Red Hat ENTERPRISE LINUX 4 - SECURITY GUIDE Manual

Also see for ENTERPRISE LINUX 4 - DEVELOPER TOOLS GUIDE: Installation guide Installation guide Tuning guide Installation guide Manual

Contents

Chapter 5.39Server SecurityWhen a system is used as a server on a public network, it becomes a target for attacks. For thisreason, hardening the system and locking down services is of paramount importance for the systemadministrator.Before delving into specific issues, review the following general tips for enhancing server security:• Keep all services current, to protect against the latest threats.• Use secure protocols whenever possible.• Serve only one type of network service per machine whenever possible.• Monitor all servers carefully for suspicious activity.5.1. Securing Services With TCP Wrappers and xinetdTCP wrappers provide access control to a variety of services. Most modern network services, such asSSH, Telnet, and FTP, make use of TCP wrappers, which stand guard between an incoming requestand the requested service.The benefits offered by TCP wrappers are enhanced when used in conjunction with xinetd, a superservice that provides additional access, logging, binding, redirection, and resource utilization control.Note>It is a good idea to use IPTables firewall rules in conjunction with TCP wrappers andxinetd to create redundancy within service access controls. Refer to Chapter 7,Firewalls for more information about implementing firewalls with IPTables commands.More information on configuring TCP wrappers and xinetd can be found in the chapter titled TCPWrappers and xinetd in the Reference Guide.The following subsections assume a basic knowledge of each topic and focus on specific securityoptions.5.1.1. Enhancing Security With TCP WrappersTCP wrappers are capable of much more than denying access to services. This section illustrateshow it can be used to send connection banners, warn of attacks from particular hosts, and enhancelogging functionality. For a thorough list of TCP wrapper functionality and control language, refer to thehosts_options man page.5.1.1.1. TCP Wrappers and Connection BannersSending a client an intimidating banner when they connect to a service is a good way to disguisewhat system the server is running while letting a potential attacker know that system administrator isvigilant. To implement a TCP wrappers banner for a service, use the banner option.This example implements a banner for vsftpd. To begin, create a banner file. It can be anywhereon the system, but it must bear same name as the daemon. For this example, the file is called /etc/banners/vsftpd.