Red Hat ENTERPRISE LINUX 4 - SECURITY GUIDE Manual

Also see for ENTERPRISE LINUX 4 - DEVELOPER TOOLS GUIDE: Installation guide Installation guide Tuning guide Installation guide Manual

Contents

Chapter 4.21Workstation SecuritySecuring a Linux environment begins with the workstation. Whether locking down a personal machineor securing an enterprise system, sound security policy begins with the individual computer. After all, acomputer network is only as secure as its weakest node.4.1. Evaluating Workstation SecurityWhen evaluating the security of a Red Hat Enterprise Linux workstation, consider the following:• BIOS and Boot Loader Security — Can an unauthorized user physically access the machine andboot into single user or rescue mode without a password?• Password Security — How secure are the user account passwords on the machine?• Administrative Controls — Who has an account on the system and how much administrative controldo they have?• Available Network Services — What services are listening for requests from the network and shouldthey be running at all?• Personal Firewalls — What type of firewall, if any, is necessary?• Security Enhanced Communication Tools — Which tools should be used to communicate betweenworkstations and which should be avoided?4.2. BIOS and Boot Loader SecurityPassword protection for the BIOS (or BIOS equivalent) and the boot loader can prevent unauthorizedusers who have physical access to systems from booting using removable media or attaining rootprivileges through single user mode. But the security measures one should take to protect againstsuch attacks depends both on the sensitivity of the information the workstation holds and the locationof the machine.For instance, if a machine is used in a trade show and contains no sensitive information, than it maynot be critical to prevent such attacks. However, if an employee's laptop with private, unencryptedSSH keys for the corporate network is left unattended at that same trade show, it could lead to a majorsecurity breach with ramifications for the entire company.On the other hand, if the workstation is located in a place where only authorized or trusted peoplehave access, then securing the BIOS or the boot loader may not be necessary at all.4.2.1. BIOS PasswordsThe following are the two primary reasons for password protecting the BIOS of a computer1:1. Preventing Changes to BIOS Settings — If an intruder has access to the BIOS, they can set it toboot from a diskette or CD-ROM. This makes it possible for them to enter rescue mode or singleuser mode, which in turn allows them to start arbitrary processes on the system or copy sensitivedata.Since system BIOSes differ between manufacturers, some may not support password protection of either type, while others maysupport one type but not the other.