<HTML
><HEAD
><TITLE
>Foreword</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+
"><LINK
REL="HOME"
TITLE="Security Quick-Start HOWTO for Linux"
HREF="index.html"><LINK
REL="PREVIOUS"
TITLE="Introduction"
HREF="intro.html"><LINK
REL="NEXT"
TITLE="Step 1: Which services do we really need?"
HREF="services.html"></HEAD
><BODY
CLASS="SECT1"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><DIV
CLASS="NAVHEADER"
><TABLE
SUMMARY="Header navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
>Security Quick-Start HOWTO for Linux</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="intro.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
></TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="services.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="FOREWORD">2. Foreword</H1
><P
> Before getting into specifics, let's try to briefly answer some questions
about why we need to be concerned about security in the first place. </P
><P
> It is easy to see why an e-commerce site, an on-line bank, or a government
agency with sensitive documents would be concerned about security. But what
about the average user? Why should even a Linux home Desktop user worry about
security? </P
><P
> Anyone connected to the Internet is a target, plain and simple. It
makes little difference whether you have a part-time dialup connection, or a
full-time connection, though full-time connections make for bigger targets.
Larger sites make for bigger targets too, but this does not let small users
off the hook since the <SPAN
CLASS="QUOTE"
>"small user"</SPAN
> may be less skilled and thus
an easier victim.
</P
><P
> There are those out there that are scanning just for easy
victims all the time. If you start logging unwanted connection attempts,
you will see this soon enough. There is little doubt that many of these
attempts are maliciously motivated and the attacker, in some cases, is
looking for Linux boxes to crack. Does someone on the other side of the globe
really want to borrow my printer? </P
><P
> What do they want? Often, they just may want your computer, your IP
address, and your bandwidth. Then they use you to either attack others, or
possibly commit crimes or mischief and are hiding their true identity behind
you. This is an all too common scenario. Commercial and high-profile sites
are targeted more directly and have bigger worries, but we all face this type
of common threat. </P
><P
> With a few reasonable precautions, Linux can be very
secure, and with all the available tools, makes for a fantastically fun and
powerful Internet connection or server. Most successful break-ins are the
result of ignorance or carelessness. </P
><P
> The bottom line is: </P
><P
> <P
></P
><UL
><LI
><P
> Do you want control of your own system or not?
</P
></LI
><LI
><P
> Do you want to unwittingly participate in criminal activity?
</P
></LI
><LI
><P
> Do you want to be used by someone else?
</P
></LI
><LI
><P
> Do you want to risk losing your Internet connection?
</P
></LI
><LI
><P
> Do you want to have to go through the time consuming steps of reclaiming
your system?
</P
></LI
><LI
><P
> Do you want to chance the loss of data on your system?
</P
></LI
></UL
></P
><P
> These are all real possibilities, unless we take the appropriate
precautions. </P
><DIV
CLASS="WARNING"
><P
></P
><TABLE
CLASS="WARNING"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="../images/warning.gif"
HSPACE="5"
ALT="Warning"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
> If you are reading this because you have already been broken into, or
suspect that you have, you cannot trust any of your system utilities to
provide reliable information. And the suggestions made in the next several
sections will not help you recover your system. Please jump straight to the
<A
HREF="intrusion.html#HACKED"
>Have I been Hacked?</A
> section, and read that
first.
</P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN161">2.1. The Optimum Configuration</H2
><P
> Ideally, we would want one computer as a dedicated firewall and router. This
would be a bare bones installation, with <EM
>no</EM
> servers
running, and only the required services and components installed. The rest of
our systems would connect via this dedicated router/firewall system. If we
wanted publicly accessible servers (web, mail, etc), these would be in a
<SPAN
CLASS="QUOTE"
>"DMZ"</SPAN
> (De-militarized Zone). The router/firewall allows
connections from outside to whatever services are running in the DMZ by
<SPAN
CLASS="QUOTE"
>"forwarding"</SPAN
> these requests, but it is segregated from the rest
of the internal network (aka LAN) otherwise. This leaves the rest of the
internal network in fairly secure isolation, and relative safety. The
<SPAN
CLASS="QUOTE"
>"danger zone"</SPAN
> is confined to the DMZ.
</P
><P
> But not everyone has the hardware to dedicate to this kind of installation.
This would require a minimum of two computers. Or three, if you would be
running any publicly available servers (not a good idea initially). Or maybe
you are just new to Linux, and don't know your way around well enough yet. So
if we can't do the ideal installation, we will do the next best thing. </P
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN169">2.2. Before We Start</H2
><P
> Before we get to the actual configuration sections, a couple of notes.
</P
><P
>
First, one of the interesting aspects of Linux, is the different
distributions like Caldera, Red Hat, SuSE, and Debian. While these are all
<SPAN
CLASS="QUOTE"
>"Linux"</SPAN
>, and may share certain features, there is surely some
differences as to what utilities they may install as defaults. Most Linux
distributions will write their own system configuration tools as well. And with
Linux, there is always more than one way to skin a cat. But for the purposes
of our discussion, we will have to use as generic set of tools as we can.
Unfortunately, GUI tools don't lend themselves to this type of documentation.
We will be using text based, command line tools for the most part. If you
are familiar with your distribution's utilities, feel free to substitute
those in appropriate places. And if not, you should learn them or suitable
alternatives. </P
><P
> The next several sections have been written such that you can perform the
recommended procedures as you read along. This is the
<SPAN
CLASS="QUOTE"
>"Quick Start"</SPAN
> in the document title!</P
><P
> To get ready, what you will need for the configuration sections below:</P
><P
> <P
></P
><UL
><LI
><P
> A text editor. There are many available. If you use a file manager
application , it probably has a built in editor.
This will be fine. <B
CLASS="COMMAND"
>pico</B
> and <B
CLASS="COMMAND"
>mcedit</B
>
are two relatively easy to use editors if you don't already have a
favorite. There is a quick guide to <A
HREF="appendix.html#TEXT"
>Text
editors</A
> in the Appendix that might help you get started. It is
always a good idea to make a back up copy, before editing system
configuration files.
</P
></LI
><LI
><P
> For non-GUI editors and some of the commands, you will also need a
terminal window opened. <B
CLASS="COMMAND"
>xterm,</B
>
<B
CLASS="COMMAND"
>rxvt,</B
> and <B
CLASS="COMMAND"
>gnome-terminal</B
> all will
work, as well as others.
</P
></LI
><LI
><P
> You should also be familiar with your distribution's method of stopping
services from running on each boot. Also, how they install (and uninstall)
packages (<B
CLASS="COMMAND"
>rpm</B
>, <B
CLASS="COMMAND"
>deb</B
>, etc). And where
to find the updates for your release. This information is available in
your release's documentation, or on your vendor's web site.
</P
></LI
></UL
></P
><P
> We'll be using a hypothetical system here for examples with the hostname
<SPAN
CLASS="QUOTE"
>"bigcat"</SPAN
>. Bigcat is a Linux desktop with a fresh install of the
latest/greatest Linux distro running. Bigcat has a full-time, direct Internet connection. Even if your
installation is not so <SPAN
CLASS="QUOTE"
>"fresh"</SPAN
>, don't be deterred. Better late
than never. </P
></DIV
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="intro.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="index.html"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="services.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Introduction</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
> </TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Step 1: Which services do we really need?</TD
></TR
></TABLE
></DIV
></BODY
></HTML
>
