Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

76

|

Chapter 3: Hardening Linux and Using iptables

name to that of a command sudo lets them execute, and thus run rampant on your

system.

Note also that in Example 3-14, no flags follow the command, so mick may execute

/sbin/ifconfig with whichever flags mick desires, which is, of course, fine with me,

since mick and root are one and the same person. If/when you use sudo to delegate

authority in addition to minimizing your own use of root privileges, you’ll probably

want to specify command flags.

For example, if I were root but not jeeves, (e.g., root=me, jeeves=one of my minions),

I might want this much less trustworthy jeeves to view but not change network-inter-

face settings. In that case, the last line of Example 3-16 would look like this:

jeeves ALL=(root) /sbin/ifconfig -a

This sort of granular delegation is highly recommended if you use sudo for privilege

delegation: the more unnecessary privilege you grant non-root accounts, the less sudo

is actually doing for you.

Configuring, Managing, and Monitoring Logs

This is something we should do but often fail to follow through on. You can’t check

logs that don’t exist, and you can’t learn anything from logs you don’t read. Make

sure your important services are logging at an appropriate level, know where those

logs are stored and whether/how ...