Chapter 16 securing the system step by step
the unauthorized reproduction in whole or in part of this publication in any form is prohibited
in this lesson we will dedicate ourselves to an overview of basic issue of system security.
Let's start with dividing the hard disk into partitions in order to maintain an optimal level of security.
We recommend that a vision into the partitions slash slash swap slash var and slash boot
after having performed this division.
We shouldn't forget about the correct settings of the administrators password the password shouldn't
be too easy or too short.
We recommended using passwords containing special characters
only the use of a sufficiently difficult and long password will allow us to secure our system optimally.
Now let's proceed with setting simple rules for filtering the network traffic.
We will use the script that we have prepared earlier.
Let's copy the exhilarate files from the disk included in the set
the startup of the firewall dot sh script will cause the packets incoming on all ports to be blocked.
With the exception of 20 21 FGP and 80 HTP
we can check the set of the rules currently valid with the IP tables command.
After a preliminary configuration of the rules for the network traffic we will now proceed with switching
off the superfluous services.
Therefore let's analyze the slash ATC slash I-net d dot com file
as we can see at the present moment a number of services are available that we don't intend to use.
We will switch them off by using the commentary sign
in order for the changes entered to be visible.
It is necessary to reload the I net DB configuration daemon first.
We do this using the command kill all H U P I D
comin out the records of the Damen I d configuration file we can also use the ready made script.
D.
If the s s h service server is installed in the system it is also necessary to use a secure configuration
after making changes to the configuration file.
We must force the reloading of the program settings.
Now let's proceed with the next verification and configuration of the programs which the id attribute
we will use for this purpose the program it will generate a list of files that work with administrator
rights.
After a moment DSU ID text file has been generated which contains the applications it has found.
Let's have a look at it and make modifications.
We update the settings using the P.L. command
as we can see the attribute has disappeared from the string representing the access rights.
If we don't want every user to be able to change his own password we delete the id attribute from the
slash.
You are slash Ben slash past the WD program.
The last operation we will perform is to determine the secure terminals where the administrator can
log on locally
after performing the basic configuration we shouldn't forget about the kernel of our system.
The current kernel version is located under the address kernel dot org
so we have now reached the end of the basic system configuration.
Advanced security mechanisms will be presented in less than 18.