Tips on making a Linux box (more) secure

Distribution

Use a well-maintained up-to-date distribution with a good track record on releasing security fixes. RedHat certainly meets this criterion, Slackware doesn't.

Back to top

Network Services

Disable any services that you don't need your box to offer. Examples might be:

• Network News (nntp) on port 119
• POP-3 email on port 110
• Remote execution (rexec) on port 512
• Remote login (rlogin) on port 513
• Remote shell (rsh) on port 514
• Finger on port 79
• Systat/Netstat on ports 11 and 15 respectively
• Echo/discard/daytime/chargen (ports 7, 9, 13, 19)

Anything that remains (telnet, ftp, smtp, etc) should be protected using tcpwrappers, to control which machines can access them (you need some form of mail software to allow you to receive the output of things like cron jobs - however, it should generally be configured so that only the machine itself can talk to port 25).

Using IP firewalling might also be useful but it's more complex to configure.

Back to top

NFS / Samba

For NFS, only export necessary filesystems. Ensure that you have restricted the machines that can connect to them.

Samba allows you to configure which machines can access its shares. See the allow hosts and deny hosts entries in the smb.conf man page for more information.

Back to top

Root access

As few people as possible should have access to the root password. Do not work as root unless absolutely necessary - create yourself a user account instead.

Back to top

Physical Security

• Keep the machine somewhere away from general access.
• Disable booting from A: in the BIOS.
• Password protect BIOS setup mode.
• Configure lilo with password and restricted entries.

Back to top

Keep up-to-date

Read appropriate security mailing lists, depending on the distribution you use. Apply appropriate fixes.

Update the kernel as necessary to deal with things like teardrop. Generally, use the latest stable kernel, unless you absolutely need to use an unstable development kernel.

Back to top

More information

Read the Linux Security HOWTO, which covers the points in here but in much more depth.

Remember that the only totally secure computer system is one that's been switched off, disconnected from the network, encased in concrete, and been dropped in the middle of the ocean. Even then, I wouldn't guarantee it.

Back to top