fehmierduran.com doxycycline philippines khasiat acyclovir allegra 6r centrifuge price how much does propecia cost a month torsemide spironolactone tide plus 10 for used foodloversheaven.com orlistat def 50 paladardigital.com eastriverpartners.info llamayhabla.com why lower back pain 5 days after clomid etodolac 400 mg tab teva usa harga salep metronidazole fosamax 10 mg 20 tablet prix ramavex ciprofloxacin 500 mg untuk apa buying viagra over the internet haltner.com endep 10 amitriptyline hydrochloride side effects cflailesi.org ciprofloxacin 500 mg doses glimepiride obat gula 1 ml andysternberg.com does nexium tablets cause magnesium deficiency levothyroxine dizziness side effects fifem.com olanzapine price us 100mg clomid twins unesco-iicas.org sildenafil online kaufen erfahrungen skale.it cabergoline tablet s ip alcohol and azithromycin azithromycin and orange juice ramrescuerigging.com segtucson.com golfnewmexico.com synthroid side effects if dog eats it what if i thriw up when taking zithromax obat diovan 80mg canada metronidazole plus spiramycine animaux fotografie-cursus.net propecia cost at costco metronidazole ivi buy albuterol inhaler no prescription thinkauto.com antibiotic levofloxacin overuse time period cialis is most effective chulavista-suites.com les effets de medicaments flagyl antibiotic generic viagra softabs po box delivery batterymedix.com atarax 75 mg aneyron.com can 5 days of azithromycin cure gonorrhea and chlamydia bmmpm.com amoxil 500 mg uses streetstylesinfo.com ondansetron tab 8mg for pregnancy batterymedix.com doxycycline side effects chickens how often should i take clonidine 100 mcg for anxiety ivermectin horse paste human dosage buy accutane in uk what happens if you take two viagra iv metronidazole veterinary buy sucralfate with nexium playbookmanagement.com can i masturbate while taking augmentin apparel-chic.com how much cialis can u take a day side effects when you stop taking flagyl obat cifro dan ketoconazole amankah untuk ibu hamil can nexium tablets be halved carlosfloresmusic.com seroquel 400 milligrams can kill you businesscreditpro.com can you take lipitor if you smoke weed acyclovir 800mg should i try 10mg celexa fir fibromyalgia allcoinreviews.org mutien.be tell me about olmesartan digoxin doctor uk lanoxin o.125 mg radiobledi.com kamagra apoteka how long does it take for buspar to be effective ciprodex inhaled clonidine patch online metronidazole 500mg mercury price philippines mutien.be para que sirve el baclofen 10 mg how much 250 amoxicillin should a 16 year old take buy valtrex online europe levofloxacin tablets with buscopan chulavista-suites.com valtrex dosage for cold sore madeinusachallenge.com xiyue028.com can lisinopril cause a slow heart rate week 4 cymbalta street name for buspirone hydrochloride 5mg. switch fluoxetine to strattera diflucan against anus candida allcoinreviews.org cialis versus viagra side effects zyprexa suicidio what to do cual es el procedimiento de las pastillas cytotec ravatio and viagra difference rwmeierlaw.com doxycycline prescription cost uk sertraline uk forum how long can i take amitriptyline for insomnia buy furosemide for dogs online sildenafil 100mg tab for which function prazosin hydrocloride tablets what do u use celebrex capsule f ramrescuerigging.com accidental overdose of 80mg of diovan nitroglycerin ointment in pakistan brand name doxycycline 100mg side effects in dogs day 35 and no period on clomid allcoinreviews.org 555fs.com association-secours-sante.cm citalopram hydrobromide 20mg uk sekerpinarosgb.com flagyl causeing eye infections cytotec tablets uk fluconazole 150mg reviews seadoo-maldives.com asociacion de especialistas de belleza viagra online medical roywalker-ifa.com light degradation paroxetine mhc-s.com can remeron be taken in the morning abortos fallidos con cytotec order accutane online from india dismenorhea after inserting cytotec is levaquin better than amoxil can memory loss be caused by getting off paxil propecia indonesia lipitor 20 mg price priligy for sale in usa priligy buy online usa flagyl online shop propecia canada get cardura 1 mg uses batterymedix.com erythromycin 250 mg dosage reviews escitalopram oxalate 10 mg doxycycline twice a day dogs dosage of synthroid during pregnancy maximum dosage of prednisone per day nexium 24can i double the dosage does tamoxifen causing bruising remeron 45 mg reviews kidney pain while taking flagyl dickhopper.com levaquin 500 mg con omeprazol cialis online italia contrassegno businesscreditpro.com iranstrick-tiregroup.com arcolane shampoo vs nizoral shampoo metronidazole gel inhalation is bananas ok to eat if taking lisinopril metronidazole 500mg antibiotic and pregnancy secretlives.me nsfrm.com tmedia.com biolab.com.sg prescribed dosage of albuterol for a seven month baby scuba dive and use of albuterol nebulizer swasthiktv.com prednisone and erectile dysfunction ketoconazole 2 percent cream for cold sore how much does glucophage cost without insurance clomiphene citrate at clicks 150 vs 300 mg wellbutrin bird doxycycline safe for humans uk viagra in supermarkets order propecia online with no prescription zyvox price india nexium 14 day treatment stlsoccer.net obat etamox amoxicillin 500 mg augmentin 750 mg strattera 40 mg capsule same as adderall pi.petnica.rs trentacular.com novo prednisone and marijuana drugprevent.org.uk aborto de 22 semanas con cytotec side effects of long term use of prednisone in dogs azithromycin dosage acne treatment onlyhantang.com buy valtrex online cheap lexapro 10mg cancer bactrim susp peds compounding recipie metformin interaction with anesthesia withdrawing from prozac lisinopril with no prescription lopressor common side effects prostam sr tamsulosin hcl 0.4mg obat untuk apa uses amoxicillin clavulanate meloxicam dosage maximum will 5mg of prednisone make me gain weight cipro side effects high blood pressure can tablet ciprofluxacin cause ovarian cyst warfarin inhibits factors 2 7 9 10 taking nolvadex without a period for fertility if am trying to become pregnant can i take augmentin amitriptyline 90 mg equivalent doses of iv and oral lasix poison oak prednisone 4 day dosage feswmp.com when-we-were-kings.com much does clomid cost walmart lawonline.co.il zydus topiramate prescribing information pdf does zyprexa have a street value nrstyles.com dose of amoxicillin for strep throat feifan8.net 8nxw.com thuoc micardis r 80 mg diff between womens cialis and mens tetracycline adverse effects mnemonic amlodipine besylate 5mg harga side effects of prednisone 100 mg doxycycline side effects hot flashes piracanga.com.br naprosyn teva 149 how much does a box of albuterol cost citalopram vs. zoloft how to wean elderly from antidepressant anaheimangelsjersey.com balitoursclub.com amoxicillin 1 gram does ketoconazole work for dogs doxycycline antibiotics to fight infected tooth is 600 milligrams of viagra too much 2.5 mg lexapro 4 weeks association-secours-sante.cm vibramycin online pharmacy clomid 100 mg pcos baclofen modafinil worldtravelandtourservices.com zoloft lawsuit withdrawal zaps can i take metronidazole with propranolol 90 wellbutrin xl 300mg can you crush flagyl pay for viagra through paypal cipro how fast does it work singulair 10 mg tablet price can i take blood tonic and fluconazole carlosfloresmusic.com does chinese food affect coumadin levels dosage of flagyl for the treatment of coli difficile metformin 250 sustained release can u drink ciplox and metronidazole together accutane cumulative dose for folliculitis xn--b1afpdqbb8d.xn--p1ai antibiotic how many days length of time for diflucan to work tjbymy.com trazodone ml50 salonedisuccesso.it prozac cost uk plavix generic for sale ansbach-direkt.de dataminingweb.com clonidine 0.2 mg high side effects of atenolol prednisone dosage skin rash ascbelfast.com nursing implication of lasix common side effects of femara cytotec dosesfor medical abortion clomid after chemical pregnancy buy levitra 10mg michelamarchiotto.com heavyanalytics.com sobukaidewallonie.be costo del cytotec en lima stopping premarin message boards how long does the effects of 20 mg strattera last dog panting after taking metronidazole clonidine transdermal patch to treat crps piroxicam gel online several propecia sheds THUMBUY.COM banners-and-skyscrapers.com unesco-iicas.org what the diadvantage of viagra on female feifan8.net focva.org viagra discount australia iranstrick-tiregroup.com nifedipine 30 mg indikasi lexapro side effects v duloxetine side effects side effects of oral diflucan stay in system how long lasix use in icu diflucan dose ballanitis augmentin sr piracanga.com.br how long metronidazole gel to get out of system tamoxifen manufacturers usa augmentin 250 mg tablets farmacia de orizaba que venda cytotec sin receta elusionist.com buy lipitor generic cost of p.o. zyvox orlistat ratiopharm 84 can montelukast affect breathalyzer test buy cheap generic viagra online intramuscolar injection of levofloxacino sertraline 50 mg withdrawal how long does it tate over the counter diflucan washington las pastillas priligy se puede conseguir en venezuela hanhvyshop.vn price of valtrex generic amlodipine besylate side effects swelling drugprevent.org.uk how can you tell if provera 5mg issss working perfectly how much is misoprostol cost in south africa cheap viagra tablets for sale bow does valtrex work simplebonsai.info focva.org can you buy doxycycline in malaysia discount cialis reviews bollywoodinformer.com mytime99.com warfarin allowed in islam gelernt.net batterymedix.com quetiapine mg how much does plendil 10 mg cost why is cipro hc otic cost so much australia dapoxetine revista 2 rodas ninja 300 indication of acyclovir in mumps fehmierduran.com deliver micardis plus 80 mg to ireland coreg cr 10mg capsules amlodipine and simvastatin side effects mylan vs qualitest on 40 mg furosemide indicaciones del celecoxib 200 mg myexactamundo.com price range for clomid mhc-s.com receding hair propecia what is metformin hcl er 500 mg used for bowels terbinafine vitiligo side effects nifedipine bigger erections cialis levitra sales viagra allcoinreviews.org can you take teva propranolol when pregnant levitra for sale toronto buy strattera online us unpyme.org.pa what happens if you take 40 mg of cialis smoking bupropion ir vs sr tablet tamoxifen benazepril hcl 5mg side effects in cats how much is gabapentin 100mg worth uk thepostcardcompany.com generic xenical cheap acyclovir 400 mg price philippines buy ivermectin liquid in canada synthroid 150 mcg side effects kamagra 7 24 policyforlife.com cheapest viagra in nairobi how many erections during one dose of cialis priligy overnight azithromycin anhydrous dosage for fish can augmentin 625mg treat pneumonia patent litigation esomeprazole trihydrate cheap tadalafil uk can 30 mg cymbalta make u sleepy ilosone suspension 125 mg propecia 10 year study mifepristona o el misoprostol precios en rd can benadryl be taken with septra ds acyclovir 200 mg tablets mecanismo accion misoprostol pdf wellbutrin day 9 MASTERRAFTING.COM drugprevent.org.uk drugprevent.org.uk carlosfloresmusic.com esteponasurgery.com cipro side effects loss of appetite metronidazole india buy focva.org emberdomme.com interaction between amoxicillin and duphaston 8nxw.com whats the shelf life of paroxetine hcl 10mg does lexapro make you want to throw up 2 pill pack of antibiotics for chlamydia betamox antibiotics is it safe to take clomid after preterm labour whats the side effects of acyclovir 1g antibiotic for ear tooth infection amoxicillin for oral suspension turkce wikipedia singulair 4 mg generic buspar 75 mg what is antidepressants chloramphenicol 10 mg salep mata premarin costo en farmacia guadalajara cyproheptadine monographie kinoiekyoriki.com inderal replacement naprosyn price australia trustoverseas.com how much albuterol for a 2 mnth old can dogs take amoxicillinamoxicillin 60 lb dog xenical price in mercury drug store doxycycline pustular acne staph infection aml.ca kactospedrasdecorativas.com.br propecia gynecomastia anastrozole minimum dosage viagra twospy.com baclofen for cerebral palsy can you use transdermal phenergan as a suppository ile-au-tresor.net how much benedryl for paxil withdrawel can i crush metformin in ice cream em2nt.net cytotec seaple 1862 funciona 20 mg accutane for 9 months blackisbusiness.info side effects elavil with seroquil golfnewmexico.com harga neurontin cordarone 900 mg gabapentin for osteoarthritis pain dogs furosemide weight loss apa bedanya flucloxacillin dengan amoxicillin amoxicillin 500 for pigeons can metoprolol cause euphoria dfldctl.com metronidazole 2g for bv xenical diet pills walgreens cerisdieventi.com mirtazapine and perimenapause deserteichler.com seadoo-maldives.com buy isotretinoin gel in india can metformin make sperm bitter metformin icd 9 code iv flagyl infusion rate lexapro generic going generic cheap viagra next day phenergan vc 6.25 can metronidazole benzoate be prescribed for ferrets estradiol .5 mg side effects tamoxifen customs australia oral ivermectin for dogs dosage teflox levofloxacin usp metformin 500 mg price ebay voltaren gel precio chile bmmpm.com urban-x.ba olanzapine street price for 1 pill foodloversheaven.com lethal dose levothyroxine glucophage price walmart viagra cheap 25mg harga antiviral flagyl 400 mg what is it for dutasteride vs finasteride prostate bleeding on a 100mg clomid cycle cd22 cialis how to tell if its fake heartsdirect.co.uk 80 mg paxil to much feline asthma prescribed mg albuterol brand names of lisinopril 40 mg average dosage of propecia metformina acne side effects of bupropion sr lotrimin vs lamisil for ringworm generic propecia costco acyclovir ringworm treatment clomiphene citrate online how to cut down on paxil andysternberg.com zoloft activating first days can u take gabapentin while having glaucoma how much of vitamin c should be taken with clomiphene phenergan for a 1 year old side effects of lyta duloxetine white liquid antibiotic with metallic taste strattera 18mg how many hours does it last

Hardening UNIX Applications (draft notes)

Secure installation of UNIX Server Applications

By Seán Boran

This article discusses securely installing well known applications like FTP, DNS and Email.  For each category, a list or tips and products are provided. General guidelines for all applications are also presented.

  1. Preparation
  2. General Guidelines
  3. FTP servers (ftpd)
  4. DNS servers
  5. HTTP servers
  6. Email Clients
  7. Email servers (SMTP): sendmail, postfix, smap
  8. Additional Notes: IDS | saveit | ntp

References
Changes to this article


1. Preparation

If you use the C-Shell, the following will make editing easier and enable history functions:

csh;
setenv TERM vt100; setenv VISUAL vi; setenv EDITOR vi;
set filec; set history=40; alias h history; alias ls 'ls -aF \!*';


General Guidelines

The following is a general checklist to consider daemons/applications :

FTP servers (ftpd)

Which FTP server should you use?

Tips for FTPD configuration:

DNS servers

Hardening on BIND is described in a separate paper. See [13].

HTTP servers

General notes:


Email Clients (SMTP)

On UNIX and Linux, sendmail is invariably installed as an email server, running as a daemon. Many users/sysadmin think that sendmail needs to run as a daemon on email clients and servers alike.

The sendmail daemon does not need to run on an 'Email Client'.

This erroneous vendor installation behaviour seems to be a default that goes back 15 years, it is difficult to understand why vendors have not corrected this. Few email servers are needed in an organisation, the default should be to only send email, since most hosts are workstations or servers that do not need an SMTP server. Running sendmail as a daemon, increase security risks:

So how is an email client set up? Assuming we want to deliver all email from our workstation to one SMTP server, the steps are:

1. Define the mail server: add an entry with the email server name and IP address to /etc/hosts. Then add an alias 'mailhost' for this machine. There should also be an entry for the workstation, and workstation.DOMAINNAME.

2. Configure sendmail.cf (in /etc or /etc/mail), so that all email is sent via 'mailhost':

DSmailhost
DRmailhost
DHmailhost
O FallbackMXhost=mailhost

3. Stop the sendmail daemon from starting automatically

mv /etc/rc2.d/S88sendmail /etc/rc2.d/.no_S88sendmail

and kill the current daemon

4. Add appropriate aliases to /etc/mail/aliases, for example:

root: Your.Name@Yourcompany.com

5. If email cannot be delivered immediately (due to server congestion for example), add the following entry to the root crontab to check for and send queued email every hour:

## process the email Q
0 * * * 1-5 /usr/lib/sendmail -q

6. Finally, test that email is being correctly delivered, by sending an empty test email to 'root' (or some other local alias) and to your usual Email address. The '-v' option is added to mailx so that we see the complete dialog with the email server, to convince us that it really is working correctly.

mailx -v -s test_email root </dev/null
mailx -v -s test_email John.Doe@YourCompany.com </dev/null

Troubleshooting: look carefully at the output of the mailx commands above, and any error emails received in the root mailbox. Check that a 'ping' to mailhost works as expected. The SMTP server may be configured only to accept emails from known workstations or workstations with a particular domain (in which case /etc/resolv.conf - DNS must be setup correctly and the workstation must use the same hostname as is listed in DNS)

Hopefully Sun and other vendors will wake up and stop the sendmail daemon by default in future OS releases, it would certainly help reduce the number of unwitting open email relays on the Internet.

 

Email servers & Gateways (SMTP)

If you really need to receive Email (i.e. run an SMTP server), it's not a trivial task. Refer to [16]. Here a few brief notes are provided.

  1. Configure anti-relaying, anti-spam options
  2. Consider anti-virus and content checking
  3. Use a secure front to sendmail on Internet gateways (with its anti-relaying patches) end like
  4. A few quick tips on Sendmail:
  5. A few quick tips on Postfix:
    Postfix is a very interesting SMTP server, from both a security and flexibility standpoint. I waited years to move over from sendmail, I wish I had done so sooner, it really is simpler, more secure and not so painful to move over.

    The main configuration files are typical in /etc/postfix, the big fish is /etc/postfix/main.cf.
    To view non-default settings (i.e. out config): postconf -n
    To show default values: postconf -d

    Some example settings for relay and spam protection are listed in postconf-n.txt
    Most of the postfix elements can be chrooted. It worked fine for me on Solaris by running the script examples/chroot-setup/Solaris2 and then editing /etc/postfix/master.cf so that all non pipe or local daemons had 'chroot=Y'.

    Postfix tutorial (french)- Hervé Schauer Consultants
    http://www.hsc.fr/ressources/cours/postfix/ 

    Postfix -- the Sendmail Replacement - Martin Zahn (nice diagrams, clear instructions)
    http://www.akadia.com/services/postfix_mta.html

    Configuring Postfix as backup MX host - Martin Zahn
    http://www.akadia.com/services/postfix_mx_backup.html

    Using Postfix for Secure SMTP Gateways - Linux Journal (brief overview)
    http://www.linuxjournal.com/lj-issues/issue78/4241.html

    Postfix FAQ
    http://www.agamemnon.net/documents/postfix/faq.html

    pflogsumm.pl http://jimsun.linxnet.com/postfix_contrib.html 

    How UCE Actually Works - mengwong
    http://www.mengwong.com/misc/postfix-uce-guide.txt 

    Filtering E-Mail with Postfix and Procmail, Part Two - Brian Hatch
    http://online.securityfocus.com/infocus/1598 

 

Further reading

The OpenAntiVirus Project
http://www.openantivirus.org
http://www.openantivirus.org/av-unix_e.txt


Additional Notes

This article has been very specific, in the interest of making it practical. However, each security administrator has his own methods and each site has different requirements.


References

[1]  
[2] Sunworld security columns
www.sunworld.com/sunworldonline/common/swol-backissues-columns.html
Solaris Security FAQ www.sunworld.com/common/security-faq.html
Padded Cells: www.sunworld.com/swol-01-1999/swol-01-security.html
Tripwire: sunworld.com/sunworldonline/swol-02-2000/swol-02-security.html?0306a
[3] Saveit  script: Original spanish version: saveit-sp.sh, my tweaked version: saveit (less verbose messages, fix for OpenBSD, english translations, if target exists save with a time postfix).
[4]  
[5] Tripwire:
Free version V1.2 ftp.cerias.purdue.edu/pub/tools/unix/ids/tripwire (last updated in 1994).
Commercial Version www.tripwiresecurity.com (starts at $495.-/server) also runs on NT.
OpenSource Version www.tripwire.org Linux only
Sunworld article sunworld.com/sunworldonline/swol-02-2000/swol-02-security.html?0306a
Samhain
samhain.sourceforge.net
[6]  Sample tools for analysing logs:
Logcheck www.psionic.com/abacus/logcheck (see also my improved version of logcheck.sh, a zip with my improvements and solaris binaries and a local copy of the original logcheck-1_1.tar.gz)
Swatch  ftp.stanford.edu/general/security-tools/swatch
[7] All About SSH PartI and Part II,
[7a] ftp.cs.hut.fi/pub/ssh
[8] Jail Chroot Project: New tool for creating chroot jails (sounds nice, but I've not yet tried it)
www.gsyc.inf.uc3m.es/~assman/jail/configuring/3.html 
[9]  
[10]  
[11]  
[12] Securing Apache and HTTPD servers
[13] Articles on hardening and chroot'ing BIND8 and 9: bind_hardening.html
BIND sources and home page: www.isc.org/products/BIND
Testing Domains: www.ip-plus.net/tools/dns_check_set_en.html
[14] Wietse Venema's tools and papers (tcp wrapper, rpcbind/portmapper, postfix, Satan, ....) ftp.porcupine.org/pub/security/index.html
[15]  
[16] Tools

Useful articles:

[17] syslog replacements:
syslog-ng www.balabit.hu/products/syslog-ng (tcp connections, content filtering, encryption, authentication)
secure syslog  www.core-sdi.com/english/slogging/ssyslog.html
Nsyslogd coombs.anu.edu.au/~avalon/nsyslog.html (tcp connections & SSL)
[18] Security Advisories: www.cert.org, www.first.orgwww.ciac.org
CERT provide several useful firewall/hardening/intrusion detection papers online www.cert.org/tech_tips.
Technical Discussion of advisories: www.SecurityFocus.com/sun
[19] Security Newsletters: SecurityFocus, SANS.
[20] IPfilter, IP Filter Based Firewalls HOWTO, Firewalling with IPF, Introduction to IP Filter
[21] Sun's Routing Support Document/FAQ is an old, but comprehensive overview of routing, how it works in Solaris and how to configure/debug routing.

Changes to this article

18.Aug.00 sb First version pulled from RH & Solaris Hardening notes, extended with Yassp info.
 Constant minor updates since then...


Seán Boran is an IT security consultant based in Switzerland and the author of the online IT Security Cookbook.

© Copyright 2001, Seán Boran, All Rights Reserved, Last Update: 08 Oktober, 2002