From b76270bf9e6dd375e495fec92140a79a79415d27 Mon Sep 17 00:00:00 2001 From: Patrick J Volkerding Date: Wed, 19 May 2010 08:58:23 +0000 Subject: Slackware 13.1 Wed May 19 08:58:23 UTC 2010 Slackware 13.1 x86_64 stable is released! Lots of thanks are due -- see the RELEASE_NOTES and the rest of the ChangeLog for credits. The ISOs are on their way to replication, a 6 CD-ROM 32-bit set and a dual-sided 32-bit/64-bit x86/x86_64 DVD. We are taking pre-orders now at store.slackware.com, and offering a discount if you sign up for a subscription. Consider picking up a copy to help support the project. Thanks again to the Slackware community for testing, contributing, and generally holding us to a high level of quality. :-) Enjoy! --- misc/slackbook/html/security.html | 218 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 218 insertions(+) create mode 100644 misc/slackbook/html/security.html (limited to 'misc/slackbook/html/security.html') diff --git a/misc/slackbook/html/security.html b/misc/slackbook/html/security.html new file mode 100644 index 000000000..34249a8bc --- /dev/null +++ b/misc/slackbook/html/security.html @@ -0,0 +1,218 @@ + + + + +Security + + + + + + + + +
+ + + + + + + + + + +
Slackware Linux Essentials
PrevNext
+ +
+
+ +
+

Chapter 14 Security

+ +
+
+
Table of Contents
+ +
14.1 Disabling Services
+ +
14.2 Host Access Control
+ +
14.3 Keeping Current
+
+
+ +

Security on any system is important; it can prevent people launching attacks from your +machine, as well as protect sensitive data. This chapter is all about how to start +securing your Slackware box against script kiddies, crackers and rogue hamsters alike. +Bear in mind that this is only the start of securing a system; security is a process, not +a state.

+ +
+

14.1 Disabling +Services

+ +

The first step after installing Slackware should be to disable any services you don't +need. Any services could potentially pose a security risk, so it is important to run as +few services as possible (i.e. only those that are needed). Services are started from two +main places - inetd and init scripts.

+ +
+

14.1.1 Services started from inetd

+ +

A lot of the daemons that come with Slackware are run from inetd(8). inetd is a daemon that listens on +all of the ports used by services configured to be started by it and spawns an instance +of the relevant daemon when a connection attempt is made. Daemons started from inetd can be disabled by commenting out the relevant lines in /etc/inetd.conf. To do this, open this file in your favorite editor +(e.g. vi) and you should see lines similar to this:

+ + + + + +
+
+telnet stream  tcp     nowait  root    /usr/sbin/tcpd  in.telnetd
+
+
+ +

You can disable this service, and any others you don't need, by commenting them out +(i.e. adding a # (hash) symbol to the beginning of the line). +The above line would then become:

+ + + + + +
+
+#telnet stream  tcp     nowait  root    /usr/sbin/tcpd  in.telnetd
+
+
+ +

After inetd has been restarted, this service will be +disabled. You can restart inetd with the command:

+ + + + + +
+
+# kill -HUP $(cat /var/run/inetd.pid)
+
+
+
+ +
+

14.1.2 Services started from init +scripts

+ +

The rest of the services started when the machine starts are started from the init +scripts in /etc/rc.d/. These can be disabled in two different +ways, the first being to remove the execute permissions on the relevant init script and +the second being to comment out the relevant lines in the init scripts.

+ +

For example, SSH is started by its own init script at /etc/rc.d/rc.sshd. You can disable this using:

+ + + + + +
+
+# chmod -x /etc/rc.d/rc.sshd
+
+
+ +

For services that don't have their own init script, you will need to comment out the +relevant lines in the init scripts to disable them. For example, the portmap daemon is +started by the following lines in /etc/rc.d/rc.inet2:

+ + + + + +
+
+# This must be running in order to mount NFS volumes.
+# Start the RPC portmapper:
+if [ -x /sbin/rpc.portmap ]; then
+  echo "Starting RPC portmapper:  /sbin/rpc.portmap"
+  /sbin/rpc.portmap
+fi
+# Done starting the RPC portmapper.
+
+
+ +

This can be disabled by adding # symbols to the beginnings +of the lines that don't already start with them, like so:

+ + + + + +
+
+# This must be running in order to mount NFS volumes.
+# Start the RPC portmapper:
+#if [ -x /sbin/rpc.portmap ]; then
+#  echo "Starting RPC portmapper:  /sbin/rpc.portmap"
+#  /sbin/rpc.portmap
+#fi
+# Done starting the RPC portmapper.
+
+
+ +

These changes will only take effect after either a reboot or changing from and back to +runlevel 3 or 4. You can do this by typing the following on the console (you will need to +log in again after changing to runlevel 1):

+ + + + + +
+
+# telinit 1
+# telinit 3
+
+
+
+
+
+ +
+
+ + + + + + + + + + + + +
PrevHomeNext
Talking to Other People Host Access Control
+
+ + + -- cgit v1.2.3