RedHat Edition -A Hands on Guide
Copyright © 2000 Gerhard Mourani and OpenDocs, LLC.
Copyright © 2000 Madhusudan (Madhu "Maddy") XML Source
This version and its subsequent outputs whether be it HTML, PDF or any other derivatives can be distributed under the same licensing terms and conditions as the original Securing and Optimizing Linux i.e. as set forth in the Open Publication License; V1.0 or later, the latest version is presently available at www.opencontent.org/openpub/.
Please note even if i madhusudan (Madhu "Maddy"),<needaguru@yahoo.com> hold the copyright for the XML source(Markup), you still need to get permission from Gerhard Mourani<gmourani@openna.com> the original author of Securing and Optmising Linux,
to make any changes to the content of this book. Please do read the licensing terms and conditions detailed below for additional information
This material may be distributed only subject to the terms and conditions set forth in the Open Publication License; V1.0 or later, the latest version is presently available at www.opencontent.org/openpub/.
Distribution of substantively modified versions of this document is prohibited without the explicit permission of the copyright holder.
Distribution of the work or derivative of the work in any standard (paper) book form for commercial purposes is prohibited unless prior permission is obtained from the copyright holder.
Please note even if I, Gerhard Mourani have the copyright, I don't control commercial printing of the book. Please contact OpenDocs @www.opendocspublishing.com/ if you have questions concerning such matters.
The logos, trademarks, symbols used in this book are properties of their respective compan(y)ies.
Table of Contents
- Preface
- 1. Getting Started
- 2. Installation
- 2. Overview of OS Linux
- 3. Installation of your Linux Server
- 1. Know your Hardware!
- 2. Creating the Boot Disk and Booting
- 3. Installation Class and Method (Install Type)
- 4. Disk Setup- Disk Druid
- 5. Disk Druid
- 6. An example
- 7. Post-Partitioning
- 8. Components to Install- Package Group Selection
- 9. Select Individual Package - Part 'A'
- 10. Select Individual Package -Part 'B'
- 11. How to use RPM Commands
- 12. Starting and stopping daemon services
- 4. Post-Install
- 3. Security, Optimization and Upgrade
- 5. General System Security
- 1. BIOS
- 2. Security as a Policy
- 3. Choose a right Password
- 4. The root account
- 5. The
/etc/exportsfile - 6. Disable console program access
- 7. Disable all console access
- 8. The inetd -
/etc/inetd.conffile - 9. TCP_WRAPPERS
- 10. The
/etc/host.conffile - 11. The /etc/services file
- 12. The
/etc/securettyfile - 13. Special accounts
- 14. Blocking; su to root, by one and sundry
- 15. Put limits on resource
- 16. Control mounting a file system
- 17. Conceal binary RPM
- 18. Shell logging
- 19. The LILO and
lilo.conffile - 20. Disable Ctrl-Alt-Delete keyboard shutdown command
- 21. Physical hard copies of all-important logs
- 22. Tighten scripts under
/etc/rc.d/ - 23. Bits from root-owned programs
- 24. The kernel tunable parameters
- 25. Refuse responding to broadcasts request
- 26. Routing Protocols
- 27. Enable TCP SYN Cookie Protection
- 28. Disable ICMP Redirect Acceptance
- 29. Enable always-defragging Protection
- 30. Enable bad error message Protection
- 31. Enable IP spoofing protection
- 32. Log Spoofed, Source Routed and Redirect Packets
- 33. Unusual or hidden files
- 34. System is compromised !
- 6. Linux General Optimization
- 1. The /etc/profile file
- 2. Benchmark Results
- 3. Benchmark results-i586
- 4. Benchmark results -i486
- 5. The bdflush parameters
- 6. The buffermem parameters
- 7. The ip_local_port_range parameters
- 8. The
/etc/nsswitch.conffile - 9. The file-max parameter
- 10. The ulimit parameter
- 11. The atime and noatime attribute
- 12. Tuning IDE Hard Disk Performance
- 13. Better manage your TCP/IP resources
- 7. Configuring and Building a Secure, Optimized Kernel
- 1. Pre-Install
- 2. Uninstallation and Optimization
- 3. Securing the kernel
- 4. Compilation
- 5. Kernel configuration -Part "A"
- 6. Kernel configuration -Part "B"
- 7. Kernel configuration -Part "C"
- 8. Kernel configuration -Part "D"
- 9. Kernel configuration -Part "E"
- 10. Installing the new kernel
- 11. Delete programs, Edit files pertaining to modules
- 12. Create a emergency Rescue and Boot floppy disk
- 4. Networking -Management, Firewall, Masquerading and Forwarding
- 5. Software -Security
- 6. Software -Networking
- 15. Software -Securities
- 16. Software -Securties(commercial)
- 1. Linux SSH2 Client/Server
- 2. Configure and Optimise SSH2
- 3. Configure the
/etc/ssh2/ssh2_configfile - 4. Configure the
/etc/ssh2/sshd2_configfile - 5. Configure sshd2 to use tcp-wrappers/inetd super server
- 6. Configuration of the
/etc/pam.d/sshfile - 7. Ssh2 Per-User Configuration
- 8. SSH2 Users Tools
- 9. Installed files
- 17. Software -Securities/System Integrity
- 18. Linux Tripwire ASR 1.3.1
- 19. Software -Securities/Management & Limitation
- 20. Set Limits using Qouta
- 21. Software -Networking
- 22. Software -Server/Mail Network
- 1. Linux Sendmail Server
- 2. Compile and optimize
- 3. Configurations
- 4. The
/etc/sendmail.mcfile /Central Mail Hub - 5. Build and Tweak Sendmail
- 6. The
/etc/mail/accessandaccess.dbfiles - 7. The
/etc/mail/aliasesandaliases.dbfiles - 8. The
/etc/mail/local-host-namesfile - 9. The
/etc/rc.d/init.d/sendmailscript file - 10. Secure Sendmail using smrsh
- 11. The
/etc/mail/aliasesfile - 12. Limit queue processing to
root - 13. Sendmail Administrative Tools
- 14. Installed files: Sendmail -Central Mail Hub
- 15. Installed files: Sendmail -Local server/client
- 23. Linux IMAP & POP Server
- 24. Software -Networking/Encryption
- 25. Linux FreeS/WAN VPN
- 1. IPSEC/VPN -FreeS/WAN
- 2. Compile, insert FreeS/WAN into the kernel
- 3. Reconfigure and install the kernel with FreeS/WAN VPN support
- 4. Configure to optimise
- 5. Automatic or Manual Key connections
- 6. The
/etc/ipsec.conffile - 7. The
/etc/ipsec.secretsfile - 8. Configure RSA private keys secrets
- 9. Required network setup for IPSec
- 10. Testing the installation
- 11. Further documentation
- 12. Installed files
- 26. Linux OpenLDAP Server
- 1. Compile and Install
- 2. Compile and Optimize
- 3. Configurations
- 4. Configure the
/etc/ldap/slapd.conffile - 5. Configure the
/etc/rc.d/init.d/ldapscript file - 6. Securing OpenLDAP
- 7. OpenLDAP Creation and Maintenance Tools
- 8. Create the LDMB backend database on-line
- 9. OpenLDAP Users Tools
- 10. Installed files
- 27. Linux PostgreSQL Database Server
- 28. Software -Server/Proxy Network
- 1. Linux Squid Proxy Server
- 2. Configure and Optimize
- 3. Improve performance Using GNU malloc library
- 4. Compile and Optimize
- 5. Configurations
- 6. Configure the
/etc/squid/squid.conffile -inhttpd-accelerator mode - 7. Configure of the
/etc/squid/squid.conffile -/proxy-caching mode - 8. Configure the
/etc/rc.d/init.d/squidscript file -/all configurations - 9. Configure the
/etc/logrotate.d/squidfile - 10. Optimizing Squid
- 11. Netscape Proxies Configuration
- 12. Installed files
- 29. Software -Network Server, web/Apache
- 1. Linux MM Shared Memory Library
- 2. Compile
- 3. Linux Apache Web Server
- 4. Compile and Optimize
- 5. Configure and apply PHP4 to Apache source
- 6. Apply mod_perl to Apache source tree
- 7. Install Apache
- 8. Post install Configuration
- 9. Configure the
/etc/httpd/conf/httpd.conffile - 10. Configure the
/etc/logrotate.d/apachefile - 11. Configure the
/etc/rc.d/init.d/httpdscript file - 12. PHP4 server-side scripting
- 13. Perl module Devel::Symdump
- 14. CGI.pm Perl library
- 15. Securing Apache
- 16. users authentication with
.dbmpasswdpassword file - 17. Apache in a chroot jail
- 18. Apache to use shared libraries
- 19. The
/chroot/etcdirectory - 20. Test the new chrooted jail
- 21. Configure the new
/etc/logrotate.d/apachefile - 22. Optimizing Apache
- 23. Installed files for Apache Web Server
- 24. Installed files /PHP4
- 25. Installed files by mod_perl
- 30. Optional component to install with Apache
- 1. Linux Webalizer
- 2. Compile
- 3. Configure the
/etc/webalizer.conffile - 4. Make Apache aware of Webalizer output directory
- 5. Run Webalizer automatically with a cron job
- 6. Linux FAQ-O-Matic
- 7. Compile and install FAQ-O-Matic
- 8. Make Apache aware Faq-O-Matic file's location
- 9. Configure your FAQ-O-Matic
- 10. Installed files
- 11. Linux Webmail IMP
- 12. Set up PHPLib
- 13. Compile to install Webmail IMP
- 14. Configure and create Webmail IMP SQL database
- 15. Configure your
php.inifrom PHP4 - 16. Configure Webmail IMP via your web browser
- 31. Software -Server/File Sharing-Network
- 1. Linux Samba Server
- 2. Configure Samba
- 3. Compile and optimize
- 4. Configurations
- 5. Configuration of the
/etc/smb.conffile - 6. Configure the
/etc/lmhostsfile - 7. Encrypted Samba password file for clients
- 8. Optimizing Samba
- 9. Tuning the buffermem
- 10. Further documentation
- 11. Samba Administrative Tools
- 12. The
/etc/rc.d/init.d/smbscript file - 13. Installed files
- 32. Linux
FTPServer - 1. chroot'd Guest FTP access
- 2. Setup an
FTPuser account minus shells - 3. Setup a chroot user environment
- 4. Configurations
- 5. Configure the
/etc/ftphostsfile - 6. Configure the
/etc/ftpconversionsfile - 7. Configure the
/etc/logrotate.d/ftpdfile - 8. FTP Administrative Tools
- 9. Securing
FTP - 10. The special file
.notar - 11. Installed files
- 7. Backup and Restore
- I. Appendixes
List of Tables
List of Examples
- 3.1. Starting and Stopping various Daemon's
- 5.1. Export file systems using NFS
- 5.2. Disable console-equivalent access
- 5.3. Print log reports
- 5.4. Use man pages
- 5.5. Use find to find
- 6.1. For 128 MB of RAM
- 7.1. SMP support
- 8.1. Two ISA ethernet cards
- 12.1.
rc.firewall.blocked - 13.1. Using tar
- 15.1. Remote login using ssh
- 15.2. scp Secure Copy utility
- 15.3. local to remote
- 16.1. login to a remote using ssh2
- 16.2. sftp2, Secure File Transfer
- 18.1. Usage of Tripwire
- 19.1. Importing using gpg
- 19.2. Signing key
- 19.3. Encrypting
- 19.4. Decrypting
- 20.1.
usrquota - 20.2.
grpquota - 21.1. dnsquery
- 21.2. Look up host names
- 21.3. Using host
- 21.4. List a complete domain
- 22.1. Overriding RBL
- 22.2. Alternative names
- 22.3.
sendmail.cf - 26.1.
my-data-file - 26.2. LDMB backend
- 26.3.
modifyentry - 26.4. Address Book
- 30.1. Using Netscape browser
- 33.1. Backup directory of a week
- 33.2. scp SSH command
- 33.3. scp SSH command