 |
|
 |
 |
|
1/5/2004 Securing a Solaris Server - Close the Doors
|
|
find / -local -type f -perm -4000 -exec ls -ld {} \;
Some files must be left unchanged (/usr/bin/login, /usr/bin/passwd).
Other files may have their group set to the administrative group (wheel),
and have their modes changed to 4750 (/usr/sbin/ping, /usr/sbin/traceroute).
Still others may be removed. NOTE: A server should be checked for setuid files
after patches are updated, and after third-party packages (source or binary)
are installed.
The setuid files found on my system, and the action performed, is as follows:
Note 1: For these commands, it might be preferable to create another group (the privileged group), similar to the administrative group, but with more members. The members of the administrative group should also be members of this group./bin/su set administrative group /sbin/su.static set administrative group /usr/bin/at set administrative group (1) /usr/bin/atq set administrative group (1) /usr/bin/atrm set administrative group (1) /usr/bin/crontab set administrative group (1) /usr/bin/eject set administrative group /usr/bin/fdformat set administrative group /usr/bin/login leave alone /usr/bin/newgrp leave alone /usr/bin/passwd leave alone /usr/bin/pfexec set administrative group (1) /usr/bin/rcp set administrative group (1) /usr/bin/rdist set administrative group /usr/bin/rlogin set administrative group (1) /usr/bin/rsh set administrative group (1) /usr/bin/i86/ps leave alone (3) /usr/bin/i86/uptime leave alone (3) /usr/bin/i86/w leave alone (3) /usr/bin/su set administrative group /usr/bin/tip set administrative group (4) /usr/bin/yppasswd remove (2) /usr/lib/acct/accton set administrative group /usr/lib/fs/ufs/quota leave alone (4) /usr/lib/fs/ufs/ufsdump set 555 mode /usr/lib/fs/ufs/ufsrestore set 555 mode /usr/lib/pt_chmod leave alone /usr/lib/sendmail leave alone /usr/lib/utmp_update leave alone /usr/local/bin/lpq leave alone /usr/local/bin/lprm leave alone /usr/local/bin/lpr leave alone /usr/local/bin/lpstat leave alone /usr/local/bin/ssh1 leave alone /usr/local/bin/ssh-signer2 leave alone /usr/local/sbin/lpc leave alone /usr/sbin/allocate leave alone (4) /usr/sbin/deallocate leave alone (4) /usr/sbin/list_devices leave alone (4) /usr/sbin/mkdevalloc leave alone (4) /usr/sbin/mkdevmaps leave alone (4) /usr/sbin/ping set administrative group /usr/sbin/sacadm set administrative group /usr/sbin/i86/whodo leave alone (3) /usr/sbin/traceroute set administrative group
Note 2: For some reason, SUN leaves this link to /bin/passwd around, even after all the NIS packages have been removed. If NIS isn't being used, this link should be removed.
Note 3: These commands are architecture specific. The SPARC versions for a SPARCstation LX are:
/usr/bin/sparcv7/ps /usr/bin/sparcv7/uptime /usr/bin/sparcv7/w /usr/sbin/sparcv7/whodo
Note 4: For these commands, it might be preferable to place them into a privileged group (see Note 1) and change their mode to 4750, or remove them.
find / -local -type f -perm -2000 -exec ls -ld {} \;
NOTE: A server should be checked for setgid files after patches are updated,
and after third-party packages (source or binary) are installed.
The setgid files found on my system, and the action performed, is as follows:
Note 1: These commands are architecture specific. The SPARC versions for a SPARCstation LX are:/usr/bin/mail leave alone /usr/bin/mailx leave alone /usr/bin/netstat leave alone /usr/bin/passwd leave alone /usr/bin/write leave alone /usr/bin/yppasswd remove /usr/platform/i86pc/sbin/eeprom set 2550 mode (1) /usr/sbin/i86/prtconf set 2550 mode (1) /usr/sbin/i86/swap set 2550 mode (1) /usr/sbin/i86/sysdef set 2550 mode (1) /usr/sbin/wall set 2550 mode /usr/xpg4/bin/i86/ipcs set 2550 mode (1)
/usr/platform/sun4m/sbin/eeprom /usr/sbin/sparcv7/prtconf /usr/sbin/sparcv7/swap /usr/sbin/sparcv7/sysdef /usr/xpg4/bin/sparcv7/ipcs
find / -local -perm -2 \! -type l -exec ls -ld {} \;
NOTE: A server should be checked for world writable files and directories
after patches are updated, and after third-party packages (source or binary)
are installed.
The world writable files and directories found on my system, and the action performed, is as follows:
/var/sadm/install/.pkg.lock set 644 mode
/var/adm/spellhist leave alone, or remove
/var/mail leave alone on mail server;
otherwise remove
/var/preserve remove
/var/spool/pkg set 750 mode
/var/tmp set 1755 mode
/tmp set 1755 mode
/tmp/.s.PGSQL.5432 leave alone (used by DBMS)
In addition to the above files, there were many device nodes (under /dev and /devices). These are either protected by the device driver, or are not in need of protection (i.e. /dev/null).
echo '#! /bin/sh' > /etc/rc2.d/S00setmodes echo '' >> /etc/rc2.d/S00setmodes echo 'chmod 1755 /tmp' >> /etc/rc2.d/S00setmodes echo 'chmod 1755 /var/tmp' >> /etc/rc2.d/S00setmodes chmod 744 /etc/rc2.d/S00setmodes ln /etc/rc2.d/S00setmodes S02setmodes
Other people suggest that empty (mode=0, owner=root) directories be placed here. Using directories, instead of empty files, adds a minor improvement in security, but at an increase in potential confusion.
echo 'root' > /etc/cron.d/cron.allow echo '' > /usr/lib/cron/at.allow chmod 644 /etc/cron.d/cron.allow /usr/lib/cron/at.allow
If a user needs access to either the cron or at command, their login should be added to the appropriate file.
CRONLOG=YES
The reason for adding these settings is that many buffer overflow problems are related to execution of code on the stack. Although it is possible to exploit a buffer overflow with these settings, it is much more difficult.
set noexec_user_stack=1 set noexec_user_stack_log=1
set nfssrv:nfs_portmon=1
set sys:coredumpsize=0
If you have neither the ability, nor a support contract that includes crash analysis, then you should disable copying of crash dumps into /var/crash. This may be done by entering the following commands (NOTE: number may not be 71; please check first with ls /etc/rc2.d/S*savecore):
mv /etc/rc2.d/S71savecore /etc/rc2.d/_S71savecore
query-source address * port 53
One additional hazard is that special attention should be paid to any directory in which anonymous users are allowed to have write permissions. If they are also allowed read or directory permissions, your system could easilly be subverted for unlawful or unwanted data. Although you would be unlikely to face criminal charges, you could easilly find that your server is cofiscated (at least temporarily) by law enforcement agencies.
There are also places in this script where ip6_ignore_redirect is set to 0. These lines should be commented out.# Change LOTS of network parameters. This should help to secure # the system against some types of Denial Of Service attacks, and # intrusion attempts. It will also keep us from forwarding Denial # Of Service attacks to other networks. # Combat ARP DOS attacks by flushing entries faster. /usr/sbin/ndd -set /dev/arp arp_cleanup_interval 60000 /usr/sbin/ndd -set /dev/ip ip_ire_arp_interval 60000 # Combat ICMP DOS attacks by ignoring them. /usr/sbin/ndd -set /dev/ip ip_respond_to_echo_broadcast 0 /usr/sbin/ndd -set /dev/ip ip6_respond_to_echo_multicast 0 /usr/sbin/ndd -set /dev/ip ip_respond_to_timestamp_broadcast 0 /usr/sbin/ndd -set /dev/ip ip_respond_to_address_mask_broadcast 0 # Ignore redirect requests. These change routing tables. /usr/sbin/ndd -set /dev/ip ip_ignore_redirect 1 /usr/sbin/ndd -set /dev/ip ip6_ignore_redirect 1 # Don't send redirect requests. This is a router function. /usr/sbin/ndd -set /dev/ip ip_send_redirects 0 /usr/sbin/ndd -set /dev/ip ip6_send_redirects 0 # Don't respond to timestamp requests. This may break rdate # on some systems. /usr/sbin/ndd -set /dev/ip ip_respond_to_timestamp 0 # If a packet isn't for the interface it came in on, drop it. /usr/sbin/ndd -set /dev/ip ip_strict_dst_multihoming 1 /usr/sbin/ndd -set /dev/ip ip6_strict_dst_multihoming 1 # Don't forward broadcasts. /usr/sbin/ndd -set /dev/ip ip_forward_directed_broadcasts 0 # Don't forward source routed packets. /usr/sbin/ndd -set /dev/ip ip_forward_src_routed 0 /usr/sbin/ndd -set /dev/ip ip6_forward_src_routed 0 # Combat SYN flood attacks. /usr/sbin/ndd -set /dev/tcp tcp_conn_req_max_q0 8192 # Combat connection exhaustion attacks. /usr/sbin/ndd -set /dev/tcp tcp_conn_req_max_q 1024 # Don't forward reverse source routed packets. /usr/sbin/ndd -set /dev/tcp tcp_rev_src_routes 0 # Combat IP DOS attacks by decreasing the rate at which errors # are sent. /usr/sbin/ndd -set /dev/ip ip_icmp_err_interval 1000 /usr/sbin/ndd -set /dev/ip ip_icmp_err_burst 5
SUN also has a package called nddconfig that performs these functions. It is one of their BluePrint security tools. It performs most of the functions of the above, but it has been tested to work on all versions of Solaris from 2.5.1 to 8.
Also, The system accounting information may be useful in monitoring a system for intrusions. This information is used to determine changes in user behavior. As the number of systems being monitored increases, the usefulness of manual monitoring of this data decreases. This is due to the limited amount of time available to check the results.
If the monitoring is automated, the usefulness of accounting data for intrusion detection remains high with more systems. To perform this properly would require a complex database system. It would also require several months of usage, before it could put out useful information.
As an example, if a user has been using 45MB of their 1GB quota, and their usage jumps to 950MB, then there has been a change that should be checked. This change could be due to a runaway program. It could also be due to an intrusion.
To run accounting, the SUNWaccr and SUNWaccu packages must be installed. Also, the following lines should be added to the crontab for the root user.
# # The root crontab should be used to perform accounting data collection. # 0 * * * * /usr/lib/acct/ckpacct > /dev/null 2>&1 0 23 * * * /usr/lib/acct/dodisk / /usr /var /usr/local > /dev/null 2>&1 59 23 * * * /usr/lib/acct/runacct > /dev/null 2>&1
The dodisk line should list all file-systems that you want to run disk accounting on. This should include all local file-systems that are normally mounted read/write.
Quotas are a two-edged sword. Proper usage of quotas (along with user education) will tend to create a cooperative user community, which should tend to reduce the amount of time that a system administrator needs to spend on solving disk space issues. Also, if a user account is compromised, quotas can be used to limit the amount of data that an intruder can store on the system.
On the other hand, by controlling quotas too tightly, and not considering the needs of the users it's possible to create a situation where the users ignore security to find a place to put their files. In extreme cases, this could become a security problem.
In general, normal users shouldn't be writing data in the root, /usr, /usr/local or /var (exclusive of /var/tmp) file-systems. The non-root usage of these file-systems should be static, and the root usage should change slowly.
With respect to users, quotas are best used to remind users when it's time to clean up their files, and to keep runaway programs from filling an entire file-system. Currently, disk is so inexpensive that for the effort required to minimize space usage, it would have been cheaper to just buy more disk. Obviously, this philosophy has limits, but if users are often hitting their disk quotas, the system administrator might want to try to determine the root cause for the problem.
A sample /etc/nscd.conf file, which minimizes the functionality of nscd, is as follows:
logfile /var/adm/nscd.log enable-cache passwd no enable-cache group no positive-time-to-live hosts 3600 negative-time-to-live hosts 5 suggested-size hosts 211 keep-hot-count hosts 20 old-data-ok hosts no check-files hosts yes enable-cache exec_attr no enable-cache prof_attr no enable-cache user_attr no
If your system has any instability with respect to host names and/or IP addresses, it is possible to substitute the following line for all the above lines containing hosts. This may slow down host name lookups, but it should fix the name translation problem.
enable-cache hosts no
SUN also suggests that the ro (read-only) mount option be set on the /usr file-system. This has good effects, but it requires that additional work be done prior to adding patches. In particular, it requires that the file-system be remounted read-write. This can be done with the command /etc/mount -o remount,rw /usr. Unfortunately, the only way to return to read-only is to reboot the system. Since a reboot is often done after patches are installed, the inability to return to read-only should be a minor nuisance.
They also suggest that whenever possible, other file-systems be mounted with either the ro option, the nosuid option, or, even better, both options. This may be quite difficult, politically.
The ro option might be useful on an archive file-system. The nosuid should always be used on NFS mounted file-systems, and may be appropriate for file-systems containing users' home directories.
Also, the /etc/rmmount.conf file should be configured to mount file-systems with the -o nosuid flag set. This flag would be placed in the mount line for the file-system.
UMASK=026
echo '#! /bin/sh' > /etc/rc2.d/S00UMASK.sh echo '' >> /etc/rc2.d/S00UMASK.sh echo 'umask 077' >> /etc/rc2.d/S00UMASK.sh chmod 744 /etc/rc2.d/S00UMASK.sh
For a PC, the BIOS usually has a value that can be set to require a password prior to booting, or prior to entering BIOS. The procedures for this are different from system to system. Setting the BIOS to require a password prior to booting will disable auto-boot.
For a PC, the BIOS usually has a password that can be set. The procedures for this are different from system to system. NOTE: If you forget this password, you will have to reset all the BIOS parameters to factory default to reset it, which will require setting a jumper on the motherboard.
| Prev | Index | Next |
If you have any comments or suggestions, please E-mail webmaster@accs.com