Linux System Administration Recipes A Problem-Solution Approach

More documents

Recommendations

Info

CHAPTER 6 ■ SECURING YOUR SYSTEMSOne option is to use the NOPASSWD tag. This allows a user to run a particular command without givinga password:jkempclient2 = NOPASSWD: /bin/ls, /usr/bin/tailThis would allow jkemp to use /bin/ls and /usr/bin/tail without authenticating herself, onclient2.You can also specify PASSWD later in the list to limit this further:jkempclient2 = NOPASSWD: /bin/ls, /usr/bin/tail, PASSWD:/bin/killThis would allow all three commands, but for /bin/kill, jkemp would have to reauthenticate.You can also use the Defaults section to specify that a particular user should be prompted for theroot password rather than for their own password when invoking sudo. Thus, the following would givejkemp the ability to run any command on any machine as any user via sudo, but would require that sheuse the root password to authenticate:Defaults:jkempjkemp ALL = (ALL)rootpwALLThis is usually not a great idea because one of the advantages of using sudo is that you don’t have togive out the root password or indeed set one on your system at all. However, let’s consider the case of asingle sysadmin who knows the root passwords anyway. What happens if their password gets cracked bysome evildoer? If sudo is set so that the sysadmin has to reauthenticate with their own password, thenour evildoer now has root access. If, on the other hand, the sysadmin has to reauthenticate with root’spassword, then the evildoer now has another password to break before they can get root access.This logic may also apply if there’s more than one sysadmin, assuming that they all already haveaccess to the root passwords. It doesn’t apply to anyone who wouldn’t otherwise know the rootpassword. In this case, stick with the default of using your own password to authenticate.■ Note You can also use the runas_default option to generalize this. This option sets the user that a sudocommand should be run as if it’s not specified on the command line with sudo -u altuser. By default, this isroot. Set it to something else using this:Defaults:runas_defaultDefaults:jkemp runaspwnotrootNow if jkemp types sudo command, it will default to running command as the notroot user and will challenge forthat user’s password.150Download at WoweBook.Com
CHAPTER 6 ■ SECURING YOUR SYSTEMS6-13. Stopping Brute-Force Attacks with iptablesBrute-force ssh attacks are where an attacker just repeatedly tries to log into your machine via ssh with aseries of usernames and/or passwords. They are an unfortunate fact of life if you run any machine thathas its SSH port open to the wider world.■ Note It’s worth considering whether you really need the SSH port of each machine open to the world outsideyour own network; your Kerberos and LDAP servers, for example, probably shouldn’t be, and even a web serverneedn’t be open on the SSH port, only the Apache port(s). If you need to log into these servers from home, you canget in via another machine. You could even insist that anyone wanting to log into the network from outside come invia a single gateway machine, but this may be more hassle (from a user management perspective) than it’s worthfor desktop machines. Users shouldn’t be allowed to log into your servers anyway; see recipe 6-3 for informationon the AllowUsers directive.One option for dealing with this problem is to use a solution that monitors how many connectionsare coming from a single IP address and blocks that IP address if there are too many in a set time period.The iptables limit module is good for this.First, let’s look at a basic iptables setup for a machine with IP address 192.168.100.25 on the192.168.100.0/255.255.255.0 subnet (that is, machines with IP addresses 192.168.100.*):01 iptables -A INPUT -d 127.0.0.0/255.0.0.0 -i ! lo -p tcp -j DROP02 iptables -A INPUT -d 192.168.100.25 -m state --state RELATED,ESTABLISHED -j ACCEPT03 iptables -A INPUT -i lo -j ACCEPT04 iptables -A INPUT -s 192.168.100.0/255.255.255.0 -d 192.168.100.25 -j ACCEPT05 iptables -A INPUT -d 192.168.100.25 -p tcp -m tcp --dport 22 -j LOG --log-prefix "ssh:"06 iptables -A INPUT -d 192.168.100.25 -p tcp -m tcp --dport 22 -j ACCEPT07 iptables -P INPUT DROP08 iptables -P FORWARD DROP09 iptables -P OUTPUT ACCEPTLine 01 drops anything coming in on 127.0.0.0 that isn’t using the loopback address. Line 02 acceptsany packets related to an established connection with this machine (-d x.x.x.x means that the packetdestination is x.x.x.x). Line 03 accepts anything coming in on the loopback address. Line 04unconditionally accepts any packet from the local network (192.168.100.*) that has a destination of thismachine’s IP.Lines 05 and 06 log any SSH packets coming in and then accept them.Lines 07–09 set the default policy for the INPUT and FORWARD chains to be to drop packets, so anythingthat hasn’t matched one of the previous rules will be dropped. For OUTPUT, we accept everything.OK, now let’s set up the limit module. The easiest way to do this is to create a new chain:iptables -N SSHIf you now type iptables -L, you’ll see all the chains and your new chain at the end of them. Nowlet’s set the rules for this chain:151Download at WoweBook.Com
Page 2:
Download at WoweBook.Com
Page 5 and 6:
Download at WoweBook.Comiii
Page 7 and 8:
Contents■About the Author .......
Page 9 and 10:
■ CONTENTS3-7. Writing a Nagios P
Page 11 and 12:
■ CONTENTS■Chapter 8: Using the
Page 13 and 14:
■ CONTENTSAbout the Author■Juli
Page 15 and 16:
■ CONTENTSAcknowledgmentsMany tha
Page 17 and 18:
■ CONTENTSIntroductionThis book i
Page 19 and 20:
■ INTRODUCTIONDownloading the Cod
Page 21 and 22:
C H A P T E R 1■ ■ ■Saving Yo
Page 23 and 24:
CHAPTER 1 ■ SAVING YOURSELF EFFOR
Page 25 and 26:
Page 27 and 28:
Page 29 and 30:
Page 31 and 32:
Page 33 and 34:
Page 35 and 36:
Page 37 and 38:
Page 39 and 40:
Page 41 and 42:
C H A P T E R 2■ ■ ■Centraliz
Page 43 and 44:
CHAPTER 2 ■ CENTRALIZING YOUR NET
Page 45 and 46:
Page 47 and 48:
Page 49 and 50:
Page 51 and 52:
Page 53 and 54:
Page 55 and 56:
Page 57 and 58:
Page 59 and 60:
Page 61 and 62:
Page 63 and 64:
Page 65 and 66:
Page 67 and 68:
Page 69 and 70:
Page 71 and 72:
Page 73 and 74:
Page 75 and 76:
Page 77 and 78:
Page 79 and 80:
Page 81 and 82:
Page 83 and 84:
C H A P T E R 3■ ■ ■Monitorin
Page 85 and 86:
CHAPTER 3 ■ MONITORING AND UPDATI
Page 87 and 88:
Page 89 and 90:
Page 91 and 92:
Page 93 and 94:
Page 95 and 96:
Page 97 and 98:
Page 99 and 100:
Page 101 and 102:
Page 103 and 104:
Page 105 and 106:
Page 107 and 108:
Page 109 and 110:
Page 111 and 112:
Page 113 and 114:
Page 115 and 116:
C H A P T E R 4■ ■ ■Taking Ba
Page 117 and 118:
CHAPTER 4 ■ TAKING BACKUPS AND MA
Page 119 and 120: CHAPTER 4 ■ TAKING BACKUPS AND MA
Page 139 and 140: C H A P T E R 5■ ■ ■Working w
Page 141 and 142: CHAPTER 5 ■ WORKING WITH FILESYST
Page 155 and 156: C H A P T E R 6■ ■ ■Securing
Page 157 and 158: CHAPTER 6 ■ SECURING YOUR SYSTEMS
Page 169: CHAPTER 6 ■ SECURING YOUR SYSTEMS
Page 179 and 180: CHAPTER 7 ■ WORKING WITH APACHEOn
Page 181 and 182: CHAPTER 7 ■ WORKING WITH APACHEdi
Page 183 and 184: CHAPTER 7 ■ WORKING WITH APACHE4.
Page 185 and 186: CHAPTER 7 ■ WORKING WITH APACHE
Page 187 and 188: CHAPTER 7 ■ WORKING WITH APACHEAl
Page 189 and 190: CHAPTER 7 ■ WORKING WITH APACHE
Page 191 and 192: C H A P T E R 8■ ■ ■Making Be
Page 193 and 194: CHAPTER 8 ■ USING THE COMMAND LIN
Page 207 and 208: CHAPTER 9 ■ WORKING WITH TEXT IN
Page 221 and 222:
CHAPTER 9 ■ WORKING WITH TEXT IN
Page 223 and 224:
C H A P T E R 10■ ■ ■Things G
Page 225 and 226:
CHAPTER 10 ■ THINGS GO IN, THINGS
Page 227 and 228:
Page 229 and 230:
Page 231 and 232:
Page 233 and 234:
C H A P T E R 11■ ■ ■Tracking
Page 235 and 236:
CHAPTER 11 ■ TRACKING DOWN BUGSTh
Page 237 and 238:
CHAPTER 11 ■ TRACKING DOWN BUGS01
Page 239 and 240:
CHAPTER 11 ■ TRACKING DOWN BUGS
Page 241 and 242:
Page 243 and 244:
Page 245 and 246:
CHAPTER 11 ■ TRACKING DOWN BUGSTh
Page 247 and 248:
CHAPTER 11 ■ TRACKING DOWN BUGSAn
Page 249 and 250:
CHAPTER 11 ■ TRACKING DOWN BUGS#
Page 251 and 252:
C H A P T E R 12■ ■ ■Managing
Page 253 and 254:
CHAPTER 12 ■ MANAGING TIME AND PE
Page 255 and 256:
Page 257 and 258:
Page 259 and 260:
Page 261 and 262:
Page 263 and 264:
Page 265 and 266:
Page 267 and 268:
APPENDIX■ ■ ■Perl TipsSee rec
Page 269 and 270:
APPENDIX ■ PERL TIPS• Date::Par
Page 271 and 272:
APPENDIX ■ PERL TIPSPerl Syntax N
Page 273 and 274:
■ ■ ■Index■Symbols$CDPATH,
Page 275 and 276:
■ INDEXenscript option (printing)
Page 277 and 278:
■ INDEX■NNagiosadding hosts to,
Page 279 and 280:
■ INDEXsyslogcentralized logging
Page 281 and 282:
Download at WoweBook.Com
show all

Linux System Administration Recipes A Problem-Solution Approach

Create successful ePaper yourself

Delete template?

Save as template?