Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

OS Hardening Principles

|

45

• Don’t leave any executable file needlessly set to run with superuser privileges,

i.e., with its SUID bit set (unless owned by a sufficiently nonprivileged user).

• In general, avoid using root privileges unnecessarily, and if your system has mul-

tiple administrators, delegate root’s authority via sudo.

• Configure logging and check logs regularly.

• Configure every host as its own firewall; i.e., bastion hosts should have their own

packet filters and access controls in addition to (but not instead of) the firewall’s.

• Check your work now and then with a security scanner, especially after patches

and upgrades.

• Understand and use the security features supported by your operating system

and applications, especially when they add redundancy to your security fabric.

• After hardening a bastion host, document its configuration so it may be used as

a baseline for similar systems and so you can rebuild it quickly after a system

compromise or failure.

All of these corollaries are ways of implementing and enforcing the Principle of Least

Privilege on a bastion host. We’ll spend most of the rest of this chapter discussing

each in depth with specific techniques and examples. We’ll end the chapter by dis-

cussing Bastille Linux, a handy tool with which Red Hat and