Red Hat ENTERPRISE LINUX 4 - SECURITY GUIDE Manual

Also see for ENTERPRISE LINUX 4 - DEVELOPER TOOLS GUIDE: Installation guide Installation guide Tuning guide Installation guide Manual

Contents

Use Kerberos Authentication45iptables -A INPUT -p ALL -s! 192.168.0.0/24 --dport 834 -j DROP iptables -A INPUT -p ALL -s!192.168.0.0/24 --dport 835 -j DROPNote>Refer to Chapter 7, Firewalls for more information about implementing firewalls withIPTables commands.5.3.5. Use Kerberos AuthenticationOne of the most glaring flaws inherent when NIS is used for authentication is that whenever a userlogs into a machine, a password hash from the /etc/shadow map is sent over the network. If anintruder gains access to an NIS domain and sniffs network traffic, usernames and password hashescan be quietly collected. With enough time, a password cracking program can guess weak passwords,and an attacker can gain access to a valid account on the network.Since Kerberos uses secret-key cryptography, no password hashes are ever sent over the network,making the system far more secure. For more about Kerberos, refer to the chapter titled Kerberos inthe Reference Guide.5.4. Securing NFSThe Network File System, or NFS, is service that provides network accessible file systems for clientmachines. For more information on how NFS works, refer to the chapter titled Network File System(NFS) in the Reference Guide. For more information about configuring NFS, refer to the SystemAdministrators Guide. The following subsections assume a basic knowledge of NFS.ImportantThe version of NFS included in Red Hat Enterprise Linux, NFSv4, no longer requiresthe portmap service as outlined in Section 5.2, “Securing Portmap”. NFS traffic nowutilizes TCP in all versions, rather than UDP, and requires it when using NFSv4. NFSv4now includes Kerberos user and group authentication, as part of the RPCSEC_GSS kernelmodule. Information on portmap is still included, since Red Hat Enterprise Linux supportsNFSv2 and NFSv3 which utilize it.5.4.1. Carefully Plan the NetworkNow that NFSv4 has the ability to pass all information encrypted using Kerberos over a network, it isimportant that the service be configured correctly if it is behind a firewall or on a segmented network.NFSv2 and NFSv3 still pass data insecurely, and concerns should be taken into consideration. Carefulnetwork design in all of these regards can help prevent security breaches.5.4.2. Beware of Syntax ErrorsThe NFS server determines which file systems to export and which hosts to export these directories tovia the /etc/exports file. Be careful not to add extraneous spaces when editing this file.For instance, the following line in the /etc/exports file shares the directory /tmp/nfs/ to the hostbob.example.com with read/write permissions.