（RHCA）Red Hat Enterprise Linux RHS333: Red Hat Enterprise Security: Network Services

Unit 2

Basic Service Security

Objectives

Upon completion of this unit, you should be able to: SELinux Kernel packet filter TCP Wrapper xinetd

Basic Host Security

Run only necessary network services Every extra service on a host is another possible vulnerability Separate servers by function Keep software up to date Use yum or Automatic Updates from Red Hat Network to stay current Limit access to critical servers

SELinux

Mandatory Access Control (MAC) -vs- Discretionary Access Control (DAC) A rule set called the policy determines how strict the control Processes are either restricted or unconfined The policy defines which resources a restricted process is allowed to access Any action that is not explicitly allowed is, by default, denied

SELinux Security Context

SELinux: Targeted Policy

The targeted policy is loaded at install time Most local processes are unconfined Principally uses the type element for type enforcement The security context can be changed with chcon chcon -t tmp_t /etc/hosts Safer to use restorecon restorecon /etc/hosts

SELinux: Management

Modes: Enforcing, Permissive, Disabled /etc/sysconfig/selinux system-config-securitylevel getenforce and setenforce 0 | 1 Disable from GRUB with selinux=0 Policy adjustments: Booleans, file contexts, ports, etc. system-config-selinux (from policycoreutils-gui package) getsebool and setsebool semanage Troubleshooting Advises on how to avoid errors, not ensure security! setroubleshootd, sealert -b and sealert -a

SELinux Troubleshooting

What is the error? Check /var/log/audit/audit.log for AVC denials sealert analyzes denials Is the process doing something it should not? Does the target have the right context? httpd_selinux, samba_selinux, ftpd_selinux and other man pages Does a boolean setting need adjustment?

Host-based Access Control

Kernel packet filters Netfilter: iptables and related tools TCP wrappers Supported by most network services xinetd-based access controls Only usable by xinetd-based services

Netfilter/iptables

Netfilter is the first line of defense system-config-securitylevel iptables can be used for fine-tuning Local firewall is enabled by default Accept ICMP, IPSec, CUPS, multicast DNS, responses to requests initiated by the host and traffic arriving on the loopback interface. RH-Firewall-1-INPUT custom chain

Review of TCP Wrappers

daemon list : client list : [option] Options are listed in hosts_options(5) There may be zero, one, or more options Option %<letter> substitutions work as specified in hosts_access(5) Options behave the same in either hosts.allow or hosts.deny files

Access Control

daemon list : client list : ALLOW|DENY Changes how rule will be interpreted no matter which file it is in Allows consolidation of rules into one file May simplify rule management Must be the last option in the rule

Logging

daemon list : client list : severity [fac].pri Logs the connection using the syslog facility and priority specified Facility is optional Default is authpriv.info

Running Other Commands

daemon list : client list : spawn command Executes command in a child process Default I/O is connected to /dev/null daemon list : client list : twist command Service is replaced by command Default I/O is connected to client Both support %<letter> substitution

banners

daemon list:client list:banners directory The file "directory/daemon name" is sent to the client before connected to service %<letter> substitution works in the banner Only works with TCP-based services

xinetd Configuration Review

Services configured in /etc/xinetd.d Each configuration file is named for the service it configures

/etc/xinetd.d Issues

Files in /etc/xinetd.d are read in alphabetical order First enabled service block which applies to the interface is used All others are ignored Can accidentally get wrong program if several programs using the port exist krb5-telnet or telnet

Location Limits

Syntax Allow with only_from = host_pattern Deny with no_access = host_pattern The most exact specification is authoritative Example only_from = 192.168.0.0/24 no_access = 192.168.0.1

Time Limits

access_times - specifies the time of day the service will be available access_times = <time range> ... Hours range from 0-23, minutes from 0-59

Interface Limits

bind - associates the service with a particular interface bind = <ip address> interface is a synonym for bind Can use the same port with different services on different IP addresses Can limit access to a service to clients connecting to a certain IP address

Usage Limits

cps - limit rate of incoming connections cps = <connectionspersec> <waitperiod> per_source - set maximum number of connections from a particular source IP per_source = <#connections|UNLIMITED> instances can be used instead to specify a maximum number of connections from all hosts

flags and deny_time

flags modify the behavior of xinetd INTERCEPT - check each packet for authenticity rather than just first one SENSOR - establishes a "trap" service Used in association with deny_time attribute deny_time = <FOREVER|NEVER|#minutes>

Interaction Between Filters

First restriction takes effect Checks against iptables first For xinetd services: TCP wrappers that affect xinetd, and xinetd configuration TCP wrappers that affect the service itself The service may have its own internal restrictions (NFS, Apache, etc.)

End of Unit 2

Questions and Answers Summary Simple steps to improve host security TCP wrapper options Advanced xinetd configuration