Re: Hardening a Solaris system.
From: Ron Markel (Ron.markel_at_med.uu.nl)
Date: 11/15/03
- Next message: Micha³ Kurowski: "Re: patching newly installed packages"
- Previous message: dave-au: "framebuffer question"
- In reply to: Dr. David Kirkby: "Hardening a Solaris system."
- Next in thread: Dr. David Kirkby: "Re: Hardening a Solaris system."
- Reply: Dr. David Kirkby: "Re: Hardening a Solaris system."
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Date: Sat, 15 Nov 2003 00:50:50 +0100
Find a firewall that lets you convigure which http requests are passed on to
apache and checks them for soundness.
Tunix checkpoint will do that for you maby there are others.
"Dr. David Kirkby" <see_my_signature_for_my_real_address@hotmail.com>
schreef in bericht news:c99d2c79.0311140749.2e91890e@posting.google.com...
> I know files that execute with root permissions by normal users (e.g.
> su) can be a security risk. Is it necessary to have any such files, if
> only the root user logs in ?? In other words, making the sytem
> unusable to anyone but root.
>
> I'm particulary thinking about Solaris 9 on a Sun SPARCstation 20.
>
> I've set up a web server, running Apache, so are thinking about what I
> can do to reduce the chances of it being hacked. I've done several
> things.
>
> 1) Installing the bare minimum Solaris.
> 2) Have a firewall hardware only open on port 80
> 3) Turning off what services I don't need
> 4) Not installed any man pages, so someone not knowing a Solaris
> command would be stuck.
>
> etc, but I was wondering if it is okay to remove the setuid bit from
> all files ?
>
> Taking it further, could 99% of files be only executable by root?
> Hence if anyone did manage to get a normal account by hacking Apache,
> they severly limited in what they could do. I can imagine that if df,
> ps, ls, cat etc would not run, it would be hard to figure out what you
> were doing until root access was gained.
>
> I know one might argue (quite rightly) that one should not log in as
> root unless one needs to, but they only problem (as I see it anyway)
> with logging in as root is that one can potentially do more damage if
> one makes an error. By restricting the access of a system to just
> root, I suspect that would make it more secure, albiet more suseptable
> to errors by the administrator.
>
> I'm not sure how Apache works too much, so perhaps it would break if
> such measures were taken. I suspect it's not possible to remove all
> accounts except root, but is there any reason I could not remove lp
> and uucp? Any more that could be removed on a Solaris install?
>
> I suspect Apache is always going to be the weak link, but I'm
> wondering what I could do to prevent any flaw in apache being
> exploited to get root access. Or is it reasonable to assume that if
> someone has got access by a flaw in Apache, that they would have root
> access anyway?
>
> Taking this a bit further, could one remove root's ability to execute
> some files (including chmod), such that even root could not be very
> powerful? This would not be such a problem, as I have terminal access
> and could boot from CD. So the lack of certain commands would not be
> too much of a hassle, although clearly I don't want to have to boot
> from CD each time I log in.
>
> Please reply on the newsgroup - I virtually give up with email due to
> spam.
>
> Dr. David Kirkby.
- Next message: Micha³ Kurowski: "Re: patching newly installed packages"
- Previous message: dave-au: "framebuffer question"
- In reply to: Dr. David Kirkby: "Hardening a Solaris system."
- Next in thread: Dr. David Kirkby: "Re: Hardening a Solaris system."
- Reply: Dr. David Kirkby: "Re: Hardening a Solaris system."
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Relevant Pages
|
