My Fedora 15 experience

So as most of you might know by now the development team over at Fedora has release a new version of the ever popular Linux distribution; Fedora 15 code name “LoveLock”. This posting is not to get into too much details about the new version or various ways in which you can  install it or anything of the sort for that you can visit Fedora documentation wiki.

The following are major features for Fedora 15:
  • GNOME 3 including the new GNOME 3 shell
  • KDE 4.6 with the improved Plasma workspace, enhanced core applications, and greater memory efficiency.
  • XFCE 4.8 with a new panel, Thunar enhancements and more.
  • Virtualization improvements including Spice support in virt-manager and support for Xen hosts.

Those features listed above are just a few of the great improvements that the new version has to offer, but as with anything new the are some give and take. I took the leaf of faith and installed the new version the day after it was released and I must say it was not what I was expecting at all.

Since I was running Fedora 14 on my Eee PC I figured it was going to be a quick and easy upgrade, so I went over the the wiki and fellowed the below steps:

First install the new fedora 15 gpg key. You may wish to verify this package against https://fedoraproject.org/keys and the fedora ssl certificate.

rpm --import https://fedoraproject.org/static/069C8460.txt

Upgrade all packages with

yum update yum
yum clean all
yum --releasever=15 --disableplugin=presto distro-sync

Problem #1

As simple as the above upgrade looked it didn’t turn out to be so simple for me, the upgrade processes kept failing and when it finally worked and I was prompted to reboot the system would hang at the logo.

If  I hit the ESC key during boot up I would notice that the system was hanging at  “Starting SYSV: Late init script for  live image, Started SYSV: Late init script for live image”.

At this point I know it was time to signup for the mailing list and visit freenode.net #fedora in search of an answer, but since it was a new release everyone else was also asking for help so I had to wait a bit.

I tried a few things but in the ended wiping out my Fedora 14 and installing Fedora 15. At that point I got a potential fix in a reply to my mailing list cry for help, the suggestion was to:

Log into single user mode  and removed all kmod packages, then installed akmod packages through command line.

Once my new install was finish I realized quickly that Gnome 3 was not the way to go on my Eee Netbook, I quickly had the following issues:

  • Screen kept diming eventhough I chaged the power management  and other setting.
  • My wireless connection strength dropped by about 50% even though I was in the same room with the AP, prior to that Fedora 15 I had near perfect signal.
  • The entire windowing experience was too slow, and bulky looking for my Netbook, It was hard to work with two windows side by side.

Linux Basix Security Tips Part 1

A while back I hinted to the wonderful guys over at  http://www.linuxbasix.com/ that I would like to appear on the show and do a segment on Linux security, the agreed and below are some of the notes that can be used to follow alone with my segment.

Disclaimer: I am by no means a Linux security expert; I am just trying to bring some visibility to a topic that I believe all new users should think about.

Taken from the Linux basix website, our goal here is to bring together information that will make your introduction to Linux and Open Source Software more enjoyable and productive. As we go along we will be constantly updating this site with our shows and show notes. If you have any questions please post comments to the shows and blog. Feel free to let us know what you think of the show and we will do our best to make it make as much sense as possible. Once the forum is up and running it will be a source to find answers, tips and tricks to make computing more enjoyable.

The goal of my segment is not to touch on anything too advance, for that you can find several Linux hardening guide by CERT, NSA, and many more resources out there. Instead I will be focusing on giving a few tips that anyone new to Linux should keep in mind before connecting their server/workstation to the internet.

I would like to start by sharing a few sentences I found in a blog posting over at computer world;

“You see Windows was designed as a single-user, non-networked operating system. That design is still at the heart of Windows, which is why security must always be an add-on to Windows. Linux, in contrast, was built from the ground up as a multi-user, networked system. Linux, like Unix, which came before it, was constructed to work in a world with hostile users.”

Physical Security ( might seem silly but this should always be considered)

Configure the BIOS to disable booting from CDs/DVDs, external devices, and set a password to protect these settings, you can also go another step by encrypting your entire drive. Next, set a password for the GRUB bootloader.

  • Generate a password hash using the command  /usr/sbin/grub-md5-crypt.
  • Add the hash to the first line of /boot/grub/menu.lst as follows: password –md5 passwordhash

Minimum install as possible

Take a moment to think about your installation, I understand you might not know exactly what you want but don’t install everything at first. Just do the basics and as you learn more you can then install those additional application and do it properly. Also remove unnecessary packages, only keep the ones you need, and lastly remove any accounts that are not needed.

# yum list installed
# yum list packageName
# yum remove packageName

OR

# dpkg –list
# dpkg –info packageName
# apt-get remove packageName

Stay away form clear text protocols

Under no circumstances do you want to use any clear text protocol. Any of the following  protocols or programs   (telnet, rsh, rlogin, FTP, TFTP) can give out your username/password to anyone on your local network with a packet sniffer. If you are hosting a website or providing users with a login portal ensure that you are not using http, but instead https even if you have to generate your own certificate.

Identify all open ports and services

Its important to know what ports you have open and what services are associated to them this way you can decide if you would like to block or filter them with a firewall. This is also important so in the event you notice a new port open you already have a baseline to compare it too.

To do you can use a tool like  Nmap (“Network Mapper”) which is a free and open source (license) utility for network exploration or security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime.

ex nmap -A -sV 127.0.0.1

You can also use the following for identifying and turning off unwanted services:

To view all services that are turned on:
# chkconfig --list | grep '3:on'

To disable a service:

# service serviceName stop
# chkconfig serviceName off

Security software

  • Install Antivirus software, I am aware that Linux is not highly prone to viruses like your average Windows PC, but don’t for a moment think that Linux is not being successfully exploited in the wild every day. You want to ensure that you are not the “Low Hanging Fruit” in short don’t be the easy target.
  • Install/configure firewall (SELinux, IP Tables, and AppArmor) and take a moment to read how to configure it.

Keep Your Software Up to Date

  • Configure your system to update via your software repository and apply then automatically. Security updates should be applied as soon as possible.
  • Create the file apt.cron, make it executable, place it in /etc/cron.daily or /etc/cron.weekly, and ensure that it reads as follows:

#!/bin/sh
/usr/bin/apt-get update
#
Or aptitude –s safe-upgrade

Password policy

  • You want to insure that you have a proper password policy, first identify any user accounts that has an empty password and set on or remove the account.
  • Setup password aging, its important to keep rotating your password a minimum every 60 days.
  • Set up some sort of password lockout policy, if someone attempts a brute force attempt you need to at least slow them down, a standard practice is to lockout an account after 3 failed login attempts.To get password expiration information, enter:
    chage -l userName

    To see failed login attempts, enter:
    faillog

    To unlock an account after login failures, run:
    faillog -r -u userName

    Note you can use passwd command to lock and unlock accounts:
    # lock account
    passwd -l userName

    # unlock account
    passwd -u userName

    Identify empty passwords type the following command
    # awk -F: ‘($2 == “”) {print}’ /etc/shadow

Make Sure No Non-Root Accounts Have UID Set To 0

Only root account have UID 0 with full permissions to access the system. Type the following command to display all accounts with UID set to 0:

# awk -F: '($3 == "0") {print}' /etc/passwd

You should only see one line as follows:
root:x:0:0:root:/root:/bin/bash

If you see other lines, delete them or make sure other accounts are authorized by you to use UID 0.

File and file system security

SUID and SGID files on your system are a potential security risk, and should be monitored closely. Because these programs grant special privileges to the user who is executing them, it is necessary to ensure that insecure programs are not installed. A favorite trick of crackers is to exploit SUID-root programs, then leave a SUID program as a back door to get in the next time, even if the original hole is plugged.

  • Find all SUID/SGID programs on your system, and keep track of what they are, so you are aware of any changes which could indicate a potential intruder. Use the following command to find all SUID/SGID programs on your system:

root# find  / -type  f ( -perm -04000 -o -perm -02000 )

World-writable files, particularly system files, can be a security hole if a cracker gains access to your system and modifies them. Additionally, world-writable directories are dangerous, since they allow a cracker to add or delete files as he wishes. (can upload malware to a site and infect visitors)

To locate all world-writable files on your system, use the following command:

find / -xdev -type d ( -perm -0002 -a ! -perm -1000 ) -print

Secure ssh remote access

  • Disable root login via ssh, if someone is going to try and brute force your ssh server the first user name the will try will be root, so ensure that you do not allow ssh login for your root user. You can verify or edit this but changing the config file in:

vi /etc/ssh/sshd_config

Find this section in the file, containing the line with “PermitRootLogin” in it.

#LoginGraceTime 2m
#PermitRootLogin no
#StrictModes yes
#MaxAuthTries 6

Then restart your SSH service with sudo /etc/init.d/sshd restart

Noowner Files

Files not owned by any user or group can pose a security problem. Just find them with the following command which do not belong to a valid user and a valid group.

find /dir -xdev ( -nouser -o -nogroup ) -print

Keeping an eye on your logs:

You should configure logging and auditing so you can keep an eye on any type of  attacks that are launched against your system. You can manually check the following logs or use a tool like logwatch or logcheck or any number of log parsers out there. Logs of interest are :

  • /var/log/syslog
  • /var/log/faillog
  • /var/log/auth
  • /var/log/lastlog
  • /var/log/messages
  • /var/log/apahe2/access.log and error.log

When all else fail, here are some useful Scripts and tools you can use:

Lynis: Lynis is an auditing tool for Unix (specialists). It scans the system and available software, to detect security issues. Beside security related information it will also scan for general system information, installed packages and configuration mistakes.

Security audit tool,is a security tool that can be used both as a security audit as well as a part of an intrusion detection system. It consists of set of tests, library and textual/graphical front-end. Tests are sorted into groups and security levels. Administrators can run selected tests, groups or whole security levels.

The Bastille Hardening program “locks down” an operating system, proactively configuring the system for increased security and decreasing its susceptibility to compromise. Bastille can also assess a system’s current state of hardening, granularity reporting on each of the security settings with which it works.

audit2.pl (perl): This second script searches the entire file system, listing SUID, SGID, world-writable, group-writable files. It also lists trust files and their contents. Finally it lists files with weird names (e.g., containing punctuation characters), which might be danger or a sign of penetration. On a large server with 100GB disks, this can take a few hours to run.

Unix-privesc-checker is a script that runs on Unix systems (tested on Solaris 9, HPUX 11, Various Linuxes, FreeBSD 6.2).  It tries to find misconfiguration that could allow local unprivileged users to escalate privileges to other users or to access local apps (e.g. databases).

DenyHosts is a script intended to be run by Linux system administrators to help thwart SSH server attacks (also known as dictionary based attacks and brute force attacks).

OpenVAS stands for Open Vulnerability Assessment System and is a network security scanner with associated tools like a graphical user front-end. The core component is a server with a set of network vulnerability tests (NVTs) to detect security problems in remote systems and applications.

References:

http://iase.disa.mil/stigs/checklist/index.html

http://www.sans.org/score/checklists/linuxchecklist.pdf

http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf

http://georgia.ubuntuforums.org/showthread.php?t=1002167&page=2

http://boilinglinux.blogspot.com/2008/07/ubuntu-hardy-hardening.html

http://www.cyberciti.biz/tips/linux-security.html

http://www.debian.org/doc/manuals/securing-debian-howto/

http://tldp.org/HOWTO/Security-HOWTO/file-security.html

http://blogs.computerworld.com/16367/dell_back_tracks_on_linux_being_safer_than_windows

http://www.rootkit.nl/projects/lynis.html

https://fedorahosted.org/sectool/

http://www.security-database.com/toolswatch/

http://securitytube.net/Mastering-IPTables-video.aspx

http://nmap.org/

http://www.openvas.org/

http://www.bastille-unix.org/

http://denyhosts.sourceforge.net/

http://pentestmonkey.net/tools/unix-privesc-check/

http://www.boran.ch/audit

http://oreilly.com/pub/h/66

http://www.howtogeek.com/howto/linux/security-tip-disable-root-ssh-login-on-linux/

http://www.cyberciti.biz/faq/linux-log-files-location-and-how-do-i-view-logs-files/