conclusion…………………………………………………………………………………………………………………………….46
Acknowledgements…………………………………………………………………………………………………………………47
Appendix - Resources……………………………………………………………………………………………………………..48
Resources - Mailing Lists…………………………………………………………………………………………………….48
Resources - Web Sites…………………………………………………………………………………………………………48
Resources - Books………………………………………………………………………………………………………………48
Resources…