Red Hat ENTERPRISE LINUX 4 - SELINUX GUIDE Uživatelská příručka Strana 54
- Strana / 128
- Tabulka s obsahem
- KNIHY
Hodnocené. / 5. Na základě hodnocení zákazníků
Chapter 2. Securing Your Network
44
Below is a sample entry from a /var/yp/securenets file:
255.255.255.0 192.168.0.0
Warning
Never start an NIS server for the first time without creating the /var/yp/securenets file.
This technique does not provide protection from an IP spoofing attack, but it does at least place limits
on what networks the NIS server services.
2.2.3.4. Assign Static Ports and Use iptables Rules
All of the servers related to NIS can be assigned specific ports except for rpc.yppasswdd — the
daemon that allows users to change their login passwords. Assigning ports to the other two NIS server
daemons, rpc.ypxfrd and ypserv, allows for the creation of firewall rules to further protect the NIS
server daemons from intruders.
To do this, add the following lines to /etc/sysconfig/network:
YPSERV_ARGS="-p 834" YPXFRD_ARGS="-p 835"
The following iptables rules can then be used to enforce which network the server listens to for these
ports:
iptables -A INPUT -p ALL ! -s 192.168.0.0/24 --dport 834 -j DROP
iptables -A INPUT -p ALL ! -s 192.168.0.0/24 --dport 835 -j DROP
This means that the server only allows connections to ports 834 and 835 if the requests come from the
192.168.0.0/24 network, regardless of the protocol.
Note
Refer to Section 2.5, “Firewalls” for more information about implementing firewalls with iptables
commands.
2.2.3.5. Use Kerberos Authentication
One of the issues to consider when NIS is used for authentication is that whenever a user logs into a
machine, a password hash from the /etc/shadow map is sent over the network. If an intruder gains
access to an NIS domain and sniffs network traffic, they can collect usernames and password hashes.
With enough time, a password cracking program can guess weak passwords, and an attacker can
gain access to a valid account on the network.
Since Kerberos uses secret-key cryptography, no password hashes are ever sent over the network,
making the system far more secure. Refer to Managing Single Sign-On and Smart Cards for more
information about Kerberos.
- Red Hat Enterprise Linux 6 1
- Security Guide 1
- Edition 1.5 2
- 1. Document Conventions 7
- 1.2. Pull-quote Conventions 8
- 2. We Need Feedback! 9
- Security Overview 11
- 1.1.1.2. Security Today 12
- 1.1.2. SELinux 13
- 1.1.3. Security Controls 13
- 1.1.4. Conclusion 14
- 1.2. Vulnerability Assessment 15
- 1.2.3. Evaluating the Tools 17
- 1.2.3.2. Nessus 18
- 1.2.3.3. Nikto 18
- 1.3.1.1. Shades of Gray 19
- 1.3.2.1.1. Broadcast Networks 20
- 1.3.3.2. Unpatched Services 21
- 1.3.4.1. Bad Passwords 22
- 1.5. Security Updates 25
- 1.5.4. Applying the Changes 27
- Applying the Changes 29
- Securing Your Network 31
- /sbin/grub-md5-crypt 32
- 2.1.3. Password Security 33
- 2.1.3.2.2. Passphrases 37
- 2.1.3.2.3. Password Aging 37
- 2.1.4.1. Allowing Root Access 39
- 2.1.4.3. Limiting Root Access 42
- 2.1.4.3.2. The sudo Command 43
- 2.1.5.1. Risks To Services 44
- 2.1.5.3. Insecure Services 46
- 2.1.6. Personal Firewalls 47
- 2.2. Server Security 48
- 220-Hello, %c 49
- 2.2.1.2.1. Setting a Trap 50
- 2.2.2. Securing Portmap 52
- 2.2.3. Securing NIS 52
- 255.255.255.0 192.168.0.0 54
- 2.2.4. Securing NFS 55
- UserDir enabled 56
- UserDir disabled root 56
- 2.2.6. Securing FTP 57
- 2.2.6.2. Anonymous Access 58
- 2.2.6.3. User Accounts 58
- 2.2.7. Securing Sendmail 59
- 2.2.7.3. Mail-only Users 60
- 2.3. TCP Wrappers and xinetd 61
- 2.3.1. TCP Wrappers 62
- [root@myServer ~]# 63
- 2.3.2.1.1. Wildcards 65
- 2.3.2.1.4. Operators 67
- 2.3.2.2. Option Fields 68
- 2.3.2.2.4. Expansions 69
- 2.3.3. xinetd 70
- 2.3.4.3.1. Logging Options 72
- 2.3.5. Additional Resources 75
- 2.3.5.3. Related Books 76
- 2.4.1. How Does a VPN Work? 77
- 2.4.2. Openswan 77
- 2.4.2.3. Commands 78
- 2.5. Firewalls 79
- 2.5.1. Netfilter and IPTables 81
- 2.5.2.3. Trusted Services 83
- 2.5.2.4. Other Ports 83
- 2.5.3. Using IPTables 84
- 2.5.5. FORWARD and NAT Rules 86
- 2.5.5.2. Prerouting 88
- 2.5.5.3. DMZs and IPTables 88
- 2.5.8. IPv6 90
- 2.5.9. Additional Resources 90
- 2.6. IPTables 91
- 2.6.2.2. Command Options 94
- 2.6.2.4.1. TCP Protocol 97
- 2.6.2.4.2. UDP Protocol 98
- 2.6.2.4.3. ICMP Protocol 98
- 2.6.2.5. Target Options 99
- 2.6.3. Saving IPTables Rules 101
- 2.6.5. IPTables and IPv6 104
- 2.6.6. Additional Resources 104
- Encryption 105
- 3.5. Virtual Private Networks 106
- 3.6. Secure Shell 106
- 3.7. OpenSSL PadLock Engine 106
- 3.8. LUKS Disk Encryption 107
- Important 108
- 3.8.5. Links of Interest 109
- Security 113
- Secure Installation 115
- Software Maintenance 117
- 7.1. Introduction 119
- (NISPOM) 120
- References 121
- A.1. Synchronous Encryption 123
- A.2. Public-key Encryption 124
- A.2.2. RSA 125
- A.2.3. DSA 125
- A.2.4. SSL/TLS 125
- A.2.6. ElGamal Encryption 126
- Appendix B. Revision History 127
Související produkty a manuály pro Software Red Hat ENTERPRISE LINUX 4 - SELINUX GUIDE
(268 stránky)Ricoh C274 Handbücher
Bedienungsanleitungen und Benutzerhandbücher für Drucken & Scannen Ricoh C274.
Wir stellen 1 PDF-Handbücher Ricoh C274 zum kostenlosen herunterladen nach Dokumenttypen zur Verfügung Bedienungsanleitung
Komentáře k této Příručce