Linux System Administration Recipes A Problem-Solution Approach

More documents

Recommendations

Info

CHAPTER 6 ■ SECURING YOUR SYSTEMSaddpol -minclasses 3 -maxlife 90 days -minlength 12 -history 5 adminpolicyaddpol -minclasses 2 -maxlife 180 days -minlength 8 -history 5 userpolicyTo apply this policy to an existing user, user1, use the following:modify_principal -policy userpolicy user1To use a policy when creating a user, admin1, use the following:add_principal -policy adminpolicy admin1If no policy is specified, the default policy will be used.You can also do this via various PAM modules if you’re using an /etc/passwd-based system (seeRecipe 6-9). (However, it’s a much better idea to use Kerberos! See Chapter 2.)■ Note You can also try making helpful suggestions to your users. For example, you could suggest that they usephrases instead of words (modern systems should be able to handle arbitrarily long passwords) or the initial lettersof a phrase or song lyric, with a few numbers or punctuation marks thrown in.6-9. Setting and Enforcing Password Policy withpam_cracklibIf you’re using the standard /etc/passwd and /etc/shadow login rather than Kerberos or anothercentralized system (see the preceding recipe for Kerberos password policy), you can use the PAMmodule pam_cracklib to enforce both length and complexity of passwords. This module works byapplying a set of rules, covering length and complexity, when a user changes their password.For length, it uses a single option, minlen (measured in days).For complexity, it has the options dcredit, ucredit, lcredit, and ocredit, which refer to thecharacter classes’ digit, uppercase character, lowercase character, and other character, respectively. Avalue of –1 for one of these values means “require one character of this type,” and a value of 1 means“give 1 credit for this type.” The credit system involves giving “length credits” for using nonlowercasecharacters (this means that you can have a shorter password than the minimum length if it usesnonlowercase characters as well as lowercase characters). However, this can be confusing for users (andreduces the security of the password), so it’s better and more straightforward just to require (by settingthe value to –1) certain types of character.Try adding the following line in /etc/pam.d/common-password in Debian-type distros or/etc/pam.d/system-auth in RedHat-type distros:password requisite pam_cracklib.so retry=3 minlen=10 difok=3 dcredit=-1 ucredit=-1 lcredit=-1The retry value sets a maximum of three attempts at getting an acceptable password. Users canalways rerun passwd to try again; this doesn’t lock you out after three attempts. minlen sets a tencharacterminimum length. difok=3 requires a minimum of three characters different from the last146Download at WoweBook.Com
CHAPTER 6 ■ SECURING YOUR SYSTEMSpassword. Finally, the last three options (dcredit, ucredit, and lcredit) add the requirements that thenew password should contain at least one character from each of the character classes of digit, lowercasecharacter, and uppercase character.However, this policy won’t come into effect until a user changes their password, so if their passwordnever expires, they’ll probably never change it. To make all your users change their passwords regularly,edit the /etc/login.defs file to set the PASS_MAX_DAYS variable to the maximum time allowed beforechanging a password (in days).Finally, however, the change to /etc/login.defs affects only new accounts. To affect existing users,you need to use the command chage:# chage -M 90 -W 7 jkempThis will set the maximum number of days between password changes to 90 for the user jkemp andwill warn the user for the seven days in advance before their password will expire. This needs to be doneon an individual user basis, unfortunately, rather than as a system-wide policy. You can use awk togenerate a script for this:# cat /etc/passwd | awk -F: '{print "chage -M 90 -W 7 "$1}' > maxdaysCheck over the maxdays file to edit out system users, and then run the script with bash maxdays.6-10. Checking the Password PolicyOnce you’ve set the password policy, as in the previous recipes, it’s also worth occasionally checking thatpeople really are using reasonable passwords and that the policies aren’t letting weak passwordsthrough. john-the-ripper (available via most distros) is a password-cracking tool that identifiesvulnerable passwords before someone with nefarious intentions finds the weakness.If you’re using /etc/password-based security, the first step is to extract the username/passwordinformation from the relevant files using the provided unshadow tool:unshadow /etc/passwd /etc/shadow > /tmp/password.dbunshadow will produce a password database only on systems that use /etc/passwd and /etc/shadowfor login. For centralized systems, a Kerberos5 module is available, or the supplied unafs utility extractsKerberos AFS passwords. There’s also an LDAP module.After you’ve extracted your password database, john has three cracking modes:• Dictionary mode, which tests passwords based on dictionary words. You can usethe provided dictionary or provide your own, and there’s an option to enable“word mangling” rules.• “Single crack” mode, which uses login names and various /etc/passwd values aspassword candidates, as well as applying word mangling rules.• Incremental mode, which tries all possible character combinations and willobviously take a very, very long time to run. You’ll almost certainly need to stop itmanually eventually, unless you have a very short password limit. You can changethe parameters for this via the config file.147Download at WoweBook.Com
Page 2:
Download at WoweBook.Com
Page 5 and 6:
Download at WoweBook.Comiii
Page 7 and 8:
Contents■About the Author .......
Page 9 and 10:
■ CONTENTS3-7. Writing a Nagios P
Page 11 and 12:
■ CONTENTS■Chapter 8: Using the
Page 13 and 14:
■ CONTENTSAbout the Author■Juli
Page 15 and 16:
■ CONTENTSAcknowledgmentsMany tha
Page 17 and 18:
■ CONTENTSIntroductionThis book i
Page 19 and 20:
■ INTRODUCTIONDownloading the Cod
Page 21 and 22:
C H A P T E R 1■ ■ ■Saving Yo
Page 23 and 24:
CHAPTER 1 ■ SAVING YOURSELF EFFOR
Page 25 and 26:
Page 27 and 28:
Page 29 and 30:
Page 31 and 32:
Page 33 and 34:
Page 35 and 36:
Page 37 and 38:
Page 39 and 40:
Page 41 and 42:
C H A P T E R 2■ ■ ■Centraliz
Page 43 and 44:
CHAPTER 2 ■ CENTRALIZING YOUR NET
Page 45 and 46:
Page 47 and 48:
Page 49 and 50:
Page 51 and 52:
Page 53 and 54:
Page 55 and 56:
Page 57 and 58:
Page 59 and 60:
Page 61 and 62:
Page 63 and 64:
Page 65 and 66:
Page 67 and 68:
Page 69 and 70:
Page 71 and 72:
Page 73 and 74:
Page 75 and 76:
Page 77 and 78:
Page 79 and 80:
Page 81 and 82:
Page 83 and 84:
C H A P T E R 3■ ■ ■Monitorin
Page 85 and 86:
CHAPTER 3 ■ MONITORING AND UPDATI
Page 87 and 88:
Page 89 and 90:
Page 91 and 92:
Page 93 and 94:
Page 95 and 96:
Page 97 and 98:
Page 99 and 100:
Page 101 and 102:
Page 103 and 104:
Page 105 and 106:
Page 107 and 108:
Page 109 and 110:
Page 111 and 112:
Page 113 and 114:
Page 115 and 116: C H A P T E R 4■ ■ ■Taking Ba
Page 117 and 118: CHAPTER 4 ■ TAKING BACKUPS AND MA
Page 139 and 140: C H A P T E R 5■ ■ ■Working w
Page 141 and 142: CHAPTER 5 ■ WORKING WITH FILESYST
Page 155 and 156: C H A P T E R 6■ ■ ■Securing
Page 157 and 158: CHAPTER 6 ■ SECURING YOUR SYSTEMS
Page 165: CHAPTER 6 ■ SECURING YOUR SYSTEMS
Page 179 and 180: CHAPTER 7 ■ WORKING WITH APACHEOn
Page 181 and 182: CHAPTER 7 ■ WORKING WITH APACHEdi
Page 183 and 184: CHAPTER 7 ■ WORKING WITH APACHE4.
Page 185 and 186: CHAPTER 7 ■ WORKING WITH APACHE
Page 187 and 188: CHAPTER 7 ■ WORKING WITH APACHEAl
Page 189 and 190: CHAPTER 7 ■ WORKING WITH APACHE
Page 191 and 192: C H A P T E R 8■ ■ ■Making Be
Page 193 and 194: CHAPTER 8 ■ USING THE COMMAND LIN
Page 207 and 208: CHAPTER 9 ■ WORKING WITH TEXT IN
Page 217 and 218:
CHAPTER 9 ■ WORKING WITH TEXT IN
Page 219 and 220:
Page 221 and 222:
Page 223 and 224:
C H A P T E R 10■ ■ ■Things G
Page 225 and 226:
CHAPTER 10 ■ THINGS GO IN, THINGS
Page 227 and 228:
Page 229 and 230:
Page 231 and 232:
Page 233 and 234:
C H A P T E R 11■ ■ ■Tracking
Page 235 and 236:
CHAPTER 11 ■ TRACKING DOWN BUGSTh
Page 237 and 238:
CHAPTER 11 ■ TRACKING DOWN BUGS01
Page 239 and 240:
CHAPTER 11 ■ TRACKING DOWN BUGS
Page 241 and 242:
Page 243 and 244:
Page 245 and 246:
CHAPTER 11 ■ TRACKING DOWN BUGSTh
Page 247 and 248:
CHAPTER 11 ■ TRACKING DOWN BUGSAn
Page 249 and 250:
CHAPTER 11 ■ TRACKING DOWN BUGS#
Page 251 and 252:
C H A P T E R 12■ ■ ■Managing
Page 253 and 254:
CHAPTER 12 ■ MANAGING TIME AND PE
Page 255 and 256:
Page 257 and 258:
Page 259 and 260:
Page 261 and 262:
Page 263 and 264:
Page 265 and 266:
Page 267 and 268:
APPENDIX■ ■ ■Perl TipsSee rec
Page 269 and 270:
APPENDIX ■ PERL TIPS• Date::Par
Page 271 and 272:
APPENDIX ■ PERL TIPSPerl Syntax N
Page 273 and 274:
■ ■ ■Index■Symbols$CDPATH,
Page 275 and 276:
■ INDEXenscript option (printing)
Page 277 and 278:
■ INDEX■NNagiosadding hosts to,
Page 279 and 280:
■ INDEXsyslogcentralized logging
Page 281 and 282:
Download at WoweBook.Com
show all

Linux System Administration Recipes A Problem-Solution Approach

Create successful ePaper yourself

Delete template?

Save as template?