Securing Debian Configuration checklist

• 
  Limit physical access and booting capabilities
  
  
  
  • 
    Enable BIOS password
    
  
  
  • 
    Disable floppy booting
    
  
  
  • 
    Set a LILO or GRUB password (/etc/lilo.conf or
    /boot/grub/menu.lst, respectively); check that the LILO or GRUB
    configuration file is read-protected.
    
  
  
  • 
    Disallow MBR floppy booting back door by overwriting the MBR (maybe not?)
    
  
  
  
  


• 
  Partitioning
  
  
  
  • 
    Separate user-writable data, non-system data, and rapidly changing run-time
    data to their own partitions
    
  
  
  • 
    Set nosuid,noexec,nodev mount options in /etc/fstab
    on ext2 partitions such as /tmp
    
  
  
  
  


• 
  Password hygiene and login security
  
  
  
  • 
    Set a good root password
    
  
  
  • 
    Enable password shadowing and MD5
    
  
  
  • 
    Install and use PAM
    
    
    
    • 
      Add MD5 support to PAM and make sure that (generally speaking) entries in
      /etc/pam.d/ files which grant access to the machine have the
      second field in the pam.d file set to "requisite" or
      "required".
      
    
    
    • 
      Tweak /etc/pam.d/login so as to only permit local root logins.
      
    
    
    • 
      Also mark authorized tty:s in /etc/security/access.conf and
      generally set up this file to limit root logins as much as possible.
      
    
    
    • 
      Add pam_limits.so if you want to set per-user limits
      
    
    
    • 
      Tweak /etc/pam.d/passwd: set minimum length of passwords higher (6
      characters maybe) and enable md5
      
    
    
    • 
      Add group wheel to /etc/group if desired; add pam_wheel.so
      group=wheel entry to /etc/pam.d/su
      
    
    
    • 
      For custom per-user controls, use pam_listfile.so entries where appropriate
      
    
    
    • 
      Have an /etc/pam.d/other file and set it up with tight security
      
    
    
    
    
  
  
  • 
    Set up limits in /etc/security/limits.conf (note that
    /etc/limits is not used if you are using PAM)
    
  
  
  • 
    Tighten up /etc/login.defs; also, if you enabled MD5 and/or PAM,
    make sure you make the corresponding changes here, too
    
  
  
  • 
    Disable root ftp access in /etc/ftpusers
    
  
  
  • 
    Disable network root login; use su(1) or sudo(1).
    (consider installing sudo)
    
  
  
  • 
    Use PAM to enforce additional constraints on logins?
    
  
  
  
  


• 
  Other local security issues
  
  
  
  • 
    Kernel tweaks
    
  
  
  • 
    Kernel patches
    
  
  
  • 
    Tighten up logfile permissions (/var/log/{last,fail}log, Apache
    logs)
    
  
  
  • 
    Verify that setuid checking is enabled in /etc/checksecurity.conf
    
  
  
  • 
    Consider making some log files append-only and configuration files immutable
    using chattr (ext2 filesystems only)
    
  
  
  • 
    Set up file integrity . Install debsums
    
  
  
  • 
    Consider replacing locate with slocate
    
  
  
  • 
    Log everything to a local printer?
    
  
  

  
  

  • 
    Burn your configuration on a bootable CD and boot off that?
    
  
  
  • 
    Disable kernel modules?
    
  
  
  
  


• 
  Limit network access
  
  
  
  • 
    Install and configure ssh (suggest PermitRootLogin No in
    /etc/ssh, PermitEmptyPasswords No; note other suggestions in text
    also)
    
  
  
  • 
    Consider disabling or removing in.telnetd
    
  
  
  • 
    Generally, disable gratuitous services in /etc/inetd.conf using
    update-inetd --disable (or disable inetd altogether, or use a
    replacement such as xinetd or rlinetd)
    
  
  
  • 
    Disable other gratuitous network services; mail, ftp, DNS, www etc should not
    be running if you do not need them and monitor them regularly.
    
  
  
  • 
    For those services which you do need, do not just use the most common programs,
    look for more secure versions shipped with Debian (or from other sources).
    Whatever you end up running, make sure you understand the risks.
    
  
  
  • 
    Set up chroot jails for outside users and daemons.
    
  
  
  • 
    Configure firewall and tcpwrappers (i.e. hosts_access(5)); note
    trick for /etc/hosts.deny in text
    
  
  
  • 
    If you run ftp, set up your ftpd server to always run chrooted to the user's
    home directory
    
  
  
  • 
    If you run X, disable xhost authentication and go with ssh instead; better yet,
    disable remote X if you can (add -nolisten tcp to the X command line and turn
    off XDMCP in /etc/X11/xdm/xdm-config by setting the requestPort to
    0)
    
  
  
  • 
    Disable outside access to printers
    
  
  
  • 
    Tunnel any IMAP or POP sessions through SSL or ssh; install stunnel if you want
    to provide this service to remote mail users
    
  
  
  • 
    Set up a loghost and configure other machines to send logs to this host
    (/etc/syslog.conf)
    
  
  
  • 
    Secure BIND, Sendmail, and other complex daemons (run in a chroot jail; run as
    a non-root pseudo-user)
    
  
  
  • 
    Install snort or a similar logging tool.
    
  
  
  • 
    Do without NIS and RPC if you can (disable portmap).
    
  
  
  
  






• 
  Policy issues
  
  
  
  • 
    Educate users about the whys and hows of your policies. When you have
    prohibited something which is regularly available on other systems, provide
    documentation which explains how to accomplish similar results using other,
    more secure means.
    
  
  
  • 
    Prohibit use of protocols which use cleartext passwords (telnet, rsh and
    friends; ftp, imap, http, ...).
    
  
  
  • 
    Prohibit programs which use SVGAlib.
    
  
  
  • 
    Use disk quotas.
    
  
  
  
  


• 
  Keep informed about security issues
  
  
  
  • 
    Subscribe to security mailing lists
    
  
  
  • 
    Subscribe to security updates -- add to /etc/apt/sources.list an
    entry (or entries) for http://security.debian.org/debian-security
    
  
  
  • 
    Also remember to periodically run apt-get update ; apt-get upgrade
    (perhaps install as a cron job?).
    
  
  
  
  

Debian Mail Server Setup with Postfix + Dovecot + SASL + Squirrel Mail

Install Postfix MTA (Mail Transfer Agent)

Use the following command to install postfix in debian

#aptitude install postfix postfix-tls libsasl2 sasl2-bin libsasl2-modules popa3d

During installation, postfix will ask for few questions like name of server and answer those questions by entering your domain name and select Internet site for postfix.

Postfix configuration file is located at:/etc/postfix/main.cf. You can edit this file using popular text editor vi /etc/postfix/main.cf

Restart Postfix Server using the following command

#/etc/init.d/postfix restart

Install Dovecot

Dovecot is POP3/IMAP server which needs MTA like Postfix to work properly.

#aptitude install dovecot-imapd dovecot-pop3d dovecot-common

Dovecot configuration file is located at: /etc/dovecot/dovecot.conf

Before we proceed we need to make some changes with dovecot configuration file. Double check the following entries in the file if the values are entered properly.

Edit the dovecot configuration file using the following command

#vi /etc/dovecot/dovecot.conf

# specify protocols = imap imaps pop3 pop3s
protocols = pop3 imap
# uncomment this and change to no.
disable_plaintext_auth = no
pop3_uidl_format = %08Xu%08Xv

Now, create a user to test our pop3 mail with outlook:

#adduser user_name

Note: Always create a separate user to test your mail or ftp.

Restart Dovecot using the following command

#/etc/init.d/dovecot restart

Now, you can use your outlook express to test whether your new mail server is working or not. Just enter username: with password in outlook.

Remember you will NOT be able to send email outside your network, you will be only be able to send within your domain or local network. If you attempt to send email you get “relay access denied” error from outlook express. However, you should have no problems in receiving your email from outlook. Inorder to send email external email you will need to configure SASL authentication as described below.

Configure SASL Authentication with TLS

SASL Configuration + TLS (Simple authentication security layer with transport layer security) used mainly to authenticate users before sending email to external server, thus restricting relay access. If your relay server is kept open, then spammers could use your mail server to send spam. It is very essential to protect your mail server from misuse.

Let us set up SMTP authentication for our users with postfix and dovecot.

Edit the postfix configuration file /etc/postfix/main.cf and enter the few lines to enable authentication of our users

smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain = yourdomain.com
smtpd_recipient_restrictions = permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination
smtpd_sasl_security_options = noanonymous

postfix does a chroot so it can’t communicate with saslauthd.

#rm -r /var/run/saslauthd/

#mkdir -p /var/spool/postfix/var/run/saslauthd

#ln -s /var/spool/postfix/var/run/saslauthd /var/run

#chgrp sasl /var/spool/postfix/var/run/saslauthd

#adduser postfix sasl

On the Dovecot side you also need to specify the dovecot authentication daemon socket. In this case we specify an absolute pathname. Refer to this postfix manual here

Edit /etc/dovecot/dovecot.conf file

#vi /etc/dovecot/dovecot.conf

Look for the line that starts with auth default, before that insert the lines below.

auth default {
mechanisms = plain login
passdb pam {
}
userdb passwd {
}
socket listen {
client {
path = /var/spool/postfix/private/auth
mode = 0660
user = postfix
group = postfix
}

}

}

Now, rename previous auth default to auth default2. If you dont rename this then dovecot server will give you error like multiple instances of auth default.

Now restart all the following components of mail server

#/etc/init.d/saslauthd restart

#/etc/init.d/postfix restart

#/etc/init.d/dovecot restart

Test whether your mail server works or not with your outlook express. Configure a user with a user name (without @domain) and make sure that you select my server requires authentication. Under settings select same as incoming mail server

Note:
1. If you dont enable My server requires authentication in outlook you cannot send emails to external recipients and you get relay access denied error.
2. Do not use root login to login to your mail server.
3. Dont forget to create a new user before you authenticate using outlook.

Forwarding Mails

Ever wondered how to forward your mails especially if you are a webmaster managing number of sites. You might need to forward any email sent to your primary email address. Its that easy. Just create a .forward file on your home directory. Insert list of emails addresses separated by commas, where you want to get forwarded.

Login as user and type

echo ‘destination_email_address’ > .forward

or you can use vi to create .forward file. Just Delete .forward file if you dont want any forwarding.

Installing Squirrel Web Mail

Before installing Squirrel Web Mail you need to make sure you have installed apache2 with php support

#aptitude install apache2

#aptitude install libapache2-mod-php5 php5-cli php5-common php5-cgi

#aptitude install squirrelmail

Squirrelmail configuration file is located in: /etc/squirrelmail/ folder. By default all settings are preloaded.

# Run squirrelmail configuration utility as ROOT
/usr/sbin/squirrelmail-configure

Now we want to setup to run under apache. Edit apache configuration file /etc/apache2/apache2.conf and insert the following line

Include /etc/squirrelmail/apache.conf

Restart the webserver using the following command

#/etc/init.d/apache2 restart

Access your webmail using the following link

http://yourdomain or server ip/squirrelmail

Create a separate local user and login as a new user.

Mail Server Logs

Always refer to logs located in /var/log/mail.log so that you can identify what the problem is before you can troubleshoot.

A detailed look at the filesystem in Debian

A typical Linux system has, among others, the following directories:

/

This is the root directory. This is where the whole tree starts.

/bin

This directory contains executable programs which are needed in single user mode and to bring the system up or repair it.

/boot

Contains static files for the boot loader. This directory only holds the files which are needed during the boot process.

/dev

Special or device files, which refer to physical devices.

/etc

Contains configuration files which are local to the machine. Some larger software packages, like X11, can have their own subdirectories below /etc. Site-wide configuration files may be placed here or in /usr/etc. Nevertheless, programs should always look for these files in /etc and you may have links for these files to /usr/etc.

/etc/skel

When a new user account is created, files from this directory are usually copied into the user's home directory.

/etc/X11

Configuration files for the X11 window system.

/home

On machines with home directories for users, these are usually beneath this directory, directly or not. The structure of this directory depends on local administration decisions.

/lib

This directory should hold those shared libraries that are necessary to boot the system and to run the commands in the root filesystem.

/mnt

is a mount point for temporarily mounted filesystems

/proc

This is a mount point for the proc filesystem, which provides information about running processes and the kernel.

/sbin

Like /bin, this directory holds commands needed to boot the system, but which are usually not executed by normal users.

/tmp

This directory contains temporary files which may be deleted with no notice, such as by a regular job or at system boot up.

/usr

This directory is usually mounted from a separate partition. It should hold only sharable, read-only data, so that it can be mounted by various machines running Linux.

/usr/X11R6

The X-Window system.

/usr/bin

This is the primary directory for executable pro grams. Most programs executed by normal users which are not needed for booting or for repairing the system and which are not installed locally should be placed in this directory.

/usr/bin/X11

is the traditional place to look for X11 executable's; on Linux, it usually is a symbolic link to /usr/X11R6/bin.

/usr/dict

This directory holds files containing word lists for spell checkers.

/usr/doc

You may find documentation about the installed software packages in this directory.

/usr/etc

Site-wide configuration files to be shared between several machines may be stored in this directory. However, commands should always reference those files using the /etc directory. Links from files in /etc should point to the appropriate files in /usr/etc.

/usr/include

Include files for the C compiler.

/usr/include/X11

Include files for the C compiler and the X-Windows system. This is usually a symbolic link to /usr/X11R6/include/X11.

/usr/include/asm

Include files which declare some assembler functions. This used to be a symbolic link to /usr/src/linux/include/asm.

/usr/include/linux

This contains information which may change from system release to system release and used to be a symbolic link to /usr/src/linux/include/linux to get at operating system specific information.

(Note that one should have include files there that work correctly with the current libc and in user space. However, Linux kernel source is not designed to be used with user programs and does not know anything about the libc you are using. It is very likely that things will break if you let /usr/include/asm and /usr/include/linux point at a random kernel tree. Debian systems don't do this and use headers from a known good kernel version, provided in the libc*-dev package.)

Include files to use with the GNU C++ compiler.

/usr/lib

Object libraries, including dynamic libraries, plus some executable's which usually are not invoked directly. More complicated programs may have whole subdirectories there.

/usr/lib/X11

The usual place for data files associated with X programs, and configuration files for the X system itself. On Linux, it usually is a symbolic link to /usr/X11R6/lib/X11

/usr/lib/gcc-lib

contains executable's and include files for the GNU C compiler.

/usr/lib/groff

Files for the GNU groff document formatting system.

/usr/local

This is where programs which are local to the site typically go.

/usr/local/bin

Binaries for programs local to the site go there.

/usr/local/doc

Local documentation

/usr/local/etc

Configuration files associated with locally installed programs go there.

/usr/local/lib

Files associated with locally installed programs go there.

/usr/local/info

Info pages associated with locally installed pro grams go there.

/usr/local/man

Manpages associated with locally installed programs go there.

/usr/local/sbin

Locally installed programs for system administration.

/usr/local/src

Source code for locally installed software.

/usr/man

Manpages traditionally go in there, into their sub directories.

/usr/sbin

This directory contains program binaries for system administration which are not essential for the boot process, for mounting /usr, or for system repair.

/usr/share

This directory contains subdirectories with specific application data, that can be shared among different architectures of the same OS. Often one finds stuff here that used to live in /usr/doc or /usr/lib or /usr/man.

/usr/share/man

Manpages go in there, into their subdirectories.

/usr/src

Source files for different parts of the system, included with some packages for reference purposes. Don't work here with your own projects, as files below /usr should be read-only except when installing software

/usr/src/linux

This has always been the traditional place where kernel sources were unpacked. This was important on systems that /usr/include/linux was a symlink here. You should probably use another directory for building the kernel now.

/usr/tmp

Obsolete. This should be a link to /var/tmp. This link is present only for compatibility reasons and shouldn't be used.

/var

This directory contains files which may change in size, such as spool and log files.

/var/adm

This directory is superseded by /var/log and should be a symbolic link to /var/log.

/var/backups

This directory is used to save backup copies of important system files.

/var/lock

Lock files are placed in this directory. The naming convention for device lock files is LCK.. where is the device's name in the filesystem. The format used is that of HDU UUCP lock files, i.e. lock files contain a PID as a 10-byte ASCII decimal number, followed by a newline character.

/var/log

Miscellaneous log files.

/var/preserve

This is where vi saves edit sessions so they can be restored later.

/var/run

Run-time variable files, like files holding process identifiers (PIDs) and logged user information (utmp). Files in this directory are usually cleared when the system boots.

/var/spool

Spooled (or queued) files for various programs.

/var/spool/at

Spooled jobs for at(1).

/var/spool/cron

Spooled jobs for cron

/var/spool/lpd

Spooled files for printing.

/var/spool/mail

Users' mailboxes.

/var/tmp

Like /tmp, this directory holds temporary files stored for an unspecified duration.

Monitoring Servers,Network Devices with Opmanager in Debian

OpManager is a network monitoring software that can automatically discover your network; group your devices into intuitive maps, monitor devices in real-time and alert instantaneously on failure. It serves as a complete network monitoring solution by providing complete fault and performance functionality across your WAN and LAN infrastructure.

System Requirements

Processor: 32-Bit x86 Compatible
998 MHz and above
Memory: 999 MB
Disk space: 200MB
Operating System: RedHat 7.x and above, Debian 3.0 and above

Preparing Your System

You need to install the following packages as root

# apt-get install libgdbmg1 libexpat1

Create the following user and group

# adduser nobody
# groupadd nobody

Install Opmanager in Debian Etch

First you need to download the trail version of opmanager for Linux from here . Now you should have ManageEngine_OpManager_7_linux.bin file. You need to run this file using the following command as root

# ./ ManageEngine_OpManager_7_linux.bin

This will start the installation and you should see the following welcome installation shield you need to click next here

Now you should see the following License Screen select” I accept the …..” option and click Next

Next one is you should choose between trail version and Free edition. Here you need to choose trail version and click next

Select you Language and click next

If you want to change the installation directory you can do so otherwise click next

Enter the web server port as 4430 because 443(https) might be using another application so I would suggest 4430 click next

Installation details screen click next

Opmanager Installation is in progress

Extracting Files are in progress

Installation Completed Screen click finish

The file libdb-3.2.so may not exist in your system. OpManager bundles this file under lib/backup under OpManager Installation directory. Copy this file to lib directory ie.(Execute this command under /opt/AdventNet/ME/OpManager – this is the default location where OpManager is installed under Linux distribution)

# cd /opt/AdventNet/ME/OpManager/

# cp lib/backup/libdb-3.2.so lib/

Now you need to start the opmanager using the follow command

# /opt/AdventNet/ME/OpManager/bin/StartOpmanagerServer.sh

Once it started you should see the following screen

Now you need to go to open https://serverip:4430 in your web browser you should see the following screen here you need to login using the following details

Username: – admin

Password: – admin

Opmanager Startup Script

If you want to start your opmanager automatically when you reboot your server you need to download this script

Download opmanager file into /etc/init.d directory and run the following command

#chmod 755 opmanager

Now you need to update the startup script link using the following command

#update-rc.d opmanager defaults 50

Thats it your opmanager is ready to use

Now you need to check this manual for how add devices and services.