
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
70
|
Chapter 3: Hardening Linux and Using iptables
If nothing else, you should change the final field (default shell), in unknown or pro-
cess-specific accounts’ entries in /etc/passwd, from a real shell to /bin/false; only
accounts used by human beings should need shells.
Restricting Access to Known Users
Some FTP daemons allow anonymous login by default. If your FTP server is
intended to provide public FTP services, that’s fine, but if it isn’t, there’s no good
reason to leave anonymous FTP enabled.
The same goes for any other service running on a publicly accessible system: if that
service supports but doesn’t actually require anonymous connections, the service
should be configured to accept connections only from authenticated, valid users.
Restricting access to FTP, HTTP, and other services is described in subsequent chap-
ters.
Running Services in chrooted Filesystems
One of our most important threat models is that of the hijacked daemon: if a mali-
cious user manages to take over and effectively “become” a process on our system,
he will assume the privileges on our system that that process has. Naturally, develop-
ers are always on the alert for vulnerabilities, such as buffer overflows, that compro-
mise their applications, which is why you must keep on top of your distribution’s ...