checklist for SysAdmins<\/p>\n\n\n\n
This article includes a collection of commands and best practices that you can use to improve the security of your Linux servers (RHEL\/CentOS)<\/p>\n\n\n\n
When choosing data communication tools, use only the secure and encrypted tools and remove the rest of the tools from the server.<\/p>\n\n\n\n
$ yum erase xinetd ypserv tftp-server telnet-server rsh-server<\/pre>\n\n\n\n2. Enable firewall\/Iptables<\/h3>\n\n\n\n
Iptables allows you to configure the IP packet filter rules of the Linux kernel firewall. To get the maximum advantage, you may need some advanced knowledge on setting up these rules. The following are few examples that you can try.<\/p>\n\n\n\n
$ service iptables start\/\/ Force SYN packets check
$ iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP\/\/ Drop XMAS packets
$ iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP\/\/ Drop null packets
$ iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP\/\/ Drop incoming packets with fragments
$ iptables -A INPUT -f -j DROP<\/pre>\n\n\n\n3. Disable unwanted services and daemons<\/h3>\n\n\n\n
You may not need services like AutoFS, NFS, FTP, HTTP, NIS, telnetd, sendmail most of the time. You can remove\/disable them.<\/p>\n\n\n\n
$ chkconfig \u2013list | grep \u20183:on\u2019
$ service serviceName stop
$ chkconfig serviceName off$ yum remove packageName<\/pre>\n\n\n\n4. Audit installed packages and remove unwanted ones regularly<\/h3>\n\n\n\n
A smaller number of packages always results in a smaller security threat surface, which means fewer potential threats at the end of the day. Therefore, keep only the necessary packages and clean up the rest.<\/p>\n\n\n\n
$ yum list installed
$ yum list packageName
$ yum remove packageName<\/pre>\n\n\n\n5. Audit listening network ports and block unwanted ones regularly<\/h3>\n\n\n\n
From time to time, you might open ports for different services and leave them out later. This is very risky, so you must always be conscious of your open ports at any given time and make sure that unwanted ones are blocked.<\/p>\n\n\n\n
\/\/ List open ports of own server
$ netstat -tulpn
$ ss -tulpn\/\/ List open ports of any server in network
$ nmap -sT -O localhost
$ nmap -sT -O server.example.com\/\/ Use chkconfig to disable corresponding services
$ chkconfig \u2013list | grep \u20183:on\u2019
$ service serviceName stop
$ chkconfig serviceName off<\/pre>\n\n\n\n6. Audit user accounts and disable the unwanted ones regularly<\/h3>\n\n\n\n
Only add the minimum number of user accounts needed and disable the rest.<\/p>\n\n\n\n
\/\/ Lock password (add ! in the second field of the file \/etc\/passwd, password authentication will fail because of this, but other authentication methods like SSH keys will still work)
$ usermod -L userName
$ passwd -l userName\/\/ Unlock password (i.e. revert the effect of above command)
$ passwd -u userName\/\/ Expire account
$ chage -E0 userName\/\/ Change default shell to non-interactive, so user won't get any login shell
$ usermod -s \/sbin\/nologin userName\/\/ Verify locked user account (*LK* flag in the output indicates that the account is locked)
$ passwd --status userName
userName *LK*<\/strong> 2021-04-05 0 45 7 -1 (Password set, SHA512 crypt.)\/\/ Verify password and account expiration
$ chage -l userName
Last password change: Jan 19, 2021
Password expires: Jan 02, 2022
Password inactive: never
Account expires: Jan 02, 2022
Minimum number of days between password change: 0
Maximum number of days between password change: 45
Number of days of warning before password expires: 7\/\/ Verify non-interactive shell
$ grep ^userName \/etc\/passwd
userName:x:1000:1000:,,,:\/home\/userName:\/sbin\/nologin<\/pre>\n\n\n\n7. Enable SELinux<\/h3>\n\n\n\n
Security-enhanced Linux (SELinux) is provided by the kernel as an access control security mechanism.<\/p>\n\n\n\n
\/\/ View current status
$ sestatus
$ system-config-selinux
$ getenforce\/\/ Enable SELinux (using command)
$ setenforce enforcing
$ setenforce 1\/\/ Enable SELinux (by editing config file)
$ vi \/etc\/selinux\/config<\/pre>\n\n\n\n8. Turn off IPv6<\/h3>\n\n\n\n
Unless you use IPv6 for a specific reason, you can disable it.<\/p>\n\n\n\n
$ vi \/etc\/sysconfig\/networkNETWORKING_IPV6=no
IPV6INIT=no<\/pre>\n\n\n\n9. Make \/boot directory a read-only<\/h3>\n\n\n\n