Bastille Linux Past Present and Future Jay Beale

Bastille Linux Past, Present and Future Jay Beale Lead Developer, Bastille Linux President, JJB Security Consulting

Bastille Linux A security hardening script for Linux and Unix Red Hat 7. 3 Mandrake 8. 2 Turbo 7. 0 Su. SE 7. 2 Debian current HP-UX 11. x

Bastille Linux More operating systems: Solaris Open. BSD (SSH worm anyone? ) Free. BSD?

Sample Screen

What Does Bastille Do? 1/3 Firewall Set-UID and Permissions Audit

What Does Bastille Do? 2/3 Deactivate unncessary stuff Tighten configurations of remaining stuff

What Does Bastille Do? 3/3 Educate Users and Admins (They have guns pointed at their boots)

Why Do I Need It? Shipped defaults are not optimized for security Users need ease-of-use Programmers want convenience and Neither groks security

But Why Do I Need Security? 1/4 You're targeted by clueful hackers (even if you're not interesting) because you're one hop on the way to the real target.

But Why Do I Need Security? 2/4 You're targeted by script kiddies. . . because you have an IP address! (That got picked up as vulnerable by their vulnerability scanners. )

But Why Do I Need Security? 3/4 You're targeted by worms. . . Slightly smarter than script kiddies, but fully automated. Easy to defeat, with hardening!

But Why Do I Need Security? 4/4 Script kiddies choose your box at random to: Run their IRC bots ● Run their IRC server ● Serve as an exchange point for files, filez. . . ● Attack other machines with Do. S/DDo. S programs ● Brag about how many random machines they 0 wn. ● <your use here> ●

How Does It Work? 1/2 Minimize Points of Entry Network Daemons User-accessible programs

How Does It Work? 2/2 Prevent Privilege Escalation Set-UID programs let me turn my user nobody access into root!

But Does It Work? Bastille was written before most of the security vulnerabilities in Red Hat 6. 0 were discovered. It could stop or contain almost all of them.

Vulnerabilties Stopped -Red Hat 6. 0 BIND - remote root wu-ftpd - remote root userhelper - local root lpd + sendmail - remote root dump/restore - local root gpm - console local root

Vulnerabilties Not Stopped -RH 6. 0 nmh - local root? man - whatever user runs it

So Who's Using it? You tell me! Mandrake. Soft had it in their distribution. Red Hat has talked about integrating it. SGI sold appliances with it loaded. Guardent/foo uses it in some appliance. Estimated around 75, 000 -150, 000 people?

Capabilities 2. 0 Release Intelligence - "requires" tags ● X or Curses configuration ● Reusable config file, with consistency checking ●

Where We're Going Soon More content: this talk will demonstrate Growing to run on more platforms: Solaris first. Enterprise features

Firewall Configure a default-deny firewall for a masquerading network, or a single machine

Firewall off daemons, but also harden/remove them. Why both?

Defense in Depth Protect each service or possible vulnerability through multiple means, so that if one fails, the remaining methods keep your machine from being compromised.

File Permissions Audit Want to do something more comprehensive! Educate newbies about groups?

SUID Audit Blocking all paths to root! Real Example: User. Rooter (userhelper)

SUID Audit 1/2 mount/umount* ping traceroute dump/restore* cardctl ( * = has been vulnerable in past 3 years)

SUID Audit 2/2 at dosemu inn tools lpr/lp* r-tools* usernetctl

Account Security Protect the users' accounts Enforce good policies to prevent privilege escalation

Account Security Protect rhosts via PAM Password Aging Restrict Cron Umask Root TTY Logins

Boot Security Password protect LILO Password protect runlevel 1

Secure Inetd Deactivate Telnet Deactivate FTP. . .

Applied Minimalism Since crackers may discover an exploitable vulnerability in any service running with privilege, minimize both the number of these services and their levels of privilege.

Miscellaneous PAM Mandatory System Resource Limits prevent core dumps limit number of processes per user filesize limit 100 mb

Logging Lots of extra logging Remote Logging Host Process Accounting

Killing Daemons 1/2 apmd nfs/portmapper* samba atd pcmcia dhcp server (*? )

Killing Daemons 2/2 gpm* news server* routing daemons NIS SNMPd*

Sendmail Reduce attacker's access to Sendmail Remove recon. Commands. Run sendmail as a non-root process via inetd/xinetd

Postfix? Sendmail's security vulnerability history is rich! Why? Consider Post. Fix, by Wietse Venema, author of TCP Wrappers Modular, safer design!

DNS - BIND Secure BIND Historical note: We secured BIND before the remote root exploits were released. Philosophy: Harden it now, before the bugs are discovered!

Hardening BIND 1/2 Chroot Run as user/group dns CONTAINMENT

Hardening BIND 2/2 Restrict queries to set of hosts Restrict zone transfers to set of hosts Choose a random version string Offer to configure views in BIND 9

Hardening Apache 1/3 Deactivate Apache? Bind Apache to localhost?

Hardening Apache 2/3 Symlinks Server Side Includes CGI Scripts Indices

Hardening Apache 3/3 Removing Modules Removing handlers Restricting. htaccess overrides

FTP is Really Bad(tm)! Unauthenticated data transfer channel (file theft) Bad authentication on command channel Takeover issues (cleartext session) Try to replace it: HTTP for downloads? SFTP for password-ed user uploads?

Hardening FTP 1/2 Deactivate anonymous mode Deactivate normal user mode

Hardening FTP 2/2 Apply path filters to all filenames used Deactivate compression/tar-ing (external progs) Choose version string randomly Chroot normal users via 'guest' accounts Require RFC 822 -compliant e-mail addresses Disable all dynamic 'message file' parsing/delivery Create less useful upload area Log: transfers, commands and security violations

Speaker Bio Jay Beale is the Lead Developer of Bastille Linux and an independent security consultant/trainer. Mandrake. He's currently working on a book on Locking Down Linux for Addison Wesley. Read more of his articles on: http: //www. bastille-linux. org/jay