________
Of all the security-related incidents that have
occurred over the years, more have involved UNIX systems than
any other type of operating system. Although UNIX releases
have generally improved in security capaiblity over the years,
UNIX is still in many respects still the most difficult operating
system to secure. Most flavors of UNIX are not very secure
out-of-the box, and factors such as UNIX's widespread use
in open computing environments compound this problem. Furthermore,
the many programs and services (e.g., sendmail, FTP, NFS,
and so on) that run in the UNIX environment traditionally
have had numerous security-related bugs, many of which have
led to root-level compromise.
Basic Principles of UNIX Security
1.
Use a current, supported operating system version. The type
of install (how much of the operating system and associated
software is loaded) should be commensurate with the intended
use of the system. Update patches regularly.
2.
After installation, configure the operating system to make
it more secure. Ensuring that ownerships and modes of system
directories and files are appropriate is a good initial step.
For example, make sure root owns all directories (e.g., /etc,
/dev, /bin, /sbin, /var, and so on) that are immediately below
/. Ensure that binaries and critical
configuration files are not world writable.
3.
Ensure that every account is password protected with a password
that is at least 8 characters long and is difficult to guess.
Change default passwords on default (preinstalled) accounts
such as sys and daemon, and disable any default accounts that
are not needed.
4.
Guard against runaway root privileges by restricting access
to the root account to as few users as possible. Have root
users first login to their own unprivileged accounts, then
go to root, rather than logging in directly to root. Ensure
that all remote root sessions are encrypted with SSH (Secure
Shell) or an equivalent program.
5.
Configure additional application software to run at the minimal
privilege required. Most do not require, and should not run
with, root privileges.
6.
Restrict network services to those that are required. Unnecessary
services should either not be installed in the first place
or disabled.
7.
Control and restrict access to all network services to those
needing access. The default configuration for access lists
should be "deny," with access granted only to those
explicitly listed.
8.
Log system events at a level commensurate with risk. At a
minimum, enable utmp and wtmp logging on all important systems.
Be sure to examine the logs regularly (daily, if possible).
9.
Install a "Tripwire" tool on all important systems
to detect if anyone has tampered with any critical system
binaries or configuration files. See http://cerias.purdue.edu/tools/.
Vulnerability
in dtspcd Needs to be Fixed in UNIX/Linux Systems
UNIX
and Linux system administrators and users—a buffer overflow
condition exists in the connection negotiation routine within
the dtspcd daemon of the Common Desktop Environment (CDE).
An attacker can exploit this vulnerability to execute arbitrary
code with up to root privileges dtspcd is a common service
that runs in most versions of UNIX. It typically listens on
port 6112/tcp. The risk that this vulnerability poses is high
because it is remotely exploitable and is fairly easy to exploit.
For more information about this vulnerability (including how
to fix it) visit:
http://www.kb.cert.org/vuls/id/172583
|
