![Close [x]](http://dw1.s81c.com/i/c.gif){kind=small}
Summary
Reviewing the hardened system
On the example system used for this tutorial, these changes have been made:
- In
/etc/inittab:- The following entries were disabled:
rcnetw,writesrv,httpdlite,imnss,imqss,dt, and lines l2 through l9 which referenced the System V script directories. - The
/etc/rc.nfsscript was modified to prevent the startup of therpc.statdandrpc.lockddaemons. - An entry was added to execute the
/etc/rc.noscript, setting network options.
- The following entries were disabled:
- In
/etc/rc.tcpip:- The lines of the script responsible for starting the
snmpd,dpid2, andx_st_mgrddaemons were disabled.
- The lines of the script responsible for starting the
- In
/etc/inetd.conf:- The following services were disabled:
shell,kshell,login,klogin,exec,bootps,tftp,rstatd,rusersd,rwalld,sprayd,pcnfsd,echo,discard,chargen,daytime,time,ttdbserver,ssalld,instsrv,dtspc, andcmsd. - The entry for
ftpwas modified to invoke the ftp daemon with the arguments-l -u077.
- The following services were disabled:
- Sendmail configuration was modified to prevent the open relaying of third-party mail.
As a result of those changes, the number of open ports on the system was reduced significantly:
| Port Number | Protocol | Well-Known Name | Daemon/Application | Started from |
21
|
tcp
|
ftp
|
/usr/sbin/ftpd
|
/etc/inetd.conf
|
23
|
tcp
|
telnet
|
/usr/sbin/telnetd
|
/etc/inetd.conf
|
25
|
tcp
|
smtp
|
/usr/sbin/sendmail
|
/etc/rc.tcpip
|
111
|
tcp
|
sunrpc
|
/usr/sbin/portmap
|
/etc/rc.tcpip
|
111
|
udp
|
sunrpc
|
/usr/sbin/portmap
|
/etc/rc.tcpip
|
514
|
udp
|
syslog
|
/usr/sbin/syslogd
|
/etc/rc.tcpip
|
Unfortunately, the answer to that question is "no". It is not enough to simply turn off some services and hope that what remains is secure. Constant monitoring of system logs and network services is required to guard against attempts at compromise and to check for signs of successful intrusion.
The steps outlined in this tutorial cover only what is possible with the tools provided by the operating system. No advantage was taken of the many open source and other free tools available. These software applications include OpenSSH, which provides secure replacements for so many of the insecure default services, and other tools like nmap, useful in determining the network footprint of a system and detecting unauthorized services that may be active.
Network security cannot be achieved by just keeping outsiders at bay. A truly safe system must have safeguards against illegitimate user activity, improper file access control, and a host of other issues. The steps outlined in this tutorial provide a necessary start to the never-ending process of developing a safe, secure, and productive computing environment.
A footnote on network security
Within the six days that the example system used in this tutorial was up and running, there were four distinct attempts at unauthorized access. System administrators who don't believe an attack is possible are not monitoring their logs close enough.
