FedoraCore6 Hardened

kernel 2.6.18
gcc 4.1.1
glibc 2.5
gnome 2.16
kde 3.5.4
openssh 4.3
firefox 1.5.0.7
thunderbird 1.5.0.7

http://www.cisecurity.org/

http://www.cisecurity.org/bench_linux.html

Oct 2003
ISBN 0-9743727-7-3
$39
https://store.sans.org/store_item.php?item=83

Official Site: http://download.fedora.redhat.com/pub/fedora/linux/core/6/i386/iso/
Local Mirror: http://mirror.vcu.edu/pub/linux/fedora/6/i386/iso/
Bittorrent: http://torrent.fedoraproject.org/

FTP:
wget -c ftp://mirror.vcu.edu/pub/linux/fedora/6/i386/iso/FC-6-i386-disc*.iso
wget ftp://mirror.vcu.edu/pub/linux/fedora/6/i386/iso/SHA1SUM

HTTP:
wget -c http://mirror.vcu.edu/pub/linux/fedora/6/i386/iso/FC-6-i386-disc1.iso
wget -c http://mirror.vcu.edu/pub/linux/fedora/6/i386/iso/FC-6-i386-disc2.iso
wget -c http://mirror.vcu.edu/pub/linux/fedora/6/i386/iso/FC-6-i386-disc3.iso
wget -c http://mirror.vcu.edu/pub/linux/fedora/6/i386/iso/FC-6-i386-disc4.iso
wget http://mirror.vcu.edu/pub/linux/fedora/6/i386/iso/SHA1SUM

curl -C - -0 <url>

sha1sum -c SHA1SUM

http://fedora.redhat.com/
http://fedoranews.org/
http://fedorasolved.org
http://www.fedorafaq.org/
http://www.fedoraforum.org/
http://www.tldp.org/
http://fcp.homelinux.org/
http://fcp.homelinux.org/modules/wffaq/

http://www.linux-laptop.net/
http://fedoramobile.org/

http://www.redhat.com/mailman/listinfo/fedora-list 
http://www.redhat.com/mailman/listinfo/fedora-test-list

http://fedora.redhat.com/participate/communicate/

swap of at least twice physical ram.
/ of at least 200 Mb, more if you don't have a separate /home, /tmp
/boot  at least 60 Mb.
/usr at least 600 Mb, more if you don't have a separate /usr/local
/var of at least 384 Mb
possible a /usr/local partition of at least 100 Mb
possible /tmp parition
possible /home partiton

edit /etc/sysconfig/harddrive

Reference: http://support.pa.msu.edu/help/faqs/linux/harddisks.html

yum update yum

http://www.cisecurity.org/bench_linux.html

run bunzip2 cis_score_tool_linux_v1.6.4.sh.bz2
run ./cis_score_tool_linux_v1.6.4.sh

run ./cis-scan

egrep "^Negative" ./cis-most-recent-log

and my own experiments, I was able to remove the following packages without affecting normal operations:

yum update 

find / -nouser
find / -nogroup

rm -rf /var/lib/nfs

bin
daemon
lp
mail
nobody
vcsa
sshd
rpc
mailnull
smmsp
ntp 

rpcuser
apache
http
httpd
named
dns
mysql
postgress
squid

# Kickstart file automatically generated by anaconda.

install
text
cdrom
lang en_US.UTF-8
keyboard us
skipx
monitor --hsync 30-70 --vsync 50-120
network --device eth0 --bootproto static --ip 192.168.1.2 --netmask  255.255.255.0 --gateway 192.168.1.1 --nameserver 192.168.1.1 --hostname  example.host
network --device eth1 --onboot no --bootproto dhcp --hostname example.host
rootpw --iscrypted $1$blah
firewall --enabled --port=22:tcp
authconfig --enableshadow --enablemd5
selinux --enforcing
timezone --utc America/New_York
#zerombr yes
bootloader --location=mbr --driveorder=sda
# The following is the partition information you requested
# Note that any partitions you deleted are not expressed
# here so unless you clear all partitions first, this is
# not guaranteed to work
clearpart --linux
part /boot --fstype ext3 --ondisk=sda --size=200 --asprimary
part /usr/local --fstype ext3 --ondisk=sda --size=3000
part /home --fstype ext3 --ondisk=sda --size=3000
part /var --fstype ext3 --ondisk=sda --size=3000
part /usr --fstype ext3 --ondisk=sda --size=3000
part / --fstype ext3 --ondisk=sda --size=3000 --asprimary
part swap --size=512 --ondisk=sda
part /tmp --fstype ext3 --ondisk=sda --size=100 --grow 

%packages
@base
@core
cracklib-dicts
kernel-headers
nash
tzdata
-acl
-acpid
 -apmd
-aspell
-aspell-en
-authconfig
-autofs
-bluez-libs
-bluez-utils
-ccid
-coolkey
-cpuspeed
-crash
-desktop-file-utils
-dhcdbd
-dhcpv6_client
-diskdumputils
-dos2unix
-dosfstools
-dump
-finger
-firstboot-tui
-gpm
-htmlview
-irda-utils
-jwhois
-krb5-workstation
-ksh
-libevent
-libgssapi
-libnl
-lftp
-mailcap
-mgetty
-mkbootdisk
-mtools
-mtr
-NetworkManager
-nano
-netdump
-nc
-nfs-utils
-nfs-utils-lib
-nscd
-nss_db
-nss_ldap
-pam_ccreds
-pam_krb5
-pam_smb
-pcmciautils
-pcsc-lite
-perl-String-CRC32
-pinfo
-portmap
-ppp
-quota
-rdate
-rdist
-readahead
-redhat-menus
-rmt
-rp-pppoe
-rsh
-setuptool
-specspo
-stunnel
-syslinux
-system-config-network-tui
-tcsh
-telnet
-traceroute
-unix2dos
-unzip
-vconfig
-which
-wpa_supplicant
-ypbind
-yp-tools
-zip

%post
chkconfig --level 2345 atd off
chkconfig --level 2345 cups off
chkconfig --level 2345 netfs off
chkconfig --level 2345 kudzu off

irqbalance
mdmonitor
messagebus
smartd
yum-updatesd

yum list updates
yum -y update
reboot

# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/hda3             981M  116M  816M  13% /
/dev/hda2              99M   15M   79M  16% /boot
/dev/hda8             3.7G  241M  3.3G   7% /home
none                   62M     0   62M   0% /dev/shm
/dev/hda5             587M  274M  284M  50% /usr
/dev/hda6             373M  106M  248M  30% /var

http://www.bastille-unix.org/

yum install perl-Curses (for CLI)
yum install perl-Tk (for GUI)

http://www.bastille-linux.org    http://aleron.dl.sourceforge.net/sourceforge/bastille-linux/Bastille-2.1.7-1.0.noarch.rpm
Bastille-2.1.6-1.0.noarch.rpm

/usr/sbin/bastille -c

mount/umount
ping
at
usernetctl
traceroute

password aging - 180 days
restrict cron 
set default umask

disallow root login on tty's 1-6
password protect grub 
disable Ctrl-Alt-Del 
password protect single user mode

set defautl deny on tcp wrappers and xinetd
disable telnet
disable ftp
display Authorized Use message

disable gcc - root access to gcc only

limit core dumps, processes
restrict console 

additional logging

stop sendmail running in daemon mode

install tmpdir/tmp scripts

turns on and configures iptables

apmd (CIS 3.6)
atd - removed with 
autofs - removed (CIS 3.9)
gpm - removed (CIS 3.6)
irda - removed (CIS 3.6)
isdn - removed (CIS 3.6)
kudzu (CIS 3.21)
netfs (CIS 3.8)
nfs - removed (CIS 3.8)
nfslock - removed (CIS 3.9)
pcmcia - removed (CIS 3.6)
portmap - removed (CIS 3.12)
rhnsd
sendmail (CIS 3.3)

http://ciac.llnl.gov/ciac/bulletins/j-043.shtml

***************************************************************************
                           NOTICE TO USERS

This computer system is the private property of $owner, whether
individual, corporate or government.  It is for authorized use only.
Users (authorized or unauthorized) have no explicit or implicit
expectation of privacy.

Any or all uses of this system and all files on this system may be
intercepted, monitored, recorded, copied, audited, inspected, and
disclosed to your employer, to authorized site, government, and law
enforcement personnel, as well as authorized officials of government
agencies, both domestic and foreign.

By using this system, the user consents to such interception, monitoring,
recording, copying, auditing, inspection, and disclosure at the
discretion of such personnel or officials.  Unauthorized or improper use
of this system may result in civil and criminal penalties and
administrative or disciplinary action, as appropriate. By continuing to
use this system you indicate your awareness of and consent to these terms
and conditions of use. LOG OFF IMMEDIATELY if you do not agree to the
conditions stated in this warning.

****************************************************************************

mkdir /etc/banners
write your banner message in /etc/banners/prototype
Authorized Users Only.  All activity may be monitored and reported.
cd /etc/banners
/usr/bin/make -f /usr/share/doc/tcp_wrappers-7.6/Banners.Makefile

cp /etc/banners/prototype /etc/nologin.txt
chown root:root /etc/nologin.txt
chmod 644 /etc/nologin.txt

#
# hosts.allow   This file describes the names of the hosts which are
#               allowed to use the local INET services, as decided
#               by the '/usr/sbin/tcpd' server.
#

ALL: LOCAL : banners /etc/banners
sshd: ALL

#
# hosts.deny    This file describes the names of the hosts which are
#               *not* allowed to use the local INET services, as decided
#               by the '/usr/sbin/tcpd' server.
#
# The portmap line is redundant, but it is left to remind you that
# the new secure portmap uses hosts.deny and hosts.allow.  In particular
# you should know that NFS uses portmap!

ALL: ALL : spawn (/bin/echo -e `/bin/date` "\n%c attempted connection to %s and  was denied"\ | /bin/mail -s "Connection attempt to %s" root) &

Protocol 2
PermitRootLogin no
ChallengeResponseAuthentication no
X11Forwarding no
Banner /etc/issue.net
AllowUsers joeuser (others as needed)

services sshd restart

Host *
   ForwardX11 no
   Protocol 2

net.ipv4.tcp_max_syn_backlog = 4096
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1

#do not perform below if system is firewall or gateway.
net.ipv4.ip_forward = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

chown root:root /etc/sysctl.conf
chmod 0600 /etc/sysctl.conf
service network restart

id:5:initdefault

id:3:initdefault

~~:S:wait:/sbin/sulogin

##ca::ctrlaltdel:/sbin/shutdown -t3 -r now

# Run gettys in standard runlevels
1:2345:respawn:/sbin/mingetty tty1
# Disable gettys not being used
##2:2345:respawn:/sbin/mingetty tty2
##3:2345:respawn:/sbin/mingetty tty3
##4:2345:respawn:/sbin/mingetty tty4
##5:2345:respawn:/sbin/mingetty tty5
##6:2345:respawn:/sbin/mingetty tty6

console
tty1

password <clear-text password>

LABEL=/      /            ext3    defaults        1 1
LABEL=/boot  /boot        ext3    defaults        1 2
none         /dev/pts     devpts  gid=5,mode=620  0 0
none         /proc        proc    defaults        0 0
none         /dev/shm     tmpfs   defaults        0 0
LABEL=/usr   /usr         ext3    defaults        1 2
LABEL=/var   /var         ext3    defaults        1 2
LABEL=/tmp   /tmp         ext3    defaults        1 2
/dev/hda7    swap         swap    defaults        0 0
/dev/cdrom   /mnt/cdrom   udf,iso9660 noauto,owner,kudzu,ro 0 0
/dev/fd0     /mnt/floppy  auto  noauto,owner,kudzu 0 0

LABEL=/      /           ext3    defaults        1 1
LABEL=/boot  /boot       ext3    nodev           1 2
# LABEL=/boot  /boot       ext3    nodev,ro           1 2
none         /dev/pts    devpts  gid=5,mode=620  0 0
none         /proc       proc    defaults        0 0
none         /dev/shm    tmpfs   defaults        0 0
LABEL=/usr   /usr        ext3    nodev        1 2
# LABEL=/usr   /usr        ext3    nodev,ro        1 2
LABEL=/var   /var        ext3    nodev           1 2
LABEL=/tmp   /tmp        ext3    nodev,nosuid,noexec 1 2
swap        swap    defaults        0 0
/dev/cdrom   /mnt/cdrom  udf,iso9660  noauto,nosuid,nodev,ro 0 0
/dev/fd0     /mnt/floppy auto    noauto,nosuid,nodev 0  to run multiple shell sessions

mount -o remount,rw /usr

mount -o remount,ro /usr

mount -o remount,exec /tmp

mount -o remount,noexec /tmp

##<console> 0660 <floppy> 0660 root.floppy

##<console> 0600 <cdrom> 0660 root.disk
##<console> 0600 <pilot> 0660 root.uucp
##<console> 0600 <jaz> 0660 root.disk
##<console> 0600 <zip> 0660 root.disk
##<console> 0600 <ls120> 0660 root.disk

##<console> 0600 <camera> 0600 root
##<console> 0600 <memstick> 0600 root
##<console> 0600 <flash> 0600 root
##<console> 0600 <diskonkey> 0660 root.disk
##console> 0600 <rem_ide> 0660 root.disk

##<console> 0600 <rio500> 0600 root

remove /etc/cron.deny if it exists
edit /etc/cron.allow /etc/at.allow
 so that root is only authorized user
 chown root:root
 chmod 400 

chmod 400 /etc/crontab
chmod -R go-rwx /etc/cron.*

userdel uucp
userdel operator
userdel games
userdel gopher

userdel adm
userdel news
userdel ftp
userdel pcap

groupdel uucp
groupdel dip
groupdel games
groupdel gopher (may be gone because gopher account already removed)

/usr/sbin/pwck
/usr/sbin/grpck

find / -nouser -exec /bin/chown root {} \;
find / -nogroup -exec /bin/chgrp root {} \;

bin
daemon
lp
mail
nobody
vcsa
sshd
rpc
mailnull
smmsp
ntp
rpm 

Maximum Password age: 99999 days = never
Minimum Password age between changes: 0 days
Maximum warning period: 7 days before maximum password age
Minimum password length: 5 characters

Maximum Password age: 90 days
Minimum Password age between changes: 7 days
Maximum warning period: 28 days before maximum password age
Minimum password length: 6 characters

Maximum Password age: 180 days
Minimum Password age between changes: 2 days
Maximum warning period: 7 days before maximum password age
Minimum password length: 5 characters

##PASS_MAX_DAYS 99999
PASS_MAX_DAYS 90

##PASS_MIN_DAYS 0
PASS_MIN_DAYS 7

##PASS_MIN_LEN  5
PASS_MIN_LEN 6

##PASS_WARN_AGE 7
PASS_WARN_AGE 28

chage -M 90 -m 7 -W 28 <account>

awk -F: `$3 >= 500 { system ("chage -M 90 -m 7 -W 28 " $1) }' /etc/passwd

johntheripper

umask 022

umask 027

/etc/profile
/etc/csh.login

/etc/csh.cshrc

##if $status then
##      umask 022
##else
##      umask 002
##endif

umask 077

/etc/bashrc

/root/.bash_profile
/root/.bashrc
/root/.cshrc

/root/.tschrc

# logout after 15 minutes
TMOUT=900

#logout after 15 minutes
set autologout=15

#*               soft    core            0
*               soft    core            0
#*               hard    rss             10000
*               hard    core            0

* hard nproc 150

* hard fsize 102400

find <partition> \( -perm -04000 -o -perm -02000 \) -type f -xdev -print

chmod u-s <program>

chmod u+s <program>

mount/umount
ping
at
usernetctl

su - <account> applies all the environmental varibles

# Uncomment the following line to require a user to be in the "wheel" group.
auth       required     /lib/security/$ISA/pam_wheel.so use_uid

usermod -G joeuser,wheel joeuser

gpasswd -a <user> <group>

visudo

# sudoers file.
#
# This file MUST be edited with the 'visudo' command as root.
#
# See the sudoers man page for the details on how to write a sudoers file.
#

# Host alias specification

# User alias specification

# Cmnd alias specification

# Defaults specification

# User privilege specification
root    ALL=(ALL) ALL

# Uncomment to allow people in group wheel to run all commands
%wheel ALL=(ALL)       ALL

# Same thing without a password
# %wheel        ALL=(ALL)       NOPASSWD: ALL

# Samples
# %users  ALL=/sbin/mount /cdrom,/sbin/umount /cdrom
# %users  localhost=/sbin/shutdown -h now

http://support.ntp.org/bin/view/Servers/NTPPoolServers
http://www.ntp.org/
http://www.ntp.org/ntpfaq/NTP-a-faq.htm
http://www.sun.com/blueprints/0701/NTP.pdf
http://www.sun.com/blueprints/0801/NTPpt2.pdf

find: D{MTAHost} [127.0.0.1]
replace 127.0.0.1 with ip address of mail relay.

set DAEMON=no

sendmail: 127.0.0.1

yum install sysstat

http://perso.wanadoo.fr/sebastien.godard/

 #If you have a remote logging host, uncomment the lines corresponding to
 #the types of messages you want to forward to it.  Replace this string
 #loghost with the IP address of your central logging server.
 #kern.*                 @loghost
 #authpriv,auth.*        @loghost
 #mail.*                 @loghost
 # or to send everything
 #*.*                    @loghost
 ################

 # Log all kernel messages to the console.
 # Logging much else clutters up the screen.
 #kern.*                                                 /dev/console
 kern.*                                                 /dev/console

 #Send kernel messages to a separate file.  Note this will
 #include messages generated by iptables about blocked
 #network traffic.
 kern.*                                                  /var/log/kernel

 # Log anything (except mail) of level info or higher.
 # Don't log private authentication messages!
 ##*.info;mail.none;authpriv.none;cron.none              /var/log/messages
 *.info;authpriv,auth,mail,cron,kern,local7.none         /var/log/messages

 # The authpriv file has restricted access.
 ##authpriv.*                                            /var/log/secure
 # capture auth messages also
 auth,authpriv.*                                            /var/log/secure

touch /var/log/kernel
chmod 400 /var/log/kernel

# rotate log files weekly
##weekly
monthly

# keep 4 weeks worth of backlogs
#rotate 4
rotate 12

# uncomment this if you want your log files compressed
#compress
compress

/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler   /var/log/boot.log /var/log/cron /var/log/kernel {
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null ||  true
    endscript
}

/sbin/service syslog restart

/usr/sbin/logrotate -f /etc/logrotate.conf

Configuring logwatch
vi /etc/logwatch/conf/logwatch.conf
add this line:
MailTo = <address>
You will be emailed nightly.

installing logcheck (must have gcc installed)
see http://sourceforge.net/projects/sentrytools/

tar -xvzf logcheck-1.1.1.tar.gz
cd logcheck-1.1.1
make linux

vi /usr/local/etc/logcheck.sh

00 * * * * /usr/local/etc/logcheck.sh

note: this location will need to be changed if /usr is made read-only

yum install psacct
service psacct start

ac - displays statistics about how long users have been logged on
lastcomm - displays information about previous executed commands
sa - summarizes information about previously executed commmands

/usr/bin/system-config-securitylevel

# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

http://www.shorewall.net/

yum install shorewall 

/usr/share/doc/shorewall-3.0.5/Samples

SSH/ACCEPT      net             $FW

/etc/shorewall/policy

#SOURCE         DEST            POLICY          LOG LEVEL       LIMIT:BURST
$FW             net             ACCEPT
##net           all             DROP            info
net             all             DROP            warning
# The FOLLOWING POLICY MUST BE LAST
##all           all             REJECT          info
all             all             REJECT          warning

chkconfig --level 12345 iptables off

service shorewall start

service shorewall stop
service shorewall start

yum install gcc

http://www.deer-run.com/~hal/dns-sendmail/
http://www.deer-run.com/~hal/sysadmin/sendmail.html
http://www.deer-run.com/~hal/sysadmin/sendmail2.html

http://www.balabit.com/products/syslog_ng/

http://www.cs.tut.fi/~rammer/aide.html
http://sourceforge.net/projects/aide

http://www.openswan.org/

http://www.cipherdyne.com/psad/

wget http://www.cipherdyne.com/psad/download/psad-2.1-1.i386.rpm

md5sum psad-2.1-1.i386.rpm

EMAIL_ADDRESSES        root@localhost,myaddress@mail.com;
HOSTNAME               server.com;

http://www.snort.org/

useradd <account>

AllowUsers

 service sshd restart

gpasswd -a <account> wheel

mount -o remount,rw /usr

mount -o remount,ro /usr

chkconfig kudzu on
halt

service kudzu stop
chkconfig kudzu off

awk -F: '($2 == "") {print $1}' /etc/shadow 

http://www.chkrootkit.org/

O'Reilly Book: Building Secure Servers with Linux

http://www.fedorafaq.org/
http://www.fedoraforum.org/
http://fedorasolved.org/
http://www.mjmwired.net/resources/mjm-fedora-fc5.html
http://www.stanton-finley.net/fedora_core_5_installation_notes.html
http://www.stud.uni-karlsruhe.de/~usge/fc2_install_notes.html
http://fedoranews.org/colin/fnu/issue12.shtml
http://fedoranews.org/colin/fnu/issue13.shtml
http://fedoranews.org/colin/fnu/issue14.shtml
http://users.netwit.net.au/~pursang/game.html

Label	Primary Repository Location	Description
base	http://download.fedora.redhat.com/pub/fedora/linux/core/5/i386/os/Fedora/RPMS/	These are the official packages that exist at release time.
updates-released	http://download.fedora.redhat.com/pub/fedora/linux/core/updates/5/i386/	These are the official updates. The ones developed after RedHat support ended have the word legacy in the package name.
fedora-extras	http://download.fedora.redhat.com/pub/fedora/linux/extras/5/i386/	3rd party packages created by the Fedora Extras Project
livna	http://rpm.livna.org/fedora/5/i386/	3rd party packages created by the Livna Project To use read the Configuration Page

Action	Command	Example
apply all updates	yum update
apply all updates with exclusions	yum --exclude <package> update	yum --exclude kernel* update
show all packages available	yum list
install package	yum install <package name>
remove package	yum remove <package name>
get information on a package	yum info <package name>
which package provides a feature or file	yum provide <feature>
search packages contain this word	yum search <string>

FedoraCore6 Hardened

From Rivalug Wiki

Contents

This document

Disclaimer

History

Reporting errors

Fedora Core 6

Why Use Fedora Core 6?

Features

*References for Hardening

*CIS Red Hat Enterprise Linux Benchmark 1.0.5 (CIS)

*SANS Securing Linux version 2.0 (SL)

*Bastille Linux 3.0.9 (BL)

*SANS Track 506: Securing Unix/Linux Track (SU)

*Simpaticus Bare-Bones Server HOWTO

*NIST Recommended Security Controls for Federal Information Systems

Securing and Hardening Red Hat Linux Production Systems

National Security Agency Security Configuration Guides

Installation

Download

Support

*Installing a Minimum System

*Tuning IDE Harddrive performance

*FC5 Issues with Binary Video Drivers (nVidia & ATI)

*Updating with Yum

*Installing GPG Keys

*Yum Repositories

*yum.conf

*Using Yum Commands

*Hardening

*Backup original files

Installing Java

*Installing the CIS Benchmark Tool

*Evaluating the Unhardened System

*CIS Benchmark Scoring Tool

*Chkconfig List of a Minimal Install

*Process List

*Disk Usage

*Open Network Connections

*Open Files

*nessus

Making the Minimum System even smaller

*remove lingering files and accounts

kickstart file

updating with yum

*Bastille Linux Script

Installation

*Running

*What it does

*Turning off or removing unused services

*Evaluation

*CIS Benchmarking Tool

*Services

*Processes

*Reducing remote access

*Physical Access

*Banners

*TCP Wrappers

*Secure Shell

*Network Kernel Parameters

*inittab

*securetty

*grub.conf

*Evaluation

*CIS Benchmarking Tool

*Services

*Processes

*Open Files

*netstat

*nessus

*Reducing local access

*fstab

*removable media

*cron & at

*remove unused accounts

*passwords

*Setting values

*using pam

*determining quality of passwords