FedoraCore5 Hardened

kernel 2.6.15
gcc 4.1
glibc 2.4
gnome 2.14
kde 3.5.1
x.org x11 
perl 5.8
openssh 4.3
firefox 1.5
thunderbird 1.5
openoffice 2.0.2
gaim 1.5
gimp 2.2.10
HelixPlayer 1.0.6

http://www.cisecurity.org/

http://www.cisecurity.org/bench_linux.html

Oct 2003
ISBN 0-9743727-7-3
$39
https://store.sans.org/store_item.php?item=83

Official Site: http://download.fedora.redhat.com/pub/fedora/linux/core/5/i386/iso/
Local Mirror: http://mirror.vcu.edu/pub/linux/fedora/5/i386/iso/
Bittorrent: http://torrent.fedoraproject.org/

FTP:
wget -c ftp://mirror.vcu.edu/pub/linux/fedora/5/i386/iso/FC-5-i386-disc*.iso
wget ftp://mirror.vcu.edu/pub/linux/fedora/5/i386/iso/SHA1SUM

HTTP:
wget -c http://mirror.vcu.edu/pub/linux/fedora/5/i386/iso/FC-5-i386-disc1.iso
wget -c http://mirror.vcu.edu/pub/linux/fedora/5/i386/iso/FC-5-i386-disc2.iso
wget -c http://mirror.vcu.edu/pub/linux/fedora/5/i386/iso/FC-5-i386-disc3.iso
wget -c http://mirror.vcu.edu/pub/linux/fedora/5/i386/iso/FC-5-i386-disc4.iso
wget http://mirror.vcu.edu/pub/linux/fedora/5/i386/iso/SHA1SUM

sha1sum -c SHA1SUM

http://fedora.redhat.com/
http://fedoranews.org/
http://www.fedorafaq.org/
http://www.fedoraforum.org/
http://www.tldp.org/
http://fcp.homelinux.org/
http://fcp.homelinux.org/modules/wffaq/

http://www.linux-laptop.net/

http://www.redhat.com/mailman/listinfo/fedora-list 
http://www.redhat.com/mailman/listinfo/fedora-test-list

http://fedora.redhat.com/participate/communicate/

swap of at least twice physical ram.
/ of at least 200 Mb, more if you don't have a separate /home, /tmp
/boot  at least 60 Mb.
/usr at least 600 Mb, more if you don't have a separate /usr/local
/var of at least 384 Mb
possible a /usr/local partition of at least 100 Mb
possible /tmp parition
possible /home partiton

edit /etc/sysconfig/harddrive

Reference: http://support.pa.msu.edu/help/faqs/linux/harddisks.html

rpm -Uvh http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/i386/yum-2.2.2-0.fc3.noarch.rpm

bunzip2 ng_scoring_tool-1.0-linux-nojvm.tar.bz2
tar -xvf ng_scoring_tool-1.0-linux-nojvm.tar 
/usr/local/jre1.5.0_10/bin/java -jar ng_scoring_tool-1.0-linux.jar -console

-------------------------------------------------------------------------------
Next Generation Scoring Tool - InstallShield Wizard

Welcome to the InstallShield Wizard for Next Generation Scoring Tool

The InstallShield Wizard will install Next Generation Scoring Tool on your
computer.
To continue, choose Next.

Next Generation Scoring Tool
The Center for internet Security
http://www.cisecurity.org

Press 1 for Next, 3 to Cancel or 5 to Redisplay [1] 1

-------------------------------------------------------------------------------
Next Generation Scoring Tool - InstallShield Wizard

Please read the following license agreement carefully.

Untitled

TERMS OF USE AGREEMENT Background.

<LICENSE FOO>

Press ENTER to read the text [Type q to quit]

WE ACKNOWLEDGE THAT WE HAVE READ THESE AGREED TERMS OF USE IN THEIR ENTIRETY,
UNDERSTAND THEM, AND WE AGREE TO BE BOUND BY THEM IN ALL RESPECTS.

Terms of Use Agreement Version 2.1 - 02/20/04

Please choose from the following options:
[ ] 1 - I accept the terms of the license agreement.
[X] 2 - I do not accept the terms of the license agreement.

To select an item enter its number, or 0 when you are finished: [0] 1

[X] 1 - I accept the terms of the license agreement.
[ ] 2 - I do not accept the terms of the license agreement.

To select an item enter its number, or 0 when you are finished: [0]

Press 1 for Next, 2 for Previous, 3 to Cancel or 5 to Redisplay [1] 1

-------------------------------------------------------------------------------
Next Generation Scoring Tool - InstallShield Wizard

Next Generation Scoring Tool Install Location

Please specify a directory or press Enter to accept the default directory.

Destination Directory [/opt/CISngtool] /usr/local/CISngtool

Press 1 for Next, 2 for Previous, 3 to Cancel or 5 to Redisplay [1]

-------------------------------------------------------------------------------
Next Generation Scoring Tool - InstallShield Wizard

Choose the installation type that best suits your needs.

[X] 1 - Typical
       The program will be installed with the suggested configuration.
       Recommended for most users.

[ ] 2 - Custom
       The program will be installed with the features you choose.
       Recommended for advanced users.

Select the number corresponding to the type of install you would like: [0]

Press 1 for Next, 2 for Previous, 3 to Cancel or 5 to Redisplay [1] 1

-------------------------------------------------------------------------------
Next Generation Scoring Tool - InstallShield Wizard

Next Generation Scoring Tool will be installed in the following location:

/usr/local/CISngtool

with the following features:

Documentation
  Users Manual
Benchmarks
  Linux Benchmarks
     Suse 9.0 Benchmark
     RedHat Benchmark

for a total size:

19.7 MB

Press 1 for Next, 2 for Previous, 3 to Cancel or 5 to Redisplay [1]

-------------------------------------------------------------------------------
Next Generation Scoring Tool - InstallShield Wizard

Installing Next Generation Scoring Tool. Please wait...

|-----------|-----------|-----------|------------|
0%         25%         50%         75%        100%
||||||||||||||||||||||||||||||||||||||||||||||||||

Creating uninstaller...

Finalizing the Vital Product Data Registry. Please wait...

-------------------------------------------------------------------------------
Next Generation Scoring Tool - InstallShield Wizard

The InstallShield Wizard has successfully installed Next Generation Scoring
Tool. Choose Finish to exit the wizard.

Press 3 to Finish or 5 to Redisplay [3]

cd /usr/local/CISngtool
/usr/local/CISngtool/ng.sh -h

[root@localhost CISngtool]# ./ng.sh --version
NG Scoring Tool 1.0 build 137

http://www.cisecurity.org/bench_linux.html

run bunzip2 cis_score_tool_linux_v1.6.4.sh.bz2
run ./cis_score_tool_linux_v1.6.4.sh

run ./cis-scan

egrep "^Negative" ./cis-most-recent-log

yum install perl-Tk   
yum install perl-Curses
http://www.bastille-unix.org/running_bastille_on.htm#top  
get Bastille-3.0.9-1.0.noarch.rpm
rpm -Uvh Bastille-3.0.9-1.0.noarch.rpm

/usr/sbin/bastille -c

# /usr/sbin/bastille --assessnobrowser

NOTE:    Using audit user interface module.
NOTE:    Bastille is scanning the system configuration...

==============================================================================
| Bastille Hardening Assessment Completed                                    |
|                                                                            |
| You can find a report in HTML format at:                                   |
|   file:///var/log/Bastille/Assessment/assessment-report.html               |
|                                                                            |
| You can find a report in text format at:                                   |
|                                                                            |
|   /var/log/Bastille/Assessment/assessment-report.txt                       |
|                                                                            |
| You can find a more machine-parseable report at:                           |
|                                                                            |
|   /var/log/Bastille/Assessment/assessment-log.txt                          |
==============================================================================    

cd /etc/Bastille
cp /path/to/bastille.CIS.conf config
bastille -b

bastille -r

mount/umount
ping
at
usernetctl
traceroute

password aging - 180 days
restrict cron 
set default umask

disallow root login on tty's 1-6
password protect grub 
disable Ctrl-Alt-Del 
password protect single user mode

set defautl deny on tcp wrappers and xinetd
disable telnet
disable ftp
display Authorized Use message

disable gcc - root access to gcc only

limit core dumps, processes
restrict console 

additional logging

stop sendmail running in daemon mode

install tmpdir/tmp scripts

turns on and configures iptables

yum update yum

yum update 

find / -nouser
find / -nogroup

rm -rf /var/lib/nfs

bin
daemon
lp
mail
nobody
vcsa
sshd
rpc
mailnull
smmsp
ntp 

rpcuser
apache
http
httpd
named
dns
mysql
postgress
squid

# Kickstart file automatically generated by anaconda.

install
text
cdrom
lang en_US.UTF-8
keyboard us
skipx
monitor --hsync 30-70 --vsync 50-120
network --device eth0 --bootproto static --ip 192.168.1.2 --netmask  255.255.255.0 --gateway 192.168.1.1 --nameserver 192.168.1.1 --hostname  example.host
network --device eth1 --onboot no --bootproto dhcp --hostname example.host
rootpw --iscrypted $1$blah
firewall --enabled --port=22:tcp
authconfig --enableshadow --enablemd5
selinux --enforcing
timezone --utc America/New_York
#zerombr yes
bootloader --location=mbr --driveorder=sda
# The following is the partition information you requested
# Note that any partitions you deleted are not expressed
# here so unless you clear all partitions first, this is
# not guaranteed to work
clearpart --linux
part /boot --fstype ext3 --ondisk=sda --size=200 --asprimary
part /usr/local --fstype ext3 --ondisk=sda --size=3000
part /home --fstype ext3 --ondisk=sda --size=3000
part /var --fstype ext3 --ondisk=sda --size=3000
part /usr --fstype ext3 --ondisk=sda --size=3000
part / --fstype ext3 --ondisk=sda --size=3000 --asprimary
part swap --size=512 --ondisk=sda
part /tmp --fstype ext3 --ondisk=sda --size=100 --grow 

%packages
@base
-acl
-aspell
-aspell-en
-authconfig
-autofs
-bind
-bluez-libs
-bluez-utils
-caching-nameserver
-cpuspeed
-crash
-desktop-file-utils
-dhcdbd
-dhcpv6_client
-diskdumputils
-dos2unix
-dosfstools
-dump
-finger
-firstboot-tui
-gpm
-htmlview
-irda-utils
-jwhois
-krb5-workstation
-ksh
-libevent
-libgssapi
-libnl
-lftp
-longrun
-mailcap
-mgetty
-mkbootdisk
-mtools
-mtr
-NetworkManager
-nano
-netdump
-nc
-nfs-utils
-nfs-utils-lib
-nscd
-nss_db
-nss_ldap
-pam_ccreds
-pam_krb5
-pam_smb
-parted
-pcmciautils
-perl-String-CRC32-1.3-3.FC5.2
-pinfo
-portmap
-ppp
-quota
-rdate
-rdist
-readahead
-redhat-menus
-rhpl
-rmt
-rp-pppoe
-rsh
-setuptool
-specspo
-stunnel
-syslinux
-system-config-network-tui
-tcsh
-telnet
-traceroute
-unix2dos
-unzip
-vconfig
-which
-wireless-tools
-wpa_supplicant
-ypbind
-yp-tools
-zip

%post

yum list updates
yum update

# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/hda3             981M  116M  816M  13% /
/dev/hda2              99M   15M   79M  16% /boot
/dev/hda8             3.7G  241M  3.3G   7% /home
none                   62M     0   62M   0% /dev/shm
/dev/hda5             587M  274M  284M  50% /usr
/dev/hda6             373M  106M  248M  30% /var

apmd (CIS 3.6)
atd - removed with 
autofs - removed (CIS 3.9)
gpm - removed (CIS 3.6)
irda - removed (CIS 3.6)
isdn - removed (CIS 3.6)
kudzu (CIS 3.21)
netfs (CIS 3.8)
nfs - removed (CIS 3.8)
nfslock - removed (CIS 3.9)
pcmcia - removed (CIS 3.6)
portmap - removed (CIS 3.12)
sendmail (CIS 3.3)

# chkconfig --level 12345 acpid off
# chkconfig --level 12345 apmd off
# chkconfig --level 12345 atd off
# chkconfig --level 12345 irqbalance off
# chkconfig --level 12345 kudzu off
# chkconfig --level 12345 mdmonitor off
# chkconfig --level 12345 messagebus off
# chkconfig --level 12345 netfs off
# chkconfig --level 12345 smartd off

http://ciac.llnl.gov/ciac/bulletins/j-043.shtml

***************************************************************************
                           NOTICE TO USERS

This computer system is the private property of $owner, whether
individual, corporate or government.  It is for authorized use only.
Users (authorized or unauthorized) have no explicit or implicit
expectation of privacy.

Any or all uses of this system and all files on this system may be
intercepted, monitored, recorded, copied, audited, inspected, and
disclosed to your employer, to authorized site, government, and law
enforcement personnel, as well as authorized officials of government
agencies, both domestic and foreign.

By using this system, the user consents to such interception, monitoring,
recording, copying, auditing, inspection, and disclosure at the
discretion of such personnel or officials.  Unauthorized or improper use
of this system may result in civil and criminal penalties and
administrative or disciplinary action, as appropriate. By continuing to
use this system you indicate your awareness of and consent to these terms
and conditions of use. LOG OFF IMMEDIATELY if you do not agree to the
conditions stated in this warning.

****************************************************************************

mkdir /etc/banners
echo "Authorized Users Only. All activity may be monitored and reported." > /etc/banners/prototype
cd /etc/banners
/usr/bin/make -f /usr/share/doc/tcp_wrappers-7.6/Banners.Makefile
ls /etc/banners
in.ftpd  in.rlogind  in.telnetd  nul  prototype

cp /etc/banners/prototype /etc/nologin.txt
chown root:root /etc/nologin.txt
chmod 644 /etc/nologin.txt

#
# hosts.allow   This file describes the names of the hosts which are
#               allowed to use the local INET services, as decided
#               by the '/usr/sbin/tcpd' server.
#

ALL: LOCAL : banners /etc/banners
sshd: ALL

#
# hosts.deny    This file describes the names of the hosts which are
#               *not* allowed to use the local INET services, as decided
#               by the '/usr/sbin/tcpd' server.
#
# The portmap line is redundant, but it is left to remind you that
# the new secure portmap uses hosts.deny and hosts.allow.  In particular
# you should know that NFS uses portmap!

ALL: ALL : spawn (/bin/echo -e `/bin/date` "\n%c attempted connection to %s and  was denied"\ | /bin/mail -s "Connection attempt to %s" root) &

Protocol 2
X11Forwarding yes 
IgnoreRhosts yes
RhostsAuthentication no
RhostsRSAAuthentication no
HostbasedAuthentication no
PermitRootLogin no
PermitEmptyPasswords no
Banner /etc/issue.net 

# for added security, restrict ssh to listed users
AllowUsers joeuser (others as needed)

services sshd restart

Host *
   Protocol 2

net.ipv4.ip_forward = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.tcp_syncookies = 1

# Following 11 lines added by CISecurity Benchmark sec 4.1
net.ipv4.tcp_max_syn_backlog = 4096
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Following 3 lines added by CISecurity Benchmark sec 4.2
#do not perform below if system is firewall or gateway.
net.ipv4.ip_forward = 0  
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

chown root:root /etc/sysctl.conf
chmod 0600 /etc/sysctl.conf
service network restart

id:5:initdefault

id:3:initdefault

~~:S:wait:/sbin/sulogin

##ca::ctrlaltdel:/sbin/shutdown -t3 -r now

# Run gettys in standard runlevels
1:2345:respawn:/sbin/mingetty tty1
# Disable gettys not being used
##2:2345:respawn:/sbin/mingetty tty2
##3:2345:respawn:/sbin/mingetty tty3
##4:2345:respawn:/sbin/mingetty tty4
##5:2345:respawn:/sbin/mingetty tty5
##6:2345:respawn:/sbin/mingetty tty6

console
tty1

password <clear-text password>

LABEL=/      /            ext3    defaults        1 1
LABEL=/boot  /boot        ext3    defaults        1 2
none         /dev/pts     devpts  gid=5,mode=620  0 0
none         /proc        proc    defaults        0 0
none         /dev/shm     tmpfs   defaults        0 0
LABEL=/usr   /usr         ext3    defaults        1 2
LABEL=/var   /var         ext3    defaults        1 2
/dev/hda7    swap         swap    defaults        0 0
/dev/cdrom   /mnt/cdrom   udf,iso9660 noauto,owner,kudzu,ro 0 0
/dev/fd0     /mnt/floppy  auto  noauto,owner,kudzu 0 0

LABEL=/      /           ext3    defaults        1 1
LABEL=/boot  /boot       ext3    nodev           1 2
none         /dev/pts    devpts  gid=5,mode=620  0 0
none         /proc       proc    defaults        0 0
none         /dev/shm    tmpfs   defaults        0 0
LABEL=/usr   /usr        ext3    ro,nodev        1 2
LABEL=/var   /var     #4:2345:respawn:/sbin/mingetty tty4
##5:2   swap        swap    defaults        0 0
/dev/cdrom   /mnt/cdrom  udf,iso9660  noauto,nosuid,nodev,ro 0 0
/dev/fd0     /mnt/floppy auto    noauto,nosuid,nodev 0  to run multiple shell sessions

mount -o remount,rw /usr

mount -o remount,ro /usr

chattr +i /etc/fstab

#<console> 0660 <floppy> 0660 root.floppy

#<console> 0600 <cdrom> 0660 root.disk
#<console> 0600 <pilot> 0660 root.uucp
#<console> 0600 <jaz> 0660 root.disk
#<console> 0600 <zip> 0660 root.disk
#<console> 0600 <ls120> 0660 root.disk

#<console> 0600 <camera> 0600 root
#<console> 0600 <memstick> 0600 root
#<console> 0600 <flash> 0600 root
#<console> 0600 <diskonkey> 0660 root.disk
#console> 0600 <rem_ide> 0660 root.disk

#<console> 0600 <rio500> 0600 root
#<console> 0600 <pmu> 0600 root
#<console> 0600 <bluetooth> 0600 root
#<console> 0600 <raw1394> 0600 root
#<console> 0600 <irda> 0600 root
#<console> 0600 <dvb> 0600 root

#<console> 0600 <dri> 0600 root

remove /etc/cron.deny and /etc/at.deny if it exists

echo root > /etc/cron.allow
echo root > /etc/at.allow 
 chown root:root /etc/cron.allow /etc/at.allow
 chmod 400 /etc/cron.allow /etc/at.allow

chmod 400 /etc/crontab
ls | grep cron | grep -v preCIS | xargs chmod -R go-rwx

# ls -al at.*
-r-------- 1 root root 5 Feb  1 12:49 at.allow
-rw------- 1 root root 1 Nov  6 09:11 at.deny-preCIS
# ls -al | grep cron
-rw-------  1 root root     298 Oct 11 08:19 anacrontab
-r--------  1 root root       5 Feb  1 12:44 cron.allow
drwx------  2 root root    4096 Jan 30 13:25 cron.d
drwx------  2 root root    4096 Jan 26 11:58 cron.daily
drwxr-xr-x  2 root root    4096 Jan 26 11:58 cron.daily-preCIS
-rw-r--r--  1 root root       0 Jan 18 07:34 cron.deny-preCIS
drwx------  2 root root    4096 Sep  8 07:49 cron.d-preCIS
drwx------  2 root root    4096 Dec 10  2005 cron.hourly
drwxr-xr-x  2 root root    4096 Dec 10  2005 cron.hourly-preCIS
drwx------  2 root root    4096 Jan 26 11:56 cron.monthly
drwxr-xr-x  2 root root    4096 Jan 26 11:56 cron.monthly-preCIS
-r--------  1 root root     255 Dec 10  2005 crontab
-rw-r--r--  1 root root     255 Dec 10  2005 crontab-preCIS
drwx------  2 root root    4096 Jan 26 11:58 cron.weekly
drwxr-xr-x  2 root root    4096 Jan 26 11:58 cron.weekly-preCIS

userdel uucp
userdel operator
userdel games
userdel gopher

userdel adm
userdel news
userdel ftp
userdel pcap

groupdel uucp
groupdel dip
groupdel games
groupdel gopher (may be gone because gopher account already removed)

/usr/sbin/pwck
/usr/sbin/grpck

find / -nouser -exec /bin/chown root {} \;
find / -nogroup -exec /bin/group root {} \;

bin
daemon
lp
mail
nobody
vcsa
sshd
rpc
mailnull
smmsp
ntp
rpm 

Maximum Password age: 99999 days = never
Minimum Password age between changes: 0 days
Maximum warning period: 7 days before maximum password age
Minimum password length: 5 characters

Maximum Password age: 90 days
Minimum Password age between changes: 7 days
Maximum warning period: 28 days before maximum password age
Minimum password length: 6 characters

Maximum Password age: 180 days
Minimum Password age between changes: 2 days
Maximum warning period: 7 days before maximum password age
Minimum password length: 5 characters

##PASS_MAX_DAYS 99999
PASS_MAX_DAYS 90

##PASS_MIN_DAYS 0
PASS_MIN_DAYS 7

##PASS_MIN_LEN  5
PASS_MIN_LEN 6

##PASS_WARN_AGE 7
PASS_WARN_AGE 28

chage -M 90 -m 7 -W 28 <account>

awk -F: `$3 >= 500 { system ("chage -M 90 -m 7 -W 28 " $1) }' /etc/passwd

johntheripper

umask 022

umask 027

/etc/profile
/etc/csh.login

/etc/csh.cshrc

##if $status then
##      umask 022
##else
##      umask 002
##endif

umask 077

/etc/bashrc

/root/.bash_profile
/root/.bashrc
/root/.cshrc

/root/.tschrc

# logout after 15 minutes
TMOUT=900

#logout after 15 minutes
set autologout=15

#*               soft    core            0
*               soft    core            0
#*               hard    rss             10000
*               hard    core            0

* hard nproc 150

* hard fsize 102400

find <partition> \( -perm -04000 -o -perm -02000 \) -type f -xdev -print

chmod u-s <program>

chmod u+s <program>

mount/umount
ping
at
usernetctl

su - <account> applies all the environmental varibles

# Uncomment the following line to require a user to be in the "wheel" group.
auth       required     /lib/security/$ISA/pam_wheel.so use_uid

usermod -G joeuser,wheel joeuser

visudo

# sudoers file.
#
# This file MUST be edited with the 'visudo' command as root.
#
# See the sudoers man page for the details on how to write a sudoers file.
#

# Host alias specification

# User alias specification

# Cmnd alias specification

# Defaults specification

# User privilege specification
root    ALL=(ALL) ALL

# Uncomment to allow people in group wheel to run all commands
%wheel ALL=(ALL)       ALL

# Same thing without a password
# %wheel        ALL=(ALL)       NOPASSWD: ALL

# Samples
# %users  ALL=/sbin/mount /cdrom,/sbin/umount /cdrom
# %users  localhost=/sbin/shutdown -h now

http://www.ntp.org/
http://www.ntp.org/ntpfaq/NTP-a-faq.htm
http://www.sun.com/blueprints/0701/NTP.pdf
http://www.sun.com/blueprints/0801/NTPpt2.pdf

find: D{MTAHost} [127.0.0.1]
replace 127.0.0.1 with ip address of mail relay.

set DAEMON=no

sendmail: 127.0.0.1

yum install sysstat

http://perso.wanadoo.fr/sebastien.godard/

#If you have a remote logging host, uncomment the lines corresponding to
#the types of messages you want to forward to it.  Replace this string
#loghost with the IP address of your central logging server.
#kern.*                 @loghost
#authpriv,auth.*        @loghost
#mail.*                 @loghost
# or to send everything
#*.*                    @loghost
################

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console
kern.*                                                 /dev/console

#Send kernel messages to a separate file.  Note this will
#include messages generated by iptables about blocked
#network traffic.
kern.*                                                  /var/log/kernel

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
##*.info;mail.none;authpriv.none;cron.none              /var/log/messages
*.info;authpriv,auth,mail,cron,kern,local7.none         /var/log/messages

# The authpriv file has restricted access.
##authpriv.*                                            /var/log/secure
# capture auth messages also
auth,authpriv.*                                            /var/log/secure

touch /var/log/kernel
chmod 400 /var/log/kernel

# rotate log files weekly
##weekly
monthly

# keep 4 weeks worth of backlogs
#rotate 4
rotate 12

# uncomment this if you want your log files compressed
#compress
compress

/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler   /var/log/boot.log /var/log/cron /var/log/kernel {
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null ||  true
    endscript
}

/sbin/service syslog restart

/usr/sbin/logrotate -f /etc/logrotate.conf

Configuring logwatch
vi /etc/logwatch/conf/logwatch.conf
add this line:
MailTo = <address>
You will be emailed nightly.

installing logcheck (must have gcc installed)
see http://sourceforge.net/projects/sentrytools/

tar -xvzf logcheck-1.1.1.tar.gz
cd logcheck-1.1.1
make linux

vi /usr/local/etc/logcheck.sh

00 * * * * /usr/local/etc/logcheck.sh

note: this location will need to be changed if /usr is made read-only

yum install psacct
service psacct start

ac - displays statistics about how long users have been logged on
lastcomm - displays information about previous executed commands
sa - summarizes information about previously executed commmands

/usr/bin/system-config-securitylevel

# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

http://www.shorewall.net/

yum install shorewall 

/usr/share/doc/shorewall-3.0.5/Samples

SSH/ACCEPT      net             $FW

/etc/shorewall/policy

#SOURCE         DEST            POLICY          LOG LEVEL       LIMIT:BURST
$FW             net             ACCEPT
##net           all             DROP            info
net             all             DROP            warning
# The FOLLOWING POLICY MUST BE LAST
##all           all             REJECT          info
all             all             REJECT          warning

chkconfig --level 12345 iptables off

service shorewall start

service shorewall stop
service shorewall start

   * Go to Java SE Downloads - Previous Release - JDK 5 http://java.sun.com/javase/downloads/index_jdk5.jsp
   * Find Java Runtime Environment (JRE) 5.0 Update 10, press Download
   * Select Accept License Agreement
   * Select Linux self-extracting file jre-1_5_0_10-linux-i586.bin 16.28 Mb 

yum install gcc

http://www.deer-run.com/~hal/dns-sendmail/
http://www.deer-run.com/~hal/sysadmin/sendmail.html
http://www.deer-run.com/~hal/sysadmin/sendmail2.html

http://www.balabit.com/products/syslog_ng/

http://www.cs.tut.fi/~rammer/aide.html
http://sourceforge.net/projects/aide

http://www.openswan.org/

http://www.cipherdyne.com/psad/

http://www.snort.org/

http://www.sdc.org/~leila/usb-dongle/readme.html

http://www.redhatmagazine.com/2007/01/18/disk-encryption-in-fedora-past-present-and-future/

useradd <account>

AllowUsers

 service sshd restart

gpasswd -a <account> wheel

mount -o remount,rw /usr

mount -o remount,ro /usr

chkconfig kudzu on
halt

service kudzu stop
chkconfig kudzu off

awk -F: '($2 == "") {print $1}' /etc/shadow 

http://www.chkrootkit.org/

O'Reilly Book: Building Secure Servers with Linux

http://www.fedorafaq.org/
http://www.fedoraforum.org/
http://fedorasolved.org/
http://www.mjmwired.net/resources/mjm-fedora-fc5.html
http://www.stanton-finley.net/fedora_core_5_installation_notes.html
http://www.stud.uni-karlsruhe.de/~usge/fc2_install_notes.html
http://fedoranews.org/colin/fnu/issue12.shtml
http://fedoranews.org/colin/fnu/issue13.shtml
http://fedoranews.org/colin/fnu/issue14.shtml
http://users.netwit.net.au/~pursang/game.html

Label	Primary Repository Location	Description
base	http://download.fedora.redhat.com/pub/fedora/linux/core/5/i386/os/Fedora/RPMS/	These are the official packages that exist at release time.
updates-released	http://download.fedora.redhat.com/pub/fedora/linux/core/updates/5/i386/	These are the official updates. The ones developed after RedHat support ended have the word legacy in the package name.
fedora-extras	http://download.fedora.redhat.com/pub/fedora/linux/extras/5/i386/	3rd party packages created by the Fedora Extras Project
livna	http://rpm.livna.org/fedora/5/i386/	3rd party packages created by the Livna Project To use read the Configuration Page

Action	Command	Example
apply all updates	yum update
apply all updates with exclusions	yum --exclude <package> update	yum --exclude kernel* update
show all packages available	yum list
install package	yum install <package name>
remove package	yum remove <package name>
get information on a package	yum info <package name>
which package provides a feature or file	yum provide <feature>
search packages contain this word	yum search <string>

FedoraCore5 Hardened

From Rivalug Wiki

Contents

This document

Disclaimer

History

Reporting errors

Fedora Core 5

Why Use Fedora Core 5?

Features

References for Hardening

CIS Red Hat Enterprise Linux Benchmark 1.0.5 (CIS)

SANS Securing Linux version 2.0 (SL)

Bastille Linux 3.0.9 (BL)

SANS Track 506: Securing Unix/Linux Track (SU)

Simpaticus Bare-Bones Server HOWTO

NIST Recommended Security Controls for Federal Information Systems

Installation

Download

Support

Installing a Minimum System

Tuning IDE Harddrive performance

FC5 Issues with Binary Video Drivers (nVidia & ATI)

Updating with Yum

Installing GPG Keys

Yum Repositories

yum.conf

Using Yum Commands

Hardening

Backup original files

Installing the CIS Benchmark Tool

Installing Java

Bastille Linux Script

Installation

Running

Assessment mode

using cis configuration

revert

What it does

Evaluating the Unhardened System

CIS Benchmark Scoring Tool

Chkconfig List of a Minimal Install

Process List

Disk Usage

Open Network Connections

Open Files

nessus

Bastille Assessment

Making the Minimum System even smaller

remove lingering files and accounts

kickstart file

updating with yum

Turning off or removing unused services

Evaluation

CIS Benchmark Scoring Tool

Chkconfig List of a Minimal Install

Process List

Disk Usage

Open Network Connections

Open Files

nessus

Bastille Assessment

Reducing remote access

Physical Access

Banners

TCP Wrappers

Secure Shell

Network Kernel Parameters

inittab

securetty

grub.conf

Evaluation

CIS Benchmark Scoring Tool

Chkconfig List of a Minimal Install

Process List

Disk Usage

Open Network Connections

Open Files

nessus

Bastille Assessment