Lab 9 – Securing Linux Systems
Materials Needed:
4) Computer
5) Internet connection
6) Root access to Linux account
Assignment:
The original checklist was written by Gene Schultz of Berkeley Lab and has been copyrighted in
2003 by the Regents of the University of California. All rights are reserved. (http://www.lbl.gov/
ICSD/Security/systems/redhat-linux-checklist_v7.html)
Baseline Security Measures
A. Securing Your System’s Accounts and Groups
1. Assign a strong root password.
%syZ12Ghy#! would be a very strong password, but do not use this particular example as your password!
The root account is the most important to protect, and the danger of it being compromised is high, given
that powerful password crackers such as John the Ripper are freely available.
To change the root password, obtain a root shell, and then enter passwd
2. Ensure direct remote root logins are disabled. /etc/securetty should list only the
console tty (tty<#>).
To find the console number, login locally and enter # tty
Local root users will be able to logon directly, but to gain root access remote
root users will have to enter
su –
3. Disable remote root logins for FTP users.The best thing for security is to not run FTP
server at all. If you must run an FTP server, limit opportunities for attackers by
locking out certain accounts frequently used by attackers. /etc/ftpusers specifies
users who are not permitted to do an FTP login. At a minimum, all default accounts
(including root) should be listed in /etc/ftpusers, such as in the following example:
#cat /etc/ftpusers
root
adm
sysop
daemon
lp
4. Prevent nonadministrative accounts from logging in.
If the console is not physically secure, you should limit who can login and what service they can use.
/etc/security/access.conf defines the users who can login using particular services. For
example, to keep everyone but root from logging in and using the console, add the following entry to this
file:
-:ALL EXCEPT root :console
