Ubuntu:Edgy ja/Security
From
Contents |
[edit]
Security
[edit]
What are the basic things I need to know about securing my Ubuntu
- #全体に共通する注意事項 を読んでください。
- Ensure hard drive is first in BIOS boot-up sequence
- To prevent trespassers from using Linux Installation CD which allows them to gain root user access
- To prevent trespassers from using Linux Live CD (e.g. UBUNTU/KNOPPIX/MEPIS) which allows them to destroy/browse/share the entire hard drive
- To prevent trespassers from installing another Operating System
- Ensure a password is set for BIOS
- To prevent trespassers from changing the BIOS boot-up sequence
- Ensure computer is located at a secured place
- To prevent trespassers from removing computer's hard drive which allows them to destroy/browse/share the entire hard drive from a different computer
- To prevent trespassers from removing computer's on-board battery which resets the BIOS password
- Ensure passwords used on the system cannot be easily guessed
- To prevent trespassers from cracking password file using brute force attacks (e.g. John the Ripper)
- Create password with minimum length of 8 characters
- Create password with mixture of characters/numbers, and upper/lower case
- Not create a password with just a single or just a typical union of main languages (english, german, french, spanish...) dictionary words
- Ensure interactive editing control for GRUB menu is disabled
- To prevent trespassers from modifying kernel boot-up arguments which allows them to have root user access
- #How to disable all interactive editing control for GRUB menu を読んでください。
- Ensure history listing is disabled in Console mode
- To prevent trespassers from seeing previously issued commands
- #How to disable history listing in Console mode を読んでください。
- Ensure Ctrl+Alt+Del is disabled in Console mode
- To prevent trespassers from restarting the system without permission in Console mode
- [[#How to disable Ctrl+Alt+Del from restarting computer in Console mode]] を読んでください。
- Ensure interactive option is set for remove, copy and move of files/folders in Console mode
- To prevent accidental removal/overwritten of files/folders
- #How to enable prompt before removal/overwritten of files/folders in Console mode を読んでください。
- For day to day usage, login as a normal user
- To prevent accidental deletion/modification of system files/folders
- #How to add/edit/delete system users を読んでください。
- Disable root user account, use "sudo" instead
- To reduce the amount of time spent with root privileges, and thus the risk of inadvertently executing a command as root
- "sudo" provides a more useful audit trail (/var/log/auth.log)
- #How to disable root user account を読んでください。
- Install a Firewall
- A firewall does not guarantee security but it is in most environments the first line of defense against network based attacks
- #How to install Firewall (Firestarter) を読んでください。
- Perform vulnerability test
- Nessus is a great tool designed to automate the testing and discovery of known security problems
- #How to install Vulnerability Scanner (Nessus) を読んでください。
[edit]
GRUBメニューのインタラクティブ編集機能をすべて無効にするには
- #全体に共通する注意事項を読んでください。
- 以下を実行してください。
grub-md5-crypt
Password: Retype password: $1$tumnZ1$xB/shuXs7MlawZXkLiBDV/
- 現在の設定ファイルをバックアップしてください。
sudo cp /boot/grub/menu.lst /boot/grub/menu.lst_backup gksudo gedit /boot/grub/menu.lst
- このセクションを見つけてください。
... ## password ['--md5'] passwd # If used in the first section of a menu file, disable all interactive editing # control (menu entry editor and command-line) and entries protected by the # command 'lock' # e.g. password topsecret # password --md5 $1$tumnZ1$xB/shuXs7MlawZXkLiBDV/ # password topsecret ...
- 以下を上記の後に追加してください。
password --md5 $1$tumnZ1$xB/shuXs7MlawZXkLiBDV/ (上記の暗号化されたパスワード)
- 以下に似たセクションを見つけてください('recovery mode'と'single'という言葉に注目してください)。
... title Ubuntu, kernel 2.6.10-5-386 (recovery mode) root (hd0,1) kernel /boot/vmlinuz-2.6.10-5-386 root=/dev/hda2 ro single initrd /boot/initrd.img-2.6.10-5-386 savedefault boot ...
- タイトル行とroot行の間にlock行を追加してください。
... title Ubuntu, kernel 2.6.10-5-386 (recovery mode) lock root (hd0,1) ...
- 編集したファイルを保存してください。
これでgrubコンソールで行編集する際にパスワードが必要になります。また、リカバリモードもパスワードを入力しない限り機能しません。メニューから他のgrubオプションにアクセスするには、画面の一番下の指示に従ってください。指示に従うと、pを押してパスワードを入力するといったことをします。
[edit]
コンソールのヒストリーリストを無効にするには
- #全体に共通する注意事項を読んでください。
- Gentoo Wikiより
rm -f .bash_history gedit ~/.bash_profile
- 以下を追加してください。
export HISTFILESIZE=4 unset HISTFILE=5
# Change this to a reasonable number of lines to save, I like to save only 100. export HISTSIZE=100
# Ignores duplicate lines next to each other export HISTCONTROL=ignoredups
これでそのユーザは~/.bash_historyが使えなくなります。キー入力ヒストリーは100行までに限り記憶され、呼び出して利用できます。また、隣接した重複行を記憶しません。
[edit]
コンソールで、Ctrl+Alt+Delでコンピュータが再起動するのを無効にするには
- #全体に共通する注意事項を読んでください。
sudo cp /etc/inittab /etc/inittab_backup gksudo gedit /etc/inittab
- 以下の行を探してください。
... ca:12345:ctrlaltdel:/sbin/shutdown -t1 -a -r now ...
- 以下と置き換えてください。
#ca:12345:ctrlaltdel:/sbin/shutdown -t1 -a -r now
- 編集したファイルを保存してください。
sudo telinit q
[edit]
コンソールでファイル/フォルダの削除/上書きの前に確認を促すには
- #全体に共通する注意事項を読んでください。
sudo cp /etc/bash.bashrc /etc/bash.bashrc_backup gksudo gedit /etc/bash.bashrc
- 以下をファイルの最後に追加してください。
alias rm='rm -i' alias cp='cp -i' alias mv='mv -i'
- 編集したファイルを保存してください。
[edit]
How to setup a LoJack system for your laptop
- #全体に共通する注意事項 を読んでください。
- #拡張リポジトリを追加するには を読んでください。
- #How to assign Hostname to local machine with dynamic IP using free DynDNS service を読んでください。
What: Quote from Wikipedia: "LoJack is an aftermarket vehicle tracking system that allows cars to be tracked by police after being stolen. The manufacturer claims a 90% recovery rate. The name "LoJack" is a play on the word "hijack," meaning the theft of a vehicle through force." Why: If your laptop is ever stolen and connected to the Internet. You will be able to find out from what IP it connects to the Internet from and contact the authorities. How:
- Get a free dynamic IP account from one of the many providers. Here we will use DynDNS.
- Install ddclient. In the section #How to assign Hostname to local machine with dynamic IP using free DynDNS service we installed the package ipcheck, here we prefer to use ddclient because it can get the IP from an external source on the Internet instead of getting it from a network adapter.
sudo apt-get install ddclient
- Edit the configuration file /etc/ddclient.conf using you fevorite text editor (emacs, gedit, kedit or even vi)
sudo emacs /etc/ddclient.conf
- Make it look like this:
# Configuration file for ddclient generated by debconf # # /etc/ddclient.conf pid=/var/run/ddclient.pid protocol=dyndns2 use=web server=members.dyndns.org login=YourNameHere password='YourPasswordHere' YourHostNameHere.gotmyip.com
- NOTE:
- * Make sure that you use the web IP detection method.
- * Specify your own user id instead of the place holder YourNameHere.
- * Specify your own password instead of the place holder YourPasswordHere, make sure to surround it with single quotes.
- * The last line should specify the hostname you registered with the dynamic IP service.
- You can now start the ddclient daemon, or wait until your next reboot.
sudo /etc/init.d/ddclient start
- The hostname you registered with your dynamic IP service should be updated. You can test it with the ping command:
ping YourHostNameHere.gotmyip.com
- Even if your laptop has a firewall that prevents pings the hostname should resolve to the IP of the network gateway that your laptop is connected to.
- Now all that is left is for someone to steal your laptop.....
References:
