The Seven Most Deadly Unix/Linux Sins

by Bob Toxen, author of

Real World Linux Security: Intrusion
Prevention, Detection, and Recovery 2nd Ed.
Published by Prentice-Hall PTR, Copyright 2003, 848pp

CTO, Horizon Network Security

Your expert in Network & Unix/Linux security,
including Adaptive Firewalls, VPNs, Virus
and spam filters, local and remote backup software,
24x7 monitoring, audits, and consulting
www.verysecurelinux.com
bob@verysecurelinux.com 770-662-8321
Presentation Copyright 2002, 2003, 2004, 2005 Horizon Network Security
All statements & comments are the opinions of Horizon Network Security
Chattanooga Java Users Group 06/16/2005
 Who are you?

System Administrator?

Security specialist?

Management?

Exclusively Windows?

Mostly Windows with some Linux/UNIX?

Mostly/exclusively Linux/UNIX?

How secure is your network?.

 The Seven Most Deadly Unix/Linux Sins
#1: Weak and default passwords

#2: Open network ports

#3: Old software versions

#4: Insecure and badly configured programs

#5: Insufficient resources/misplaced priorities

#6: Stale and unnecessary accounts

#7: PROCRASTINATION!!!
 #1: Weak and default passwords
Verify that no default or empty passwords in use
Educate users on selecting good passwords (Thompson test)
No word or pair of words
Should be at least 10 chars (15-20 better)
Not based on personal info: SO, chil’n, car tag, hobby/interests
Do not use terms for computing or Science Fiction
Do not rely on capitalization
Do not rely on substitutions (zero for "oh", one for "el")
Use cracklib, etc. to ensure good passwords selected
Use crack, etc. to try to crack passwords
(with written management approval)
Avoid unencrypted passwords on disk and over network
 #2: Open network ports
Turn off NFS,portmap,mountd,telnet,FTP,lpd/cups,auth,etc.

Turn off named (DNS) unless serving to other systems

If you send mail out but not in, remove "-bd"

If sendmail must receive local mail, listen on only IP 127.0.0.1:

"O DaemonPortOptions=Name=MTA, Address=127.0.0.1"

Check for daemons and turn unneeded ones off

netstat -anp | more
ports | more
ps -axlww | more
 #3: Old software versions
Patch quickly (but carefully, with testing)

Upgrade before a vendor stops support of current version

Dump vendors that do not issue timely patches

(24 hours is typical of good vendors.)

Dump vendors and programs with a poor security history

#4: Insecure and badly configured programs
If you run named (DNS) or auth (ident), do not run as root

Don’t run Apache as root but have its files owned by

root mode 644 (-rw-r--r--); use suEXEC for CGIs

Don’t use PHP (too many recent security bugs)

Audit CGIs by one who understands secure programming

Good programming practices in CGIs

Rings of Security (suEXEC)

#5: Insufficient resources/misplaced priorities
Not a technical problem but "selling" management is critical

Show management "asides" in RWLS; that’s what they’re for

Give management Schneier’s "Secrets and Lies: Digital

Security in a Networked World"

Do demonstrations of secure products, e.g., Linux Firewalls

or Servers and problems with existing systems
(Don’t attack systems without written permission)

Never give up (but don’t risk your career)

 #6: Stale and unnecessary accounts
Document everywhere each class of user has passwords
or access cards, including SysAdmins, vendors, consultants

Suggest to HR policy that SysAdmins be told of termination,

disable access when person is "getting the word"

Give each new user a different initial good password;

most never will change it; I use current events
(Do not give the same password to different users)

Use a different password for each hi-security account

 #7: PROCRASTINATION!!!
Most SysAdmins who suffered break-ins knew they had
patches or reconfigurations to do but delayed doing it
 Questions?
The Seven Most Deadly Unix/Linux Sins
by Bob Toxen, author of
Real World Linux Security 2nd Ed.
Published by Prentice-Hall PTR, Copyright 2003, 848pp

CTO, Horizon Network Security

Your expert in Network & Unix/Linux security
www.verysecurelinux.com
bob@verysecurelinux.com 770-662-8321
Chattanooga Java Users Group
06/16/2005
Presented by Magic Point, the Unix/Linux Open Source tool