Linux Security: OS & Service Level Security in Linux Part-2

<div dir="ltr" style="text-align: left;" trbidi="on"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGRemCcYh-4YycwIWJZfwSQ4x7AaTjhgjax-1OWCqBgBRAYsVTP-xVSCoSrlwNoRJLyvQXi1EX8MJnEsfdaYekZkmk35D9al7qhQH-uMlOKvmJnqBJV85XaWcmFfiHuiMdb9ZFkz0g134H/s1600/Linux-security-part2-700x454.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGRemCcYh-4YycwIWJZfwSQ4x7AaTjhgjax-1OWCqBgBRAYsVTP-xVSCoSrlwNoRJLyvQXi1EX8MJnEsfdaYekZkmk35D9al7qhQH-uMlOKvmJnqBJV85XaWcmFfiHuiMdb9ZFkz0g134H/s1600/Linux-security-part2-700x454.jpg" /></a></div> <br /> <div class="wpb_row row-fluid" style="background-color: white; color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px; width: 699.96875px;"> <div class="span12 wpb_column column_container" style="box-sizing: border-box; float: left; margin-left: 0px; min-height: 31px; position: relative; width: 699.96875px;"> <div class="wpb_wrapper"> <div class="wpb_text_column wpb_content_element "> <div class="wpb_wrapper"> <div style="margin-bottom: 23px;"> <strong>Linux Security > OS & Service Level Security in Linux>Samba Server</strong></div> <h6 style="color: #222222; font-size: 22px; line-height: 28px; margin: 25px 0px 27px; text-rendering: optimizeLegibility;"> Samba Server:</h6> <div style="margin-bottom: 23px;"> <strong>About Samba Server:</strong></div> <div style="margin-bottom: 23px;"> Samba is an Open Source/Free Software suite that provides seamless file and print services to SMB/CIFS clients. Samba is freely available, unlike other SMB/CIFS implementations, and allows for interoperability between Linux/Unix servers and Windows-based clients.</div> <div style="margin-bottom: 23px;"> <strong>Service:</strong>  smb,nmb<br /> <strong>Port:</strong> 137,138,139,445<br /> <strong>Config File:</strong> /etc/samba/smb.conf</div> <div style="margin-bottom: 23px;"> <strong>Embeded security with samba serve</strong>r</div> <div style="margin-bottom: 23px;"> <strong>Global parameter</strong><strong> </strong></div> <div style="margin-bottom: 23px;"> <strong>interfaces </strong> = lo eth0 eth1 192.168.0.0/24<span style="color: red;"> <—samba service available on this interfaces only</span><br /> <strong>hosts allow</strong> = 127.  192.168.0. <span style="color: red;"><–samba service can be access through these IP Ranges only </span><br /> </div> <div style="margin-bottom: 23px;"> <strong>Samba Share parameter</strong></div> <div style="margin-bottom: 23px;"> <strong>valid users</strong> = vikas prabhat   <span style="color: red;"><–only these users can access samba share</span><br /> <strong>veto files </strong> = /*.exe/*.pdf/  <span style="color: red;"><—stop saving .exe  and .pdf files</span></div> <div style="margin-bottom: 23px;"> <strong>public = no</strong><br /> <strong>writable = yes</strong><br /> <strong>browseable = yes</strong><br /> <strong>create mask = 0765</strong></div> </div> </div> </div> </div> </div> <div class="wpb_row row-fluid" style="background-color: white; width: 699.96875px;"> <div class="span12 wpb_column column_container" style="box-sizing: border-box; float: left; margin-left: 0px; min-height: 31px; position: relative; width: 699.96875px;"> <div class="wpb_wrapper"> <div class="td_block_wrap td_text_with_title" style="padding-bottom: 20px !important; position: relative;"> <h4 class="block-title" style="border-bottom-color: rgb(77, 178, 236); border-bottom-style: solid; border-bottom-width: 2px; color: #222222; font-family: 'PT Sans', sans-serif; font-size: 28px; line-height: 34px; margin: 25px 0px 27px; position: relative; text-rendering: optimizeLegibility;"> <span style="background-color: #4db2ec; color: white; font-family: 'Roboto Condensed', sans-serif; padding: 3px 10px; z-index: 1;">DNS Server Securities</span></h4> <div class="td_mod_wrap" style="margin-bottom: 15px;"> <strong style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px;">Linux Security > OS and Service level Security > DNS Server</strong><br /> <div style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px; margin-bottom: 23px; position: relative; top: -9px;"> </div> <div style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px; margin-bottom: 23px; position: relative; top: -9px;"> <strong>About DNS Server :</strong></div> <div style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px; margin-bottom: 23px; position: relative; top: -9px;"> Domain Name Servers (DNS) are the Internet’s equivalent of a phone book. They maintain a directory of domain names and translate them to Internet Protocol (IP) addresses.</div> <div style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px; margin-bottom: 23px; position: relative; top: -9px;"> This is necessary because, although domain names are easy for people to remember, computers or machines, access websites based on IP addresses.</div> <div style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px; margin-bottom: 23px; position: relative; top: -9px;"> <strong>Service: </strong> named<br /> <strong>Port:</strong> 53 UDP<br /> <strong>Config FIle:</strong>  /etc/named.conf</div> <div style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px; margin-bottom: 23px; position: relative; top: -9px;"> ———————————————————————————–</div> <div style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px; margin-bottom: 23px; position: relative; top: -9px;"> <strong>Basic Configuration</strong>  <strong>/etc/named.conf</strong></div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> <span style="color: #262626; font-family: PT Sans, sans-serif;"><span style="font-size: 15px; line-height: 23px;"><b>options {</b></span></span><span style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px;"> listen-on port 53 { 127.0.0.1; };</span><span style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px;"> listen-on-v6 port 53 { ::1; };</span><span style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px;"> directory "/var/named";</span><span style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px;"> dump-file "/var/named/data/cache_dump.db";</span><span style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px;"> statistics-file "/var/named/data/named_stats.txt";</span><span style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px;"> memstatistics-file "/var/named/data/named_mem_stats.txt";</span><span style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px;"> allow-query { localhost; };</span><span style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px;"> listen-on port 53 { 127.0.0.1;192.168.1.254; };</span><span style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px;"> listen-on-v6 port 53 { ::1; };</span><span style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px;"> directory "/var/named";</span><span style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px;"> dump-file "/var/named/data/cache_dump.db";</span><span style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px;"> statistics-file "/var/named/data/named_stats.txt";</span><span style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px;"> memstatistics-file "/var/named/data/named_mem_stats.txt";</span><b style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px;"> };</b></div> <div style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px; margin-bottom: 23px; position: relative; top: -9px;"> <strong>Restricting zone transfers</strong></div> <div style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px; margin-bottom: 23px; position: relative; top: -9px;"> In order for your slave server(s) to be able to answer queries about your domain, they must be able to transfer the zone information from your primary server. Very few others have a need to do so. Therefore restrict zone transfers using the allow-transfer option, assuming 192.168.1.4 is the IP address of ns.linuxgateway.fake and adding yourself for debugging purposes:</div> <div style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px; margin-bottom: 23px; position: relative; top: -9px;"> zone “linuxgateway.fake” {<br /> allow-transfer { 192.168.1.4; localhost; };<br /> };</div> <div style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px; margin-bottom: 23px; position: relative; top: -9px;"> By restricting zone transfers you ensure that the only information available to people is that which they ask for directly – no one can just ask for all the details about your set-up.</div> <div style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px; margin-bottom: 23px; position: relative; top: -9px;"> ——————————————————————–</div> <h2 style="color: #222222; font-family: 'PT Sans', sans-serif; font-size: 36px; line-height: 42px; margin: 25px 0px 27px; text-rendering: optimizeLegibility;"> Protecting against spoofing</h2> <div style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px; margin-bottom: 23px; position: relative; top: -9px;"> Firstly, disable any queries for domains you don’t own, except from your internal/local machines. This not only helps prevent malicious use of your DNS server, but also reduces unnecessary use of your server.</div> <div style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px; margin-bottom: 23px; position: relative; top: -9px;"> Further, disable recursive queries except from internal/local sources. This reduces the risk of cache poisoning attacks (where false data is fed to your server).</div> <table class="crayon-table" style="background-attachment: initial !important; background-clip: initial !important; background-color: black; background-image: none !important; background-origin: initial !important; background-position: initial !important; background-repeat: initial !important; background-size: initial !important; border-collapse: collapse !important; border-image-outset: initial !important; border-image-repeat: initial !important; border-image-slice: initial !important; border-image-source: initial !important; border-image-width: initial !important; border-spacing: 0px !important; border: none !important; color: #262626; font-family: 'Ubuntu Mono', UbuntuMonoRegular, 'Courier New', monospace; font-size: 12px; line-height: 15px; margin-bottom: 0px !important; margin-left: -26px; margin-right: 0px !important; margin-top: 0px !important; max-width: 100%; padding: 0px !important; table-layout: auto !important; width: auto !important;"><tbody> <tr class="crayon-row" style="background: 0px 50%; border: none !important; margin: 0px !important; padding: 0px !important; vertical-align: top !important;"><td class="crayon-nums " data-settings="hide" style="background-attachment: initial !important; background-clip: initial !important; background-image: initial !important; background-origin: initial !important; background-position: initial !important; background-repeat: initial !important; background-size: initial !important; border-bottom-width: 0px; border-left-width: 0px; border-right-color: rgb(255, 255, 255) !important; border-right-width: 1px !important; border-style: initial; border-top-width: 0px; color: rgb(73, 73, 73) !important; margin: 0px !important; padding: 0px !important; vertical-align: top !important;"><div class="crayon-nums-content" style="background: 0px 50%; border: 0px; font-size: 15px !important; margin: 0px; padding: 0px; white-space: nowrap;"> <div class="crayon-num" data-line="crayon-55a9629c2715a059304565-3" style="background: 0px 50%; border: 0px; font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important; margin: 0px; padding: 0px 5px; text-align: center;"> 3</div> <div class="crayon-num crayon-striped-num" data-line="crayon-55a9629c2715a059304565-4" style="background-attachment: initial !important; background-clip: initial !important; background-image: initial !important; background-origin: initial !important; background-position: initial !important; background-repeat: initial !important; background-size: initial !important; border: 0px; font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important; margin: 0px; padding: 0px 5px; text-align: center;"> 4</div> <div class="crayon-num" data-line="crayon-55a9629c2715a059304565-5" style="background: 0px 50%; border: 0px; font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important; margin: 0px; padding: 0px 5px; text-align: center;"> 5</div> <div class="crayon-num crayon-striped-num" data-line="crayon-55a9629c2715a059304565-6" style="background-attachment: initial !important; background-clip: initial !important; background-image: initial !important; background-origin: initial !important; background-position: initial !important; background-repeat: initial !important; background-size: initial !important; border: 0px; font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important; margin: 0px; padding: 0px 5px; text-align: center;"> 6</div> <div class="crayon-num" data-line="crayon-55a9629c2715a059304565-7" style="background: 0px 50%; border: 0px; font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important; margin: 0px; padding: 0px 5px; text-align: center;"> 7</div> <div class="crayon-num crayon-striped-num" data-line="crayon-55a9629c2715a059304565-8" style="background-attachment: initial !important; background-clip: initial !important; background-image: initial !important; background-origin: initial !important; background-position: initial !important; background-repeat: initial !important; background-size: initial !important; border: 0px; font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important; margin: 0px; padding: 0px 5px; text-align: center;"> 8</div> <div class="crayon-num" data-line="crayon-55a9629c2715a059304565-9" style="background: 0px 50%; border: 0px; font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important; margin: 0px; padding: 0px 5px; text-align: center;"> 9</div> <div class="crayon-num crayon-striped-num" data-line="crayon-55a9629c2715a059304565-10" style="background-attachment: initial !important; background-clip: initial !important; background-image: initial !important; background-origin: initial !important; background-position: initial !important; background-repeat: initial !important; background-size: initial !important; border: 0px; font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important; margin: 0px; padding: 0px 5px; text-align: center;"> 10</div> <div class="crayon-num" data-line="crayon-55a9629c2715a059304565-11" style="background: 0px 50%; border: 0px; font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important; margin: 0px; padding: 0px 5px; text-align: center;"> 11</div> </div> </td><td class="crayon-code" style="background: 0px 50%; border: 0px; margin: 0px !important; padding: 0px !important; vertical-align: top !important; width: 672px;"><div class="crayon-pre" style="background: none !important; border: none !important; color: rgb(255, 255, 255) !important; font-size: 15px !important; margin: 0px; overflow: visible; padding: 0px; tab-size: 4; white-space: pre;"> <div class="crayon-line" id="crayon-55a9629c2715a059304565-1" style="background: 0px 50%; border: 0px; font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important; margin: 0px; padding: 0px 5px;"> <span class="crayon-e" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">options</span><span class="crayon-h" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;"> </span><span class="crayon-sy" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">{</span></div> <div class="crayon-line crayon-striped-line" id="crayon-55a9629c2715a059304565-2" style="background-attachment: initial !important; background-clip: initial !important; background-image: initial !important; background-origin: initial !important; background-position: initial !important; background-repeat: initial !important; background-size: initial !important; border: 0px; font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important; margin: 0px; padding: 0px 5px;"> <span class="crayon-h" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">      </span><span class="crayon-e" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">allow</span><span class="crayon-o" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">-</span><span class="crayon-e" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">query</span><span class="crayon-h" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;"> </span><span class="crayon-sy" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">{</span><span class="crayon-h" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;"> </span><span class="crayon-cn" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">192.168.1.0</span><span class="crayon-o" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">/</span><span class="crayon-cn" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">24</span><span class="crayon-sy" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">;</span><span class="crayon-h" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;"> </span><span class="crayon-v" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">localhost</span><span class="crayon-sy" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">;</span><span class="crayon-h" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;"> </span><span class="crayon-sy" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">}</span><span class="crayon-sy" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">;</span></div> <div class="crayon-line" id="crayon-55a9629c2715a059304565-3" style="background: 0px 50%; border: 0px; font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important; margin: 0px; padding: 0px 5px;"> <span class="crayon-sy" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">}</span><span class="crayon-sy" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">;</span></div> <div class="crayon-line crayon-striped-line" id="crayon-55a9629c2715a059304565-4" style="background-attachment: initial !important; background-clip: initial !important; background-image: initial !important; background-origin: initial !important; background-position: initial !important; background-repeat: initial !important; background-size: initial !important; border: 0px; font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important; margin: 0px; padding: 0px 5px;"> </div> <div class="crayon-line" id="crayon-55a9629c2715a059304565-5" style="background: 0px 50%; border: 0px; font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important; margin: 0px; padding: 0px 5px;"> <span class="crayon-i" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">zone</span><span class="crayon-h" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;"> </span><span class="crayon-s" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">"linuxgateway.fake"</span><span class="crayon-h" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;"> </span><span class="crayon-sy" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">{</span></div> <div class="crayon-line crayon-striped-line" id="crayon-55a9629c2715a059304565-6" style="background-attachment: initial !important; background-clip: initial !important; background-image: initial !important; background-origin: initial !important; background-position: initial !important; background-repeat: initial !important; background-size: initial !important; border: 0px; font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important; margin: 0px; padding: 0px 5px;"> <span class="crayon-h" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">      </span><span class="crayon-e" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">allow</span><span class="crayon-o" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">-</span><span class="crayon-e" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">query</span><span class="crayon-h" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;"> </span><span class="crayon-sy" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">{</span><span class="crayon-h" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;"> </span><span class="crayon-v" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">any</span><span class="crayon-sy" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">;</span><span class="crayon-h" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;"> </span><span class="crayon-sy" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">}</span><span class="crayon-sy" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">;</span></div> <div class="crayon-line" id="crayon-55a9629c2715a059304565-7" style="background: 0px 50%; border: 0px; font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important; margin: 0px; padding: 0px 5px;"> <span class="crayon-sy" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">}</span><span class="crayon-sy" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">;</span></div> <div class="crayon-line crayon-striped-line" id="crayon-55a9629c2715a059304565-8" style="background-attachment: initial !important; background-clip: initial !important; background-image: initial !important; background-origin: initial !important; background-position: initial !important; background-repeat: initial !important; background-size: initial !important; border: 0px; font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important; margin: 0px; padding: 0px 5px;"> </div> <div class="crayon-line" id="crayon-55a9629c2715a059304565-9" style="background: 0px 50%; border: 0px; font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important; margin: 0px; padding: 0px 5px;"> <span class="crayon-i" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">zone</span><span class="crayon-h" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;"> </span><span class="crayon-s" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">"196.168.2.in-addr.arpa"</span><span class="crayon-h" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;"> </span><span class="crayon-sy" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">{</span></div> <div class="crayon-line crayon-striped-line" id="crayon-55a9629c2715a059304565-10" style="background-attachment: initial !important; background-clip: initial !important; background-image: initial !important; background-origin: initial !important; background-position: initial !important; background-repeat: initial !important; background-size: initial !important; border: 0px; font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important; margin: 0px; padding: 0px 5px;"> <span class="crayon-h" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">      </span><span class="crayon-e" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">allow</span><span class="crayon-o" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">-</span><span class="crayon-e" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">query</span><span class="crayon-h" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;"> </span><span class="crayon-sy" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">{</span><span class="crayon-h" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;"> </span><span class="crayon-v" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">any</span><span class="crayon-sy" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">;</span><span class="crayon-h" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;"> </span><span class="crayon-sy" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">}</span><span class="crayon-sy" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">;</span></div> <div class="crayon-line" id="crayon-55a9629c2715a059304565-11" style="background: 0px 50%; border: 0px; font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important; margin: 0px; padding: 0px 5px;"> <span class="crayon-sy" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">}</span><span class="crayon-sy" style="font-family: inherit; font-size: inherit !important; font-weight: inherit !important; height: inherit; line-height: inherit !important;">;</span></div> </div> </td></tr> </tbody></table> <hr style="border-bottom-color: rgb(255, 255, 255); border-bottom-style: solid; border-left-width: 0px; border-right-width: 0px; border-top-color: rgb(238, 238, 238); border-top-style: solid; color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px; margin: 21px 0px;" /> <h6 style="color: #222222; font-family: 'PT Sans', sans-serif; font-size: 22px; line-height: 28px; margin: 25px 0px 27px; text-rendering: optimizeLegibility;"> options { allow-recursion { 192.168.2.0/24; localhost; }; }; —————————————————–</h6> <div style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px; margin-bottom: 23px; position: relative; top: -9px;"> chroot jail</div> <div style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px; margin-bottom: 23px; position: relative; top: -9px;"> A “jail” is a software mechanism for limiting the ability of a process to access resources outside a very limited area, and it’s done with security in mind. A nameserver often talks to the outside world, and time has shown that “the public internet” is a very hostile environment. Should a flaw in BIND be discovered, it could be exploited by one located anywhere on the planet: by isolating the process inside a jail, this restricts the harm that can be done to a compromised system.</div> <div style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px; margin-bottom: 23px; position: relative; top: -9px;"> A jail is created using the chroot() system call (named for “change root”), and it’s given a directory name as a parameter. Once this call is made, the root – the top of the directory tree – for this process is changed from / to the directory given, and there is no way for the process to get outside this area. We typically use /chroot/named to jail our nameservers, but we’ll note that the “chroot” in the directory name is just a convention: this is not required (e.g., “/usr/local/named” would make a fine jail location too).</div> </div> </div> </div> </div> </div> </div>

Linux Security: OS & Service Level Security in Linux Part-2

Linux Security > OS & Service Level Security in Linux>Samba Server Samba Server: About Samba Server: Samba is an O...

Read more »

Linux Security: OS & Service Level Security in Linux Part-1

<div dir="ltr" style="text-align: left;" trbidi="on"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgMFmQISinvMM4jFGdzoHmTpjTD5mRx9mkdFwcsN2S_exRJPyb0Hu0AScpp3Tb1_U09_rrfxIRpEHDCfku8qtn7p1MTwo2nmWM4fR2h7_x2qn2iplTsgo_gause0mIapCDV1UxnaMMzjJsk/s1600/Linux-security-part11-700x454.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgMFmQISinvMM4jFGdzoHmTpjTD5mRx9mkdFwcsN2S_exRJPyb0Hu0AScpp3Tb1_U09_rrfxIRpEHDCfku8qtn7p1MTwo2nmWM4fR2h7_x2qn2iplTsgo_gause0mIapCDV1UxnaMMzjJsk/s1600/Linux-security-part11-700x454.jpg" /></a></div> <br /> <h1 class="entry-title" itemprop="name" style="background-color: white; color: #222222; font-family: 'Roboto Condensed', sans-serif; font-size: 34px; font-weight: normal; line-height: 40px; margin: 17px 0px 7px; text-rendering: optimizeLegibility; word-wrap: break-word;"> <div class="wpb_row row-fluid" style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px; width: 699.96875px;"> <div class="span12 wpb_column column_container" style="box-sizing: border-box; float: left; margin-left: 0px; min-height: 31px; position: relative; width: 699.96875px;"> <div class="wpb_wrapper"> <div class="wpb_text_column wpb_content_element "> <div class="wpb_wrapper"> <div style="margin-bottom: 23px;"> <strong>Linux Security > OS & Service Level Security in Linux > sshd  server</strong></div> </div> </div> </div> </div> </div> </h1> <h4 class="block-title" style="border-bottom-color: rgb(77, 178, 236); border-bottom-style: solid; border-bottom-width: 2px; color: #222222; font-family: 'PT Sans', sans-serif; font-size: 28px; line-height: 34px; margin: 25px 0px 27px; position: relative; text-rendering: optimizeLegibility;"> <span style="background-color: #4db2ec; color: white; font-family: 'Roboto Condensed', sans-serif; padding: 3px 10px; z-index: 1;">SSH Server security</span></h4> <h6 style="color: #222222; font-family: 'PT Sans', sans-serif; font-size: 22px; line-height: 28px; margin: 25px 0px 27px; text-rendering: optimizeLegibility;"> <strong>About SSH Server:</strong></h6> <h1 class="entry-title" itemprop="name" style="background-color: white; color: #222222; font-family: 'Roboto Condensed', sans-serif; font-size: 34px; font-weight: normal; line-height: 40px; margin: 17px 0px 7px; text-rendering: optimizeLegibility; word-wrap: break-word;"> <div class="wpb_row row-fluid" style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px; width: 699.96875px;"> <div class="span12 wpb_column column_container" style="box-sizing: border-box; float: left; margin-left: 0px; min-height: 31px; position: relative; width: 699.96875px;"> <div class="wpb_wrapper"> <div class="td_block_wrap td_text_with_title" style="padding-bottom: 20px !important; position: relative;"> <div class="td_mod_wrap" style="margin-bottom: 15px;"> <div style="margin-bottom: 23px; position: relative; top: -9px;"> </div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> An SSH server is a software program which uses the secure shell protocol to accept connections from remote computers. SFTP/SCP file transfers and remote terminal connections are popular use cases for an SSH server. This article compares a selection of popular servers.<br /> Embedded Security With SSH</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> <strong>Service</strong>: sshd<br /> <strong>Port</strong> : 80<br /> <strong>Config File:</strong> /etc/sshd/sshd-config</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> ———————————————————————-<br /> <strong>Changing default port</strong><br /> Everybody knows that ssh works on port no 22 and root  user is able to login by default. We can change port no  for that, go to config file</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> # vi /etc/ssh/sshd_config<br /> #Port 22 <span style="color: red;"><– change port</span><br /> <strong>Port 6987</strong></div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> <strong>Listen Port  192.168.1.254:6987</strong> <span style="color: red;"> <— it allows port 6987 for ssh on IP 192.168.1.254</span></div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> <br /></div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> <strong>Disable root login</strong><br /> By enabling this feature , root can not login , we have to access ssh through another user, then switch user to root , for that search</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> <strong>PermitRootLogin</strong><br /> In the config file and modify<br /> #PermitRootLogin yes<br /> <strong>PermitRootLogin no</strong>  <span style="color: red;"> <— modify here and allow only some user to login through ssh</span></div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> <strong>AllowUsers vikas prabhat</strong>  <span style="color: red;"> < —  add this lines</span></div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> <strong>UsePAM  yes </strong></div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> Banner  “warning ….”    <span style="color: red;"><– always user ssh banner to warn users from unsolicited works</span></div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> <strong>#LoginGraceTime 2m</strong>   <span style="color: red;"><— login grace time is 2 min by default, we can reduce it</span></div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> <strong>#MaxAuthTries 6 </strong>  <span style="color: red;"><–maximum password retries, 3 is idle ..here 6 is default</span></div> </div> </div> </div> </div> </div> </h1> <h4 class="block-title" style="border-bottom-color: rgb(77, 178, 236); border-bottom-style: solid; border-bottom-width: 2px; color: #222222; font-family: 'PT Sans', sans-serif; font-size: 28px; line-height: 34px; margin: 25px 0px 27px; position: relative; text-rendering: optimizeLegibility;"> <span style="background-color: #4db2ec; color: white; font-family: 'Roboto Condensed', sans-serif; padding: 3px 10px; z-index: 1;">/etc/nologin</span></h4> <h1 class="entry-title" itemprop="name" style="background-color: white; color: #222222; font-family: 'Roboto Condensed', sans-serif; font-size: 34px; font-weight: normal; line-height: 40px; margin: 17px 0px 7px; text-rendering: optimizeLegibility; word-wrap: break-word;"> <div class="wpb_row row-fluid" style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px; width: 699.96875px;"> <div class="span12 wpb_column column_container" style="box-sizing: border-box; float: left; margin-left: 0px; min-height: 31px; position: relative; width: 699.96875px;"> <div class="wpb_wrapper"> <div class="td_block_wrap td_text_with_title" style="padding-bottom: 20px !important; position: relative;"> <div class="td_mod_wrap" style="margin-bottom: 15px;"> <strong>/etc/nologin</strong><br /> <div style="margin-bottom: 23px; position: relative; top: -9px;"> </div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> Create this file to disallow user logins and notify users when a system will be unavailable for an extended period of time because of a system shutdown or routine maintenance.</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> If a user attempts to log in to a system where this file exists, the contents of the nologin file is displayed, and the user login is terminated. Superuser logins are not affected</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> This file is not there by default, we have to create it, this is a blank file only, protect all non root users to login. This option does not effect on existing non root users ,who are already logged in.</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> </div> </div> </div> </div> </div> </div> </h1> <h4 class="block-title" style="border-bottom-color: rgb(77, 178, 236); border-bottom-style: solid; border-bottom-width: 2px; color: #222222; font-family: 'PT Sans', sans-serif; font-size: 28px; line-height: 34px; margin: 25px 0px 27px; position: relative; text-rendering: optimizeLegibility;"> <span style="background-color: #4db2ec; color: white; font-family: 'Roboto Condensed', sans-serif; padding: 3px 10px; z-index: 1;">Secure terminal in Linux : /etc/securetty</span></h4> <h1 class="entry-title" itemprop="name" style="background-color: white; color: #222222; font-family: 'Roboto Condensed', sans-serif; font-size: 34px; font-weight: normal; line-height: 40px; margin: 17px 0px 7px; text-rendering: optimizeLegibility; word-wrap: break-word;"> <div class="wpb_row row-fluid" style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px; width: 699.96875px;"> <div class="span12 wpb_column column_container" style="box-sizing: border-box; float: left; margin-left: 0px; min-height: 31px; position: relative; width: 699.96875px;"> <div class="wpb_wrapper"> <div class="td_block_wrap td_text_with_title" style="padding-bottom: 20px !important; position: relative;"> <div class="td_mod_wrap" style="margin-bottom: 15px;"> # vi /etc/securetty<br /> console<br /> vc/1<br /> vc/2<br /> vc/3<br /> vc/4<br /> vc/5<br /> vc/6<br /> vc/7<br /> vc/8<br /> vc/9<br /> vc/10<br /> vc/11<br /> tty1<br /> tty2<br /> tty3<br /> tty4<br /> <strong>#tty5</strong>   <span style="color: red;"><—-modified  line </span><br /> tty6<br /> tty7<br /> tty8<br /> tty9<br /> tty10<br /> tty11<br /> <div style="margin-bottom: 23px; position: relative; top: -9px;"> </div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> root can login in every terminal by default, if we modify this file <strong>/etc/securetty</strong> ,  <strong>#tty5</strong>  for example, root cannot login  in this terminal.</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> Note: <strong>/etc/securetty</strong> and <strong>/etc/nologin</strong> is controlled by  pam.d , If<strong> /etc/nologin</strong> file is created, then pam modules <strong>pan_nologin</strong> deny to all non-root users to login locally. As you can see in third line of<strong>/ete/pam.d/login</strong> file, <strong>pam_securetty</strong> modules checks the <strong>/etc/securetty</strong> file, which terminal are available to root. If terminal is not available in this file then<strong> pam_securetty module</strong> deny to login on unavailable terminal to root user.</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> <strong># vi /ete/pam.d/login</strong></div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> #%PAM-1.0<br /> auth [user_unknown=ignore success=ok ignore=ignore default=bad] <span style="color: red;">pam_securetty.so</span><br /> auth include system-auth<br /> <span style="color: red;">account required pam_nologin.so</span><br /> account include system-auth<br /> password include system-auth<br /> # pam_selinux.so close should be the first session rule<br /> session required pam_selinux.so close<br /> session required pam_loginuid.so<br /> session optional pam_console.so<br /> # pam_selinux.so open should only be followed by sessions to be executed in the user context<br /> session required pam_selinux.so open<br /> session required pam_namespace.so<br /> session optional pam_keyinit.so force revoke<br /> session include system-auth<br /> session optional pam_ck_connector.so</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> </div> </div> </div> </div> </div> </div> </h1> <h4 class="block-title" style="border-bottom-color: rgb(77, 178, 236); border-bottom-style: solid; border-bottom-width: 2px; color: #222222; font-family: 'PT Sans', sans-serif; font-size: 28px; line-height: 34px; margin: 25px 0px 27px; position: relative; text-rendering: optimizeLegibility;"> <span style="background-color: #4db2ec; color: white; font-family: 'Roboto Condensed', sans-serif; padding: 3px 10px; z-index: 1;">VSFTPD Server Security</span></h4> <h1 class="entry-title" itemprop="name" style="background-color: white; color: #222222; font-family: 'Roboto Condensed', sans-serif; font-size: 34px; font-weight: normal; line-height: 40px; margin: 17px 0px 7px; text-rendering: optimizeLegibility; word-wrap: break-word;"> <div class="wpb_row row-fluid" style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px; width: 699.96875px;"> <div class="span12 wpb_column column_container" style="box-sizing: border-box; float: left; margin-left: 0px; min-height: 31px; position: relative; width: 699.96875px;"> <div class="wpb_wrapper"> <div class="td_block_wrap td_text_with_title" style="padding-bottom: 20px !important; position: relative;"> <div class="td_mod_wrap" style="margin-bottom: 15px;"> <strong>About vsftpd server:</strong><br /> <div style="margin-bottom: 23px; position: relative; top: -9px;"> </div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> vsftpd, (or very secure FTP daemon), is an FTP server for Unix-like systems, including Linux.</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> Service:  vsftpd<br /> Port: 20/21<br /> Config File: /etc/vsftpd/vsftpd.conf</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> ————————————————–<br /> <strong>Embeded Security with vsftpd server</strong></div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> security options are already given in config file</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> <strong>pam_service_name=vsftpd</strong><br /> <strong>userlist_enable=YES <span style="color: red;"><– control by /etc/vsftpd/userlist</span></strong><br /> <strong>tcp_wrappers=YES</strong>  <strong><span style="color: red;"><–control by /etc/host.allow and /etc/host.deny</span></strong></div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> go to /etc/vsftpd</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> # <strong>vi /etc/vsftpd/userlist</strong></div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> # vsftpd userlist<br /> # If<span style="color: red;"> userlist_deny=NO</span>, only allow users in this file<br /> # If <span style="color: red;">userlist_deny=YES</span> (default), never allow users in this file, and<br /> # do not even prompt for a password.<br /> # <span style="color: red;">Note that the default vsftpd pam config also checks /etc/vsftpd/ftpusers</span><br /> # for users that are denied.<br /> root<br /> bin<br /> daemon<br /> adm<br /> lp<br /> sync<br /> shutdown<br /> halt<br /> mail<br /> news<br /> uucp<br /> operator<br /> games<br /> nobody</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> ———————————————————-</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> modify /etc/vsftpd/vsftpd.conf  at the bottom of the file</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> pam_service_name=vsftpd<br /> userlist_enable=YES<br /> <strong>userlist_deny=NO</strong>  <—place this file here<br /> tcp_wrappers=YES</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> <strong>Note: userlist_deny=NO</strong>  here means only allow users mentioned in the file /etc/vsftpd/userlist, if we modify like this</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> # vi /etc/vsftpd/userlist</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> # vsftpd userlist<br /> # If userlist_deny=NO, only allow users in this file<br /> # If userlist_deny=YES (default), never allow users in this file, and<br /> # do not even prompt for a password.<br /> # Note that the default vsftpd pam config also checks /etc/vsftpd/ftpusers<br /> # for users that are denied.<br /> #root<br /> #bin<br /> #daemon<br /> #adm<br /> #lp<br /> #sync<br /> #shutdown<br /> #halt<br /> #mail<br /> #news<br /> #uucp<br /> #operator<br /> #games<br /> #nobody<br /> <strong><span style="color: black;">vikas</span> </strong>   <span style="color: red;"><—–comment all and placed this two line</span>s<br /> <strong><span style="color: black;">prabhat</span></strong></div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> this means, user prabhat and vikas can only use ftp service now, other users are denied. ( all users are allowed by default except root)</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> Other Securities</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> <strong>anonymous_enable=YES</strong><br /> <strong>local_enable=YES</strong><br /> <strong>anon_mkdir_write_enable=YES</strong></div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> we can control ftp by using this lines, enable disable anonymous ftp ( ftpd without username and password )<br /> ——————————————————————————-</div> </div> </div> </div> </div> </div> </h1> <h5 style="color: #222222; font-family: 'PT Sans', sans-serif; font-size: 25px; line-height: 32px; margin: 25px 0px 27px; text-rendering: optimizeLegibility;"> Disable Linux FTP User Account</h5> <h1 class="entry-title" itemprop="name" style="background-color: white; color: #222222; font-family: 'Roboto Condensed', sans-serif; font-size: 34px; font-weight: normal; line-height: 40px; margin: 17px 0px 7px; text-rendering: optimizeLegibility; word-wrap: break-word;"> <div class="wpb_row row-fluid" style="color: #262626; font-family: 'PT Sans', sans-serif; font-size: 15px; line-height: 23px; width: 699.96875px;"> <div class="span12 wpb_column column_container" style="box-sizing: border-box; float: left; margin-left: 0px; min-height: 31px; position: relative; width: 699.96875px;"> <div class="wpb_wrapper"> <div class="td_block_wrap td_text_with_title" style="padding-bottom: 20px !important; position: relative;"> <div class="td_mod_wrap" style="margin-bottom: 15px;"> <div style="margin-bottom: 23px; position: relative; top: -9px;"> If you have vsftp server  add user to /etc/vsftpd/ftpusers (VSFTPD) file</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> <strong>#/etc/vsftpd/ftpusers</strong><br /> gopal<br /> shahzad</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> this will protect user gopal and shahzad to use ftp service<br /> ————————————————————————–</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> <strong>Deny uploading files to ftp share</strong></div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> deny_file={*.mp3,*.wma,*.rpm,*.private,*.text}</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> —————————————————————————</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> <strong>Allow interface IP to listen FTP request</strong></div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> listen_address=192.168.0.254 192.168.0.251<br /> —————————————————————————–</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> <span style="color: black;"><strong>Change default Port ( 20,21 ) to specific Port like 2121</strong></span><strong><u> </u></strong></div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> listen_port=2121<br /> ——————————————————————————-</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> <strong>Place the FTP Directory on its Own Partition</strong></div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> Separation of the operating system files from FTP users files may result into a better and secure system. Restricting the growth of certain file systems is possible using various techniques. For example, use /ftp partition to store all ftp home directories and mount ftp with nosuid, nodev and noexec options. A sample<strong>/etc/fstab</strong> entry:</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> /dev/sda5  /ftp          ext3    defaults,nosuid,nodev,noexec,usrquota 1 2</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> —————————————————————————</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> <strong>To lock down users to their home directories:</strong><br /> chroot_local_user=NO</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> ——————————————————————</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> You can create warning banners for all FTP users, by defining the path:</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> banner_file=/etc/vsftpd/banner</div> <div style="margin-bottom: 23px; position: relative; top: -9px;"> create your own banner</div> </div> </div> </div> </div> </div> </h1> </div>

Linux Security: OS & Service Level Security in Linux Part-1

Linux Security > OS & Service Level Security in Linux > sshd  server SSH Server security About SSH Server: ...

Read more »