Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

70

|

Chapter 3: Hardening Linux and Using iptables

If nothing else, you should change the final field (default shell), in unknown or pro-

cess-specific accounts’ entries in /etc/passwd, from a real shell to /bin/false; only

accounts used by human beings should need shells.

Restricting Access to Known Users

Some FTP daemons allow anonymous login by default. If your FTP server is

intended to provide public FTP services, that’s fine, but if it isn’t, there’s no good

reason to leave anonymous FTP enabled.

The same goes for any other service running on a publicly accessible system: if that

service supports but doesn’t actually require anonymous connections, the service

should be configured to accept connections only from authenticated, valid users.

Restricting access to FTP, HTTP, and other services is described in subsequent chap-

ters.

Running Services in chrooted Filesystems

One of our most important threat models is that of the hijacked daemon: if a mali-

cious user manages to take over and effectively “become” a process on our system,

he will assume the privileges on our system that that process has. Naturally, develop-

ers are always on the alert for vulnerabilities, such as buffer overflows, that compro-

mise their applications, which is why you must keep on top of your distribution’s ...