 | Level: Intermediate Gary V. Vaughan (gary@gnu.org), Freelance open source developer and technical writer, Azazil
23 May 2007 For technical and non-technical users alike, maintaining a large
installed base of Linux machines can be a harrowing experience for an administrator.
Technical users take advantage of Linux®'s extreme configurability to change
everything to their liking, while non-technical users running amok within their own
file systems. This tutorial is the first in a two-part series that shows you how and
why to lock those machines down to streamline the associated support and
administration processes. In this tutorial, you learn how to remove the interpreters
from the installation base system.
In this tutorial
- Learn some of the security issues that you must
consider when supporting a large-scale Linux installation and how to minimize
their risk and cost.
- See how to set up
the hardware and firmware to prevent basic tampering.
- Remove the standard Linux interpreters to minimize the
risk of users running unaudited code in your secure environment.
- Configure an industrial-grade,
locked-down Linux distribution that cannot be injected with applications that
you have not personally audited and signed off.
Objectives
This tutorial gives you reasons for keeping Linux's customizability under
control and shows you how to lock down a standard Linux
distribution to prevent spurious user changes to the baseline installation. It
lays the groundwork for Part 2 in this series, which completes the lockdown
process by building a kernel that enforces the use of only signed binaries that
have been introduced in a controlled way to each machine that must be
supported.
Prerequisites
This tutorial is written for Linux administrators whose skills and experience
are at an intermediate to advanced level. You should have good familiarity with
the Linux boot process, be comfortable with a command-line shell, and possess a
working knowledge of the C programming language.
System requirements
You need an
old Linux installation that you don't mind breaking, preferably with a rescue
disk in case something goes wrong. If you have any data you might ever need to
get back to on that machine (even if you follow this tutorial on a different
partition or on a separate drive using a multi-boot setup), you'll need to make
and test a full backup of that data before you try any of the techniques
described here.
Duration
More than 2 hours
Formats html, pdf
Learn more
| | | |
