Post on 12-Apr-2018
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 1/282
Dermongnk
oj Fgnux
Yenmrl Jofl
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 2/282
E RNX ’ Romo Neiglnef mo Onsgnl
o Xosqugse ’ ç quefgcgieme iljl
uje Lrkengzeëél Yligef (LY),
sonml fgkeme el Jgngstçrgl me
Igànige, ]oinlflkge o Gnlveëél
( JI ] G ) o ros plns å v o f po f l
Xrlkreje Gntorjgngstorgef RNX,
quo ilnte ilj e pertgigpeëél mls
jgngstçrgls me Omuieëél (JOI), me
Yeðmo (JY) o me Iufture (JgnI).
Xglnogre nl eiossl è Gntornot nl
Bresgf, e RNX pfeno`e o jentçj eromo Gpà, e romo ùptgie neiglnef
eiemàjgie mo eftl mosojpondl.
Ilj Xlntls mo Xrosonëe nes
2; ungmemos me comoreëél, e romo
toj jegs mo 488 gnstgtugëÿos
ilnoitemes. Yél eprlxgjemejonto
9,? jgfdÿos mo usuårgls usucrugnml
mo uje gncreostruture mo romosevenëemes pere iljungieëél,
iljputeëél o oxporgjonteëél,
quo ilntrgbug pere e gntokreëél
ontro l sgstoje mo Igànige o
]oinlflkge, Omuieëél Yuporglr,
Yeðmo o Iufture.
Igànige, ]oinlflkgeo Gnlveëél
Jgngstçrgl me
OmuieëélJgngstçrgl me
YeðmoJgngstçrgl me
IuftureJgngstçrgl me
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 3/282
Dermongnkoj Fgnux
Yenmrl Jofl
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 4/282
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 5/282
Dermongnkoj Fgnux
Yenmrl Jofl
Rgl mo @enogrl
Osilfe Yuporglr mo Romos
285=
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 6/282
Ilpyrgkdt © 285= ’ Romo Neiglnef mo Onsgnl o Xosqugse ’ RNX
Rue Feurl Jöffor, 553 sefe 5589
22278-783 Rgl mo @enogrl, R@
Mgrotlr Koref Nofsln Ygjÿos
Mgrotlr mo Yorvgëls o Ylfuëÿos @lsç Fugz Rgbogrl Cgfdl
Osilfe Yuporglr mo Romos
Illrmoneëél
Fugz Ilofdl
Omgëél
Fgnilfn me Jete
Rovgsél tçingie
Omsln Alwesa o [onmof Yleros
Oqugpo OYR (oj lrmoj efcebçtgie)
Emrgene Xgorrl, Iofge Jeigof, Irgstgeno Lfgvogre, Morfgnçe Jgrenme, Ofgjårge Berblse,Ovoffyn Cogtlse, Cofgpo Nesigjontl, Flurmos Ylnign, Fuigene Betgste, Fugz Ierfls Flbetl ,Ronetl Muerto o Wvo Jerigef.
Iepe, prl`otl vgsuef o mgekrejeëél
]oinlmosgkn
Sorsél
5.8.8
Osto jetorgef mgmåtgil clg ofeblreml ilj ns omuieiglnegs. Ylfgigtejls quo quefquor orrl oniln-
treml lu mðvgme ilj rofeëél el jetorgef lu sou usl so`e onvgeml pere e oqugpo mo ofeblreëél mo
ilntoðml me Osilfe Yuporglr mo Romos, nl o-jegf gnclHosr.rnp.br. E Romo Neiglnef mo Onsgnl oXosqugse o ls eutlros nél essujoj quefquor rosplnsebgfgmemo plr ovontuegs menls lu pormes, e
possles lu bons, lrgkgnemls ml usl mosto jetorgef. Es jeries rokgstremes joniglnemes nosto jetorgef portonioj els rospoitgvls tgtuferos.
Mgstrgbugëél
Osilfe Yuporglr mo Romos Rue Feurl Jöffor, 553 ’ sefe 5589
22278-783 Rgl mo @enogrl, R@
dttp0//osr.rnp.br gnclHosr.rnp.br
Memls Gntorneiglnegs mo Ieteflkeëél ne Xubfgieëél (IGX)
J?24d Jofl, Yenmrl. Dermongnk oj Fgnux / Yenmrl Jofl. ’ Rgl mo @enogrl0 RNX/OYR, 285=.
2;4 p. 0 gf. 1 2;,? ij.
Bgbfglkree0 p.239.
GYBN 7;4-4?-39398-2;-4
5. Yokurenëe mo Iljputemlros (Emjgngstreëél). 2. Fgnux (Ylctwero). 9. Yokurenëe mo slctwero. G. ]gtufl.
IMM 88?.234
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 7/282
ggg
Yujårgl
Osilfe Yuporglr mo Romos
E jotlmlflkge me OYR gx
Ylbro l iursl x
E quoj so mostgne x
Ilnvonëÿos utgfgzemes nosto fgvrl x
Xorjgssÿos mo usl xg
Ylbro l eutlr xgg
5. Dermongnk oj sgstoje Fgnux ’ pùs-gnstefeëél
Oxoriêigl mo ngvofejontl 5 ’ Gntrlmuëél mo dermongnk 2
L quo ç dermongnk 2
Oxoriêigl mo xeëél 5 ’ Sufnorebgfgmemos ?
Xùs-gnstefeëél 3
Oxoriêigl mo xeëél 2 ’ Xeiltos gnstefemls ;
Etuefgzeëÿos mo sokurenëe vge Mobsoien 4
Erqugvls ilj porjgssél mo Yugm bgt 58
Roiljonmeëÿos o bles pråtgies 58
Rojlëél mo Yugm bgt 58
Yokurenëe nl sgstoje mo erqugvls 52
Oxoriêigl mo xeëél 2 ’ Xertgiglnejontl 52
Oxoiuëél ml prliomgjontl 52
Yokurenëe nl torjgnef 54
Mosebgfgter l usl mo —I]RF+EF]+MOF‗ 54
Oxoriêigl mo xeëél 2 ’ —I]RF+EF]+MOF‗ 57
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 8/282
gv
Fgjgter l usl mls torjgnegs toxtl 57
Bflquoer l torjgnef ilj e ver gåvof ]JL_] 28
Koronigejontl mo prgvgfçkgls 25
Bflquoer l flkgn ml rllt nls torjgnegs toxtl 25
Motorjgner metes mo oxpgreëél pere ilntes mo usuårgls 22
Rojlvor sdoffs våfgmes mo usuårgls quo nél proigsej mofes 29Gnstefeëél mo peiltos ospoiêils 2=
Yokurenëe ml Krub 2?
Debgfgter sonde nes vorsÿos entgkes ml Krub (vorsÿos 5 o 2) 23
Rltogrl mo Etgvgmemos 5 2;
Etgvgmemo 5.5 ’ Dermongnk F gnux ’ Eptgirln 2;
Etgvgmemo 5.2 ’ Dermongnk Fgnux ’ Mobsoien 2;
Etgvgmemo 5.9 ’ Dermongnk Fgnux ’ Mobsoien v ge irln 24
Etgvgmemo 5.= ’ Dermongnk Fgnux ’ etuefgzeëél 24
Etgvgmemo 5.? ’ Dermongnk Fgnux ’ peiltos mosnoiossårgls 24
Etgvgmemo 5.3 ’ Dermongnk Fgnux ’ vflia 27
Etgvgmemo 5.; ’ Dermongnk Fgnux ’ rokres mo jlntekoj 27
Etgvgmemo 5.4 ’ Dermongnk Fgnux ’ Idarlltagt raduntor 27
Etgvgmemo 5.7 ’ Dermongnk Fgnux ’ Besofgno 98
2. Dermongnk oj sgstoje Fgnux ’ ilntrlfos mo sokurenëe pere ilntes mo usuårgls
Gntrlmuëél 95
Oxoriêigl mo ngvofejontl 5 ’ Ilntrlfos mo sokurenëe pere usuårgls 92
Ilntrlfos mo eutontgieëél ilj e utgfgzeëél ml XEJ 92
Ygnefgzemlros mo ilntrlfo 99
Iejgndl ml jùmufl 99
Oxoriêigl mo xeëél 5 ’ XEJ 93
Xrliure plr sondes creies 9;
_tgfgzeëél ml @ldn tdo Rgppor 9;
_tgfgzeëél mo qulte 94
Oxoriêigl mo xeëél 2 ’ Uulte =8
_tgfgzeëél mo EIF ’ Xlsgx 5o =5
Debgfgteëél ml suplrto el roiursl mo EIF =9
Iljenml mo emjgngstreëél mo EIF =9
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 9/282
v
Iljenml ‖suml‚ (Yupor _sor Ml ’ cezor iljl supor usuårgl) ==
Xrovonëél —Osiepo Ydoff‗ =3
Mues clrjes mo mosebgfgter ‖Osiepo Ydoff‚ =;
Rltogrl mo Etgvgmemos 2 =7
Etgvgmemo 5 ’ XEJ =7
Etgvgmemo 2 ’ Xrliure plr sondes creies ?8
Etgvgmemo 9 ’ Uultes ?8
Etgvgmemo = ’ EIF ?5
Etgvgmemo ? ’ Iljenml —suml‗ ?9
9. Dermongnk oj sgstoje Fgnux ’ Rokgstrl mo ovontls (flk) o DGMY
Oxoriêigl mo ngvofejontl 5 ’ Rokgstrl mo ovontls (flk) o DGMY ?;
]rgfde mo iljenmls ?4
]rgfde mo iljenml ?4
Rokgstrl mo ovontls ’ Flks ml sgstoje 38
Ilnclrjgmemo ilj es roiljonmeëÿos 38
Bles pråtgies pere erqugvls mo flk 35
Flks ml sgstoje 32
Yysflk-NK 39
Roiursls (ceigfgty) 39
Nêvof mo rokgstrl (prglrgmemo) 39
Yorvgmlr Yysflk iontrefgzeml ;5
Iljenml —flkkor‗ ;5
Ostruture mo Yorvgmlr o Ifgonto ;2
Ilnkureëél ml sorvgmlr mo flks ;2
Ilnkureëél ml ifgonto ;=
Ilnkureëél ml Y]_NNOF ;?
Mongëél me plfêtgie mo rlteiglnejontl mo flks ;3
Yorvgmlr N]X ;4
Ilntebgfgzeëél mo prliossls ;7
Eumgtlrge ilj DGMY 48
Rltogrl mo Etgvgmemos 9 49
Etgvgmemo 9.5 ’ Dermongnk Fgnux ’ Rokgstrl mo ovontls (flks) 49
Etgvgmemo 9.2 ’ Eumgtlrge DGMY 4=
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 10/282
vg
=. Yorvgëls mo Romos ’ Xerto 5
Idoiafgst nls sorv gëls ml sgstoje 4;
Oxoriêigl mo xeëél 5 ’ Idoiafgst mo Romo 72
Koronigejontl mo sorvgëls mo romos oj Gnotm o Tgnotm 7=
Yokurenëe oj sorvgëls mo romos 73
Cgnkorprgnt mo sorvgël 7;
Oxoriêigl mo xeëél 5 ’ Foventejontl mo gnclrjeëél o Clrëe Brute 582
Dermongnk ml sorvgël YYD 582
Jgtgkeëél mo etequo mo Clrëe Brute 583
Rltogrl mo Etgvgmemos = 587
Etgvgmemo =.5 ’ # sorvgio cegf2ben rostert 587
?. Yorvgëls mo Romos ’ Xerto 2
Dermongnk 555
Rojlëél mo jùmufls nél utgfgzemls 55?
Liuftenml e vorsél ml sorvgmlr 553
Dermongnk ml sorvgël MNY/BGNM 525
XY-[etidor0 Jlngtlreëél mo sorvgëls etgvls 52;
Rltogrl mo Etgvgmemos ? 527
Etgvgmemo ?.5 ’ Ygstojes mo motoiëél mo gntrusÿos (GMY) oj romos [FEN 527
3. Dermongnk oj sgstoje Fgnux ’ Xrlxy [ob
Gntrlmuëél 595
Oxoriêigl mo ngvofejontl 5 ’ Xrlxy wob 595
Gjpfojonteëél mo uj Xrlxy [ob ilj Yqugm ’ Gnstefeëél o Ilnkureëél ml Xrlxy Ieido 599
Irgeëél mo EIFs 597
Oxoriêigl mo Cgxeëél ’ Xrlxy wob 5=5
EIF ]gjo ’ Rokres tojplrergzemes 5=5
Rltogrl mo Etgvgmemos 3 5=;
Etgvgmemo 3.5 ’ Dermongnk Fgnux ’ Xrlxy wob ’ Yqugm 5=;
;. Cgroweff ’ Xerto 5
Gntrlmuëél 5=7
Erqugtoture mo roweff 5?8
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 11/282
vgg
Cunmejontls pere l GXtebfos 5??
]rebefdenml ilj GXtebfos 5?3
]ebofes 5?4
Fgstenml (-F) es rokres oj tebofes o idegns 538
Xrlplste mo rokres 53=
Rltogrl mo Etgvgmemos ; 545
Etgvgmemo ;.5 ’ Dermongnk Fgnux ’ Cgroweff Fgnux 545
4. Yokurenëe mo Xorêjotrl ’ Xerto 2
Oxoriêigl mo ngvofejontl 5 ’ C groweffs 549
Rokres mo ilntrlfo 54=
Ilnstrugnml uj sirgpt mo roweff 572
]rebefdenml ilj tremuëél mo onmoroëejontl GX 288
]rebefdenml ilj romgroiglnejontl mo plr tes 282
_senml e ]ebofe Jenkfo 28=
Enefgsenml l ilntoðml mls metekrejes 28;
Xlrt Anliagnk ’ Ilniogtl o pråtgie 284
Rltogrl mo Etgvgmemos 4 255
Etgvgmemo 4.5 ’ Dermongnk Fgnux ’ Cgroweff Fgnux 255
7. ]ungnk mo Aornof
]ungnk mo Aornof 25?
]ungnk ]IX 253
]ungnk GIJX 222
Mongml rosplste e Xgnk 222
]ungnk GX 22?
Debgfgtenml ropesso mo Xeiltos (GX\CLR[ERM) 22?
Yokurenëe mo Aornof ’ Yokurenëe ne ðftgje crlntogre 295
Mongëél mo åroe ml usuårgl 292
Mongëél mo iejeme mo Aornof 292
_tgfgzeëél ml jùmufl Weje 299
]ljlyl 29=
Ilnkureëél o emjgngstreëél ml ]ljlyl 29?
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 12/282
vggg
Rltogrl mo Etgvgmemos 7 2=5
Etgvgmemo 7.5 ’ Dermongnk Fgnux ’ ]ungnk mo Aornof 2=5
58.Eumgtlrge ne iejeme mo Aornof
Oxoriêigl mo ngvofejontl 5 ’ Eumgtlrge ne iejeme mo Aornof 2=9
Eumgtlrge ne iejeme mo Aornof 2=9
Rltogrl mo Etgvgmemos 58 239
Etgvgmemo 58.5 ’ Dermongnk oj Ygstoje Fgnux 239
Etgvgmemo 58.2 ’ Dermongnk Fgnux ’ Rokgstrl mo Ovontls (flks) o Eumgtlrge 239
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 13/282
gx
E Osilfe Yuporglr mo Romos (OYR) ç e ungmemo me Romo Neiglnef mo Onsgnl o Xosqugse (RNX)
rosplnsåvof pofe mgssojgneëél ml ilndoigjontl oj ]oinlflkges me Gnclrjeëél o Iljungie-
ëél (]GI). E OYR nesio ilj e prlplste mo sor e clrjemlre o mgssojgnemlre mo iljpotàniges
oj ]GI pere l ilrpl tçingil-emjgngstretgvl mes ungvorsgmemos comoregs, osilfes tçingies o
ungmemos comoregs mo posqugse. Yue jgssél cunmejontef ç roefgzer e iepeigteëél tçingie mlilrpl cuniglnef mes lrkengzeëÿos usuårges me RNX, pere l oxoriêigl mo iljpotàniges epfgiå -
vogs el usl oiez o oigonto mes ]GI.
E OYR lcoroio mozones mo iursls mgstrgbuêmls nes åroes tojåtgies0 Emjgngstreëél o Xrl`otl
mo Romos, Emjgngstreëél mo Ygstojes, Yokurenëe, Jêmges mo Yuplrto è Ilfeblreëél Mgkgtef o
Klvornenëe mo ]G.
E OYR tejbçj pertgigpe mo mgvorsls prl`otls mo gntorosso pðbfgil, iljl e ofeblreëél o
oxoiuëél mo pfenls mo iepeigteëél pere clrjeëél mo juftgpfgiemlros pere prl`otls omu-
ieiglnegs iljl0 clrjeëél nl usl me ilncorànige wob pere e _ngvorsgmemo Eborte ml Bresgf
(_EB), clrjeëél ml suplrto tçingil mo feblretùrgls ml Xrlgncl o irgeëél mo uj iln`untl mo
iertgfdes slbro romos soj l pere l prlkreje _j Iljputemlr plr Efunl (_IE).
E jotlmlflkge me OYR
E flsle pomekùkgie o e jotlmlflkge quo lrgontej ls iursls me OYR sél besoemes ne
epronmgzekoj iljl ilnstruëél ml ilndoigjontl plr jogl me roslfuëél mo prlbfojes têpg -
ils me roefgmemo ml prlssglnef oj clrjeëél. Ls rosuftemls lbtgmls nls iursls mo neturoze
toùrgil-pråtgie sél ltgjgzemls, plgs l gnstrutlr, euxgfgeml pofl jetorgef mgmåtgil, etue nél
epones iljl oxplsgtlr mo ilniogtls o gnclrjeëÿos, jes prgnigpefjonto iljl lrgontemlr ml
efunl ne oxoiuëél mo etgvgmemos ilntoxtuefgzemes nes sgtueëÿos ml iltgmgenl prlssglnef.
E epronmgzekoj ç ontonmgme iljl e rosplste ml efunl el mosel mo sgtueëÿos-prlbfojesojofdentos ès onilntremes ne pråtgie prlssglnef, quo sél suporemes plr jogl mo enåfgso,
sêntoso, `ufkejontl, ponsejontl irêtgil o ilnstruëél mo dgpùtosos pere e roslfuëél ml prl-
bfoje, oj eblrmekoj lrgonteme el mosonvlfvgjontl mo iljpotàniges.
Mosse clrje, l gnstrutlr toj pertgigpeëél etgve o mgefùkgie iljl lrgontemlr ml efunl pere es
etgvgmemos oj feblretùrgl. Etç josjl e eprosonteëél me tolrge nl gnêigl me sossél mo epron -
mgzekoj nél ç ilnsgmoreme uje sgjpfos oxplsgëél mo ilniogtls o gnclrjeëÿos. L gnstrutlr
busie gniontgver e pertgigpeëél mls efunls ilntgnuejonto.
Osilfe Yuporglr mo Romos
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 14/282
x
Es sossÿos mo epronmgzekoj lnmo so mél e eprosonteëél mls ilntoðmls o e roefgzeëél mes
etgvgmemos pråtgies tàj clrjetl prosonigef o ossonigefjonto pråtgil, utgfgzenml tçingies mo
ostuml mgrgkgml gnmgvgmuef, trebefdl oj oqugpo o pråtgies lrgontemes pere l ilntoxtl mo etue-
ëél ml cuturl ospoigefgste quo so protonmo clrjer.
Es sossÿos mo epronmgzekoj mosonvlfvoj-so oj tràs otepes, ilj promljgnânige mo tojpl
pere es etgvgmemos pråtgies, ilnclrjo mosirgëél e sokugr0
Xrgjogre otepe0 eprosonteëél me tolrge o osiferoigjontl mo mðvgmes (mo 38 e 78 jgnutls).
L gnstrutlr eprosonte, mo jenogre sgntçtgie, ls ilniogtls toùrgils ilrrosplnmontos el toje
me sossél mo epronmgzekoj, ilj euxêfgl mo sfgmos oj clrjetl XlworXlgnt. L gnstrutlr fovente
quostÿos slbro l ilntoðml mls sfgmos oj voz mo epones eprosontå-fls, ilnvgmenml e turje
è rooxél o pertgigpeëél. Gssl ovgte quo es eprosonteëÿos so`ej jlnùtlnes o quo l efunl so
ilflquo oj plsgëél mo pessgvgmemo, l quo romuzgrge e epronmgzekoj.
Yokunme otepe0 etgvgmemos pråtgies mo epronmgzekoj (mo 528 e 5?8 jgnutls).
Oste otepe ç e ossànige mls iursls me OYR. E jeglrge mes etgvgmemos mls iursls ç essênirlne o
roefgzeme oj mupfes mo efunls, quo eiljpendej l rgtjl ml rltogrl mo etgvgmemos prlplstl nl
fgvrl mo eplgl. Gnstrutlr o jlngtlr igriufej ontro es mupfes pere slfuiglner mðvgmes o lcoroior
oxpfgieëÿos iljpfojonteros.
]oriogre otepe0 mgsiussél mes etgvgmemos roefgzemes (98 jgnutls).
L gnstrutlr iljonte ieme etgvgmemo, eprosontenml uje mes slfuëÿos plssêvogs pere roslfvà-fe,
movonml etor-so èquofes quo korej jeglr mgiufmemo o plfàjgie. Ls efunls sél ilnvgmemls e
iljonter es slfuëÿos onilntremes o l gnstrutlr rotlje tùpgils quo tondej koreml mðvgmes,
ostgjufenml e pertgigpeëél mls efunls. L gnstrutlr sojpro ostgjufe ls efunls e onilntreroj
slfuëÿos eftornetgves ès sukorgmes plr ofo o pofls ilfokes o, iesl oxgstej, e iljontå-fes.
Ylbro l iursl
L iursl ilnsgsto ne enåfgso mo ejoeëes, jgngjgzeëél mo rgsils o oxoiuëél mo etgvgmemosilrrotgves mes vufnorebgfgmemos gmontgiemes oj sorvgmlros ne pfeteclrje Fgnux.
Eprosonte ls ilniogtls toùrgils o etrevçs mo etgvgmemos pråtgies e j mo roclrëer o kerentgr
e sokurenëe mo sorvgmlros Fgnux pere es jegs mgvorses epfgieëÿos. Yorél eprosontemes
mgvorses tçingies, prliomgjontls o correjontes pere quo ls sor vgmlros Fgnux tondej
e sokurenëe mo sous sorvgëls ofoveme. Ls essuntls tretemls plssgbgfgterél jofdlrge me
sokurenëe mo sorv gmlros ilnsgmorenml l jlmofl MEI iljl tejbçj ml jlmofl JEI, plgs
sorél roefgzemls prliomgjontls mo sokurenëe ilj correjontes nl ilntoxtl me usorfenm o
tejbçj roiursls mo sokurenëe mo Aornof.
E quoj so mostgne
Osto iursl ç mostgneml è emjgngstremlros mo romos o mo sorvgmlros Fgnux gntorossemls oj
prltokor sues romos o roefgzer e`ustos motefdemls (tunngnk) oj sous sorvgmlros wob, etrevçs
me gjpfojonteëél mo jùmufls mo sokurenëe o [ob Eppfgietgln Cgroweff ([EC).
Ilnvonëÿos utgfgzemes nosto fgvrl
Es sokugntos ilnvonëÿos tgplkråies sél usemes nosto fgvrl0
Gtåfgil
Gnmgie nljos mo erqugvls o rocoràniges bgbfglkråies rofeiglnemes el flnkl ml toxtl.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 15/282
xg
Ferkure ilnstento
Gnmgie iljenmls o sues lpëÿos, vergåvogs o etrgbutls, ilntoðml mo erqugvls o rosufteml me seême
mo iljenmls. Iljenmls quo sorél mgkgtemls pofl usuårgl sél krgcemls oj nokrgtl o plssuoj
l proxl ml ejbgonto oj usl (nl Fgnux ç nlrjefjonto # lu $, onquentl nl [gnmlws ç I0V).
Ilntoðml mo sfgmo
qGnmgie l ilntoðml mls sfgmos rocorontos el iursl eprosontemls oj sefe mo eufe.
Yêjblfl wGnmgie rocorànige iljpfojonter mgsplnêvof oj sgto lu påkgne ne gntornot.
Yêjblfl m Gnmgie uj mliujontl iljl rocorànige iljpfojonter.
Yêjblfl v Gnmgie uj vêmol iljl rocorànige iljpfojonter.
Yêjblfl s Gnmgie uj erqugvl mo eðmgl iljl rocorànige iljpfojonter.
Yêjblfl ! Gnmgie uj evgsl lu proieuëél e sor ilnsgmoreme.
Yêjblfl p Gnmgie quostglnejontls quo ostgjufej e rooxél lu eprosonte ilntoðml mo eplgl el
ontonmgjontl ml toje oj quostél.
Yêjblfl f Gnmgie nltes o gnclrjeëÿos iljpfojonteros iljl mgies, sukostÿos mo fogture emgiglnef lu
josjl uje lbsorveëél.
Xorjgssÿos mo usl
]lmls ls mgrogtls rosorvemls è RNX.
Ekremoiojls sojpro igter oste clnto quenml gnifugr perto mosto fgvrl oj lutre lbre.
Oxojpfl mo igteëél0 ]LRROY, Xomrl ot ef. Emjgngstreëél mo Ygstojes Fgnux0 Romos o Yokurenëe.
Rgl mo @enogrl0 Osilfe Yuporglr mo Romos, RNX, 2859.
Iljontårgls o porkuntesXere onvger iljontårgls o porkuntes slbro oste pubfgieëél0
Osilfe Yuporglr mo Romos RNX
Onmoroël0 Ev. Feurl Jöffor 553 sefe 5589 ’ Blteclkl
Rgl mo @enogrl ’ R@ ’ 22278-783
O-jegf0 gnclHosr.rnp.br
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 16/282
xgg
Ylbro l eutlr
Yenmrl Jofl Ç mlutlrenml nl ]GMM-X_I/YX, Jostro oj Onkonderge me Iljputeëél nl
GX]/_YX, Jostro oj Onkonderge mo Romos pofl GX]/_YX1 Xùs-kremueml oj Emjgngstreëél
mo Romos Fgnux pofe _CFE-JK1 Xùs-kremueml oj Enåfgso mo Ygstojes o Kremueëél oj
Xrliossejontl mo Memls pofe _ngvorsgmemo Jeiaonzgo, etue ne åroe mo ]G mosmo mo 577;,
roefgzenml nosto porêlml vårgls prl`otls mo gjpfenteëél mo sorvgëls mo romo o sokurenëe.
Etuefjonto etue iljl Illrmonemlr ml Iursl mo Romos mo Iljputemlros ne BENM]OI
rosplnsåvof pofe iemogre mo Ygstojes Lporeiglnegs, Iljputeëél Mgstrgbuême o Iontrefgzeme
o Yokurenëe o Eumgtlrge. Ç uj ovenkofgste ml Ylctwero Fgvro, sonml ojbegxemlr Comlre,
Xrlitlr BYME o FXG, tejbçj etue iljl prlcosslr ilnvgmeml rosplnsåvof plr iåtomres
gnorontos e Yokurenëe o Iljputeëél Clronso oj sgstoje Fgnux, `å tonml e lplrtungmemo
mo etuer ne _CFE/ERF (JK), GB]E (Iejpgnes), _NGYEFOY (OY), Ceiufmemo Xgtåklres (Kuere-
perg-OY, ]ogxogre mo Crogtes-BE), _ngvorsgmemo Xltgkuer (RN), G]E (YX), GOE YEJ (XE), _ngrln
(RL), CEER(RL), CEIGM (XG) ontro lutres. Yonml gmoefgzemlr o illrmonemlr mls iursls mo
Xùs Kremueëél Yokurenëe o Iljputeëél Clronso nes ontgmemos0 _ngvorsgmemo Jeurêigl mo
Nesseu (EF) , Ceiufmemo CEIGM (XG), Ceiufmemo IO](XG), Ceiufmemo Etuef (RR), Gquefg/OOOJBE
(BE)1 Gnstrutlr eutlrgzeml CrooBYMBresgf o ilnvgmeml me Eiemojge Ifevgs.
Omsln Alwesa Bozorre ç prlssglnef me åroe mo sokurenëe me gnclrjeëél o klvornenëe
då jegs mo qugnzo enls, etuenml iljl eumgtlr fêmor, posqugsemlr, koronto mo prl`otl o
koronto tçingil, oj gnðjorls prl`otls mo kostél mo rgsils, kostél mo sokurenëe me gnclrje -
ëél, ilntgnugmemo mo nokùigls, XIG, eumgtlrge o roiuporeëél mo mosestros oj ojproses mo
krenmo plrto ml sotlr mo tofoiljungieëÿos, neniogrl, onorkge, gnmðstrge o klvornl. Ilj
veste oxporgànige nls tojes mo sokurenëe o klvornenëe, toj etueml tejbçj iljl pefos-
trento nls prgnigpegs ovontls ml Bresgf o egnme iljl gnstrutlr mo trognejontls cliemls oj
sokurenëe o klvornenëe. Ç prlcosslr o illrmonemlr mo iursls mo pùs-kremueëél ne åroe mo
sokurenëe me gnclrjeëél, kostél gntokreme, mo gnlveëél o toinlflkges wob. Dl`o etue iljl
Illrmonemlr Eiemàjgil mo Yokurenëe o Klvornenëe mo ]G me Osilfe Yuporglr mo Romos.
[onmof Yleros ç clrjeml oj Yokurenëe me Gnclrjeëél pofe Ceiufmemo Rlkeiglngste o
ospoigefgste oj romos mo iljputemlros. Clg plr lgtl enls emjgngstremlr mo romos ml Jgngs-
tçrgl me Mocose Oxçrigtl Bresgfogrl, trebefdenml ilj romos mo sokurenëe mo ]G. Ilfeblremlr
me Osilfe Yuporglr mo Romos mosmo 2884, tonml foiglneml iursls mo Fgnux o Yokurenëe mo
Romos. Etuefjonto trebefde iljl Ospoigefgste mo romos pere uje Juftgneiglnef Ejorgiene.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 17/282
5
I e p ê t u f l
5 - D e r m o n g n k o j s
g s t o j e F g n u x ’ X ù s - g n s t e f e ë é l
l b ` o t g v l s
i l n i o g t l s
5Dermongnk oj sgstoje Fgnux ’pùs-gnstefeëél
Rovor ilniogtls rofeiglnemls è sokurenëe1 Iljproonmor ilniogtls gjplrtentos
slbro dermongnk oj Fgnux1 Evefger uj Besofgno1 Roefgzer prliomgjontls mo
gnstefeëél mgcoronigemls.
Ilniogtls mo Yokurenëe1 Ilniogtls mo dermongnk1 Besofgno1 Xrlplste mo
prliomgjontls epùs e gnstefeëél.
L ilreëél ml sgstoje Fgnux ç l sou aornof o tejbçj sou Ygstoje Lporeiglnef. Iljbgnemls,
ofos clrjej e beso lnmo ostél tlmes es sues epfgieëÿos quo rlmej nl iljputemlr. Iljpe-
retgvejonto cefenml, l Ygstoje Lporeiglnef Fgnux o sou aornof sél rezlevofjonto sokurls.
_j krenmo nðjorl mo lpëÿos mo sokurenëe ostél gnifuses nl aornof o uje krenmo vergo-memo mo correjontes o ilnkureëÿos mo sokurenëe lpon-slurio `å ostél gnifuses nes jegs
vergemes mgstrgbugëÿos. Emgiglnefjonto, l Fgnux lcoroio oxiopiglnef ilntrlfo slbro quoj,
iljl o quegs roiursls o epfgieëÿos ls usuårgls plmoj tor eiossl. Ontél, lnmo ostå l rgsil<
Nlrjefjonto, ‖l prlbfoje ostå nls motefdos‚. E sokurenëe ml sgstoje moponmo mo uje
onlrjo quentgmemo mo ofojontls mo ilnkureëél oj nêvof, tentl mo Ygstoje Lporeiglnef
quentl mo epfgieëÿos. L prùprgl Ygstoje Lporeiglnef o sou aornof sél bestento iljpfoxls,
o sue ilrrote ilnkureëél nél ç uj prliossl trgvgef. Ygstojes Lporeiglnegs besoemls nl
aornof Fgnux plssuoj gnngtes ilnkureëÿos, o ieme e`usto plmo ieuser sçr gls prlbfojes
mo sokurenëe. Sufnorebgfgmemos o cefdes mo sokurenëe nél sél cåiogs mo onilntrer.
Xere oster eptl pere nujorer ossos plntls, proigsejls emqugrgr sùfgmls ilndoigjontlsslbro ls roqugsgtls båsgils mo sokurenëe ml nlssl Ygstoje Lporeiglnef o sou nðifol.
Dermongnk oj Fgnux ç uj prliossl mo prltoëél ml Ygstoje Lporeiglnef, sou aornof o sues
epfgieëÿos ilntre ejoeëes ilndoigmes lu nél etrevçs me epfgieëél mo tçingies ospoiêies
mo ilntrlfo, jgngjgzeëél mo rgsils o oxoiuëél mo etgvgmemos ilrrotgves.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 18/282
2
D e r m o n g n k o j F
g n u x
Oxoriêigl mo ngvofejontl 5o Gntrlmuëél mo dermongnk
Iljl ç plssêvof poriobor e noiossgmemo mo sokurenëe nls sorvgëls o nes jåqugnes sorvg-
mlres mo uje lrkengzeëél<
Oxoiuto uj clra etteia iljl usuårgl iljuj nl sdoff me jåqugne vgrtuef o evefgo e pertgr ml
rosufteml l quentl uje gnstefeëél pemrél mo Fgnux ç sokure.
Clra Etteia0 0(){ 0|0& }10
L quo ç dermongnk
qÇ e prltoëél ml sgstoje plr jogl me romuëél mo sues plssêvogs vufnorebgfgmemos.
Movojls0
5 Ilnkurer l sgstoje.
5 Gnstefer peiltos mostgnemls e efkuj prliomgjontl mo sokurenëe.
5 Jlmgier l porjgssglnejontl pere jofdlrer o roclrëer e sokurenëe.
Mo eilrml ilj e [gagpomge, ‖dermongnk ç uj prliossl mo jepoejontl mes ejoeëes, jgtg-
keëél mls rgsils o oxoiuëél mes etgvgmemos ilrrotgves ’ ilj clil ne gncreostruture o ilj l
lb`otgvl prgnigpef mo tlrnå-fe propereme pere oncronter tontetgves mo etequo‚.
@å sokunml e G]Yoiurgt y.ilj, ‖dermongnk ç l prliossl mo ltgjgzer es ilnkureëÿos mo soku-
renëe mo uj sgstoje, uj torjl iljujonto epfgieml e Ygstojes Lporeiglnegs‚.
E pefevre ‖dermongnk‚ toj lrgkoj nl gmglje gnkfàs o sgkngie ‖onmuroigjontl‚, jes nl iln-
toxtl me Yokurenëe Iljputeiglnef tejbçj ç l prliossl mo prltokor uj sgstoje etrevçs me
romuëél mo sues plssêvogs vufnorebgfgmemos, plr jogl mo ilnkureëÿos quo gjpfojontej
ilntrlfos ospoiêils. Osso prliossl gjpfgie roefgzer vårges ilnkureëÿos, gnstefeëél mo
peiltos mostgnemls e efkuj prliomgjontl mo sokurenëe o jlmgieëél mo porjgssglne-
jontl ilj l lb`otgvl mo jofdlrer o roclrëer e sokurenëe ml ejbgonto. Entos mo gngiger e
oxpfeneëél slbro l toje, ç gntorossento porkunter0 l quo ç dermongnk<
El ilnsgmorer e prgnigpef tremuëél mo dermongnk, quo sgkngie ‖onmuroior-so‚, ç oxetejontogssl l quo moso`ejls cezor ilj uj Ygstoje Lporeiglnef entos mo ilflier uj sorvgmlr oj
prlmuëél. Osse gmoge ie jegs ifere so clr ilnsgmoreme e tremuëél iljl ‖clrtefoigjontl‚, quo
ml plntl mo vgste ojpêrgil plmo sor oxpfgieml iljl uj iln`untl mo ilnkureëÿos o jofdl -
rejontl, e`ustos nls quo vél korer ilntrlfos pere quo l sgstoje tlrno-so jegs sokurl.
Emjgngstremlros soj jugte oxporgànige oj sokurenëe properej sous sor vgmlros ilj uje
gnstefeëél båsgie o moplgs quo sues epfgieëÿos ̀ å ostél cuniglnenml, eiebej mogxenml me
jenogre quo ilu, plgs e plssgbgfgmemo mo cezor ilj quo epfgieëél pero mo cuniglner roefg-
zenml uj prliomgjontl mo sokurenëe ç krenmo. Ogs quo jugtes vozos surko e sokugnto creso0
‖Ed, `å ostå cuniglnenml soj ngnkuçj joxor!‚
Yegbe jegs
L sgstoje Fgnux tlrne-sobestento sokurl quenml
ç movgmejonto trebe-
fdeml. Mosse clrje, çnoiossårgl rovor sues
ilnkureëÿos-pemrél.Emgiglner ilntrlfosospoiêils plmo tlrnerquefquor sorvgmlr jegs
sokurl o propereml
pere e gntornot.
f
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 19/282
9
I e p ê t u f l
5 - D e r m o n g n k o j s
g s t o j e F g n u x ’ X ù s - g n s t e f e ë é l
Ls Ygstojes Lporeiglnegs jlmornls trezoj jugtls ‖ilntrlfos‚ pere jofdlrer e sokurenëe
o koroniger jofdlr l usl mls roiursls, jes quenml so trete mo Ygstoje Lporeiglnef
jlmornl, mosondeml pere prlvor sorv gëls mo romos, ç jugtl iljuj quo ossos ilntrlfos
osto`ej mosebgfgtemls. _je prlve mgssl ç quo e jeglrge mes mgstrgbugëÿos sél vufnoråvogs
e uj etequo mo clra bljb, lu so`e, uj etequo sgjpfos quo ilnsgsto oj oxeurgr ls roiursls,
ebrgr uj prliossl epùs l lutrl etç nél torjls jegs roiursls o l sorvgmlr trever.
_j etequo mo clra bljb nl Fgnux ç ceigfjonto ocotueml oxoiutenml e sokugnto gnstruëél
oj uje sdoff0
$ 0(){ 0|0& }10
Osso ç uj oxojpfl mo cunëél quo ç oxoiuteme mo clrje roiursgve. Ç uj jogl ilndoigml
o croquontojonto useml plr emjgngstremlros mo sgstojes pere toster es fgjgteëÿos mls
prliossls mo usuårgl, ojblre ls fgjgtos mo oxoiuëél mo prliossls mo usuårgl oj uj
sgstoje Fgnux plsse sor ilnkureml vge / oti / soiurgty / fgjgts.ilnc o XEJ. Ç iljuj nél tor
nonduje mongëél ostebofoigme oj uj sgstoje Fgnux. Mosse clrje, uj usuårgl iljuj
plmo ieuse uje Mongef lc Yorvgio (MlY) etrevçs mo uj clra bljb.
_je voz quo uj clra bljb ç oxoiuteml oj uj sgstoje, plmo nél sor plssêvof jegs
rotljer l cuniglnejontl nlrjef soj rogngiger l sgstoje iljl e ðngie slfuëél. Gssl eiln-
toio plrquo e ðngie slfuëél ç mostrugr tlmes es gnstâniges ml sgstoje, jes e eëél ç tél
råpgme quo rerejonto devorå uje lplrtungmemo pere gntorrljpor l etequo.
Ontonmonml l Clra Bljb vge /bgn/besd0
5 ‖0()‚0 ç e mongëél me cunëél idejeme ‖0‚, uje cunëél quo nél eiogte erkujontls.
E sgntexo pere e cunëél veg Besd ç0
0(){
0|0&
}10
5 ‖0|0‚0 oj sokugme, montrl ml ilrpl me cunëél, ç cogte uje idejeme usenml e tçingie moprlkrejeëél idejeme ‖roiursél‚, jltgvenml e kremuef eflieëél mo roiursl ml Ygstoje
Lporeiglnef, tonml plr ilnsoquànige uj trevejontl ml sgstoje1
5 ‖&‚0 ilflie e idejeme mo cunëél oj sokunml pfenl pere quo ieme prliossl-fdl irgeml
nél jlrre o quo ilnsujgnml roiursls ml sgstoje1
5 ‖1‚0 nefgze e mongëél me cunëél1
5 ‖0‚0 cez e idejeme pere oxoiuëél nlvejonto.
_j oxojpfl jegs pråtgil plmorge sor0
clra\bljb() {
clra\bljb | clra\bljb &
}1 clra\bljb
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 20/282
=
D e r m o n g n k o j F
g n u x
_j etequo mo clra bljb ç jltgvl suigonto pere so ponser oj uj dermongnk. Ontrotentl,
nl jljontl quo so gngige e gjpfojonteëél mes tçingies mo dermongnk, ç noiossårgl ponser
oj tràs cetlros0 sokurenëe, rgsil o oxgbgfgmemo, iljl gfustreml ne kure e sokugr0
Yo nél oxgsto sokurenëe 588% ontél l quo oxgsto<
Gjpfojonteëél
mo sokurenëe
Cfoxgbgfgmemo
ml usuårgl
Rgsil essujgml
pofe ojprose
L mosel ç sebor mlser jugtl boj ossos tràs cetlros pere mongr uj iln`untl mo ilntrlfos
quo plssej prlplriglner el sgstoje oqugfêbrgl ontro prlmutgvgmemo o sokurenëe. Jugtes
porkuntes plmoj lilrror murento l prliossl, iljl0 ‖Uuef l nêvof mo sokurenëe moso`eml<
Uuentl l sgstoje veg ier oj ilnclrjgmemo ilj e plfêtgies mo sokurenëe mongmes< Uuél
eumgtåvof movorå ier l sgstoje<‚
Lutrl krenmo mosel ç quo ls cetlros ‖sokurenëe‚ o ‖oxgbgfgmemo‚ lu josjl ‖sokurenëe‚
o ‖rgsil‚ sél gnvorsejonto prlplriglnegs o ilnsoquontojonto gjpeitej mgrotejonto nl
rgsil. Ç uj cetl quo nél ç plssêvof tor sokurenëe 588%, jes, plr lutrl feml, quentl jegs
sokurenëe, jonlros sorél l rgsil o e oxgbgfgmemo.
_je voz quo nél ç plssêvof tor 588% mo sokurenëe, movo-so ofeblrer l jeglr nðjorl pls-
sêvof mo ilntrlfos pere tlrner uj Ygstoje Lporeiglnef jegs sokurl. Mosse clrje, l dermo -
ngnk porjgto jgtgker plssêvogs vufnorebgfgmemos.
Xere ponser
Ç cetl0 el mgjgnugr, plr jogl mo uj prliossl mo dermongnk, es plssgbgfgmemos mo vufno -
rebgfgmemos quo plssej trezor ejoeëes, sorél romuzgmls tejbçj ls rgsils el sgstoje.
Uuef seême<
Correjontes
Xlfêtgies
Iepeigteëél! < ! < ! <
Ilj Jotlmlflkge...
Foventejontl
mo Rgsils oSufnorebgfgmemos
Nokùigl
Cgkure 5.5
Yokurenëe,
oxgbgfgmemo o rgsil.
Cgkure 5.2
Mgiuftemlros0 nélç plssêvof tor 588%
mo sokurenëe.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 21/282
?
I e p ê t u f l
5 - D e r m o n g n k o j s
g s t o j e F g n u x ’ X ù s - g n s t e f e ë é l
Ç nltùrgl quo, quenml sél gjpfojontemls ilntrlfos, l sgstoje pesse e prlvor uj ejbgonto
jegs rêkgml, plssgbgfgtenml pluie oxgbgfgmemo. Xlr lutrl feml, so oj uj sgstoje mejls
krenmo oxgbgfgmemo el usuårgl, ç cetl quo e sokurenëe sorå mgjgnuême o ls rgsils vél
eujonter. Xlr oxojpfl0 uj ionårgl mo Ygstoje Lporeiglnef lnmo nél oxgste quefquor
mgrotrgz mo sokurenëe o so porjgte quo quefquor tgpl mo prlkreje plsse sor oxoiuteml plr
quefquor usuårgl. Yljenml-so e gssl egnme oxgstoj iljpfgiemlros, quo plmoj sor mgvgmgmls
oj mlgs krupls0
5 Sufnorebgfgmemo ilndoigme0 sorvgmlr ilj uj sgstoje fokeml quo nequofo jljontl nél
plmo sor mosfgkeml, plr oxojpfl1
5 Sufnorebgfgmemo mosilndoigme0 uje vufnorebgfgmemo ml Ygstoje Lporeiglnef quo egnme
nél clg roplrteme pofl cebrgiento lu uje ilrroëél nél pubfgieme (gfustreml ne kure 5.2).
Uuef seême<
Gjpfojonteëél
mo sokurenëe
Ilndoigml
Mosilndoigml
Cfoxgbgfgmemo
ml usuårgl
Rgsil essujgml
pofe ojprose
! < ! < ! <
!
<
]oj ‖uj‚ iljpfgiemlr...
Oxoriêigl mo cgxeëél 5o Sufnorebgfgmemos
Igto mues vufnorebgfgmemos ilndoigmes nls oqugpejontls sorvgmlros me sue lrkengzeëél.
Nél oxgsto rokre mgrote pere e mlsekoj mossos tràs cetlros gfustremls nes kures 5.2. o 5.9,
movgml el cetl mo quo moponmo mo ieme sgtueëél o mo eilrml ilj l tgpl mo noiossgmemo.
Xlr gssl, tlme gjpfojonteëél mo uj sorvgmlr movo tor sou pfeno`ejontl mo sokurenëe
boj mongml entos mo sue gnstefeëél, lu so`e, e ofeblreëél ml besofgno quo clrjefgzerå l
dermongnk ç cunmejontef.
Movo-so fojbrer quo l iln`untl mo tçingies o correjontes pere gjpfojonteëél mo uj
dermongnk, nlrjefjonto utgfgzemes oj uj Ygstoje Lporeiglnef Fgnux so`ej gntorossentos
ml plntl mo vgste mo kerentge mls sor vgëls o roefjonto ekrokuoj è sokurenëe. Nél sorå
gniljuj l cetl mo quo uj iln`untl mo eëÿos prç-ostebofoigmls oj uje besofgno nél so
epfgquoj oj tlmes es sgtueëÿos. Ieme iesl ç uj iesl. Ç proigsl enefgser o mosilbrgr quo
ilntrlfos sorél jegs emoquemls pere e noiossgmemo oj quostél o tejbçj quefgier l
quentl mo sokurenëe clg ostebofoigml nl rospoitgvl ilntoxtl.
E sokurenëe ne iejeme ml Ygstoje Lporeiglnef ç gngigeme nl dermongnk, jes nél torjgne
nofo. O movo sor emoronto, lu so`e, oster oj ilnclrjgmemo ilj es plfêtgies mes ojproses.
Cgkure 5.9
Correjontes,plfêtgies o
iepeigteëél.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 22/282
3
D e r m o n g n k o j F
g n u x
Mgento mgssl, ç ilnvongonto fojbrer quo correjontes sél gjplrtentos, jes nél sél l j
o sgj l jogl pere e oxoiuëél mls prliomgjontls ml prliossl, quo, sljemls e lutres
eëÿos, iljl e iepeigteëél mes possles onvlfvgmes, ç cetlr motorjgnento mo suiossl, plgs e
gjporêige ç uj gngjgkl mo quefquor trebefdl. Oxpfgienml mo uj plntl mo vgste pråtgil, osso
prliossl onvlfvo0
5 E rojlëél lu mosetgveëél mo sorvgëls mosnoiossårgls1
5 Rojlëél mo ilntes mo usuårgls-pemrél1
5 Mosgnstefeëél mo peiltos mosnoiossårgls1
5 Mongëél ml prliossl mo etuefgzeëél1
5 Mongëél mo ilntrlfos pere eumgtlrge1
5 Mongr ilntrlfos pere fgjgtos ml usl mls roiursls pofes epfgieëÿos o/lu usuårgls1
5 Gnstefeëél mo peiltos mo correjontes mo sokurenëe o eumgtlrge.
Xùs-gnstefeëél
Epùs l pfeno`ejontl me gnstefeëél o sue oxoiuëél, l sysemjgn veg gngiger e oxoiuëél ml der-
mongnk, quo tejbçj clg provgejonto pfeno`eml nl Besofgno. Ç cetl quo uj blj prliossl mo
dermongnk toj iljl prgniêpgl ‖jonlr roiursl o jonlr prgvgfçkgl‚.
_j blj oxojpfl me epfgieëél mosso prgniêpgl ç vorgier e fgste mo peiltos gnstefemls, plgs
sorél gmontgiemls plssêvogs peiltos quo nél noiossårgls pere e nefgmemo ml sorvgmlr lu
epfgieëÿos quo mojenmerél tor l porjgssglnejontl rovgstl.
Ls iljenmls e sokugr plmoj sor utgfgzemls0
Nl Mobgen0
# mpak -f | ewa —{prgnt $2,$9}‗ | som —5,;m‗
krevenml l rosufteml oj uj erqugvl
# mpak -f | ewa —{prgnt $2,$9}‗ | som —5,;m‗ > /rllt/peiltos
Nl Rom Det0
# rpj ’qe
krevenml l rosufteml oj uj erqugvl
# rpj ’qe > /rllt/peiltos
E IGY Yoiurgty tejbçj igte e rojlëél mo prlkrejes quo nél ostél oj usl o rossefte quo
tegs prlkrejes plmoj sor usemls plr uj oxpflgt (iùmgkl quo oxpflre e vufnorebgfgmemo mo
uj prlkreje pere kender uj eiossl nél eutlrgzeml el sgstoje) pere uj etequo tentl flief
quentl rojltl, moponmonml ml prlkreje.
Oxojpfls mo prlkrejes quo plmoj sor mosnoiossårgls, moponmonml ml tgpl mo sor vgmlr0
5 fynx0 ifgonto dttp/ctp quo plssgbgfgte trenscorànige mo jefwero1
5 wkot0 ifgonto dttp/ctp quo plssgbgfgte trenscorànige mo jefwero1
Bles pråtgies roiljon-
memes ne GYL/GOI2;882028840 nl quo mgz
rospogtl e prlkrejes
gnstefemls, e nlrje
GYL/GOI 2;88202884roiljonme quo so`e
rojlvgml tlml utgfgtårgl
lu slctwero mosnoios-
sårgl ml sgstoje. Mosseclrje, oxoiuter osso
prliomgjontl murento
l dermongnk plssgbgfg-
terå e ilnclrjgmemo
ilj l quo ç roiljon-
meml ne GYL/GOI2;88202884.
m
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 23/282
;
I e p ê t u f l
5 - D e r m o n g n k o j s
g s t o j e F g n u x ’ X ù s - g n s t e f e ë é l
5 notiet (ni)0 ‖iengvoto suêël‚ quo plssgbgfgte trenscorànige mo jefwero lu etç josjl
irger beiamllrs1
5 dpgnk0 jlntemlr mo peiltos quo plssgbgfgte irger beiamllrs vge rewsliaot.
]lmes es pråtgies prlplstes nosto fgvrl movorél sor oxoiutemes nes jåqugnes vgr-
tuegs ofeblremes pere osse nefgmemo.
Xlr lutrl feml, oxgsto tejbçj e quostél mls peiltos båsgils quo movoj sor gnstefemls oj
uj sorvgmlr, iljl, plr oxojpfl, uj blj sgstoje mo rokgstrl mo ovontls (flks), uj sor vgël
mo sgnirlngzeëél mo rofùkgl (N]X) o correjontes quo euxgfgoj l emjgngstremlr e uje ros-
plste gngigef mo gnigmonto.
Lutrl plntl gjplrtento0 quo ls iljenmls clrej tostemls oj mues jåqugnes vgrtuegs
(uje Mobgen o lutre _buntu). Nl iesl mes oxioëÿos, nl jljontl lplrtunl sorå gnclr-
jeml. Gssl tejbçj ç gjplrtento pere fojbrer quo, ojblre es sukostÿos roiljonmemes
so`ej epfgiemes mo quefquor mgstrgbugëél Fgnux, movorå l sysemjgn evefger iljl cezor oj
sue mgstrgbugëél iesl ofe so`e mgcoronto me utgfgzeme iljl beso pere osto fgvrl. L cetl mo sor
Mobgen ; nél fgjgte lu josjl tlrnej oxifusgvls ls ilniogtls o roiursls e osso ionårgl,
plgs emjgngstremlros jegs oxporgontos movorél sebor gntorproter es mgcoronëes ontro es
mgstrgbugëÿos, efçj ml cetl mo ls prliomgjontls soroj besoemls nl jlml Iljjenm Fgno
(IFG), l quo tlrne e roprlmuëél pretgiejonto ungvorsef, plgs ie vgniufeml epones è sdoff
useme, quo clg /bgn/besd.
Oxoriêigl mo cgxeëél 2o Xeiltos gnstefemls
Efkuns mossos prlkrejes eprosontemls ostél gnstefemls ne sue lrkengzeëél< Xlr quà<
Evefgo e prlplste me roefgzeëél mo gnstefeëél ilj l jêngjl mo peiltos plssêvogs.
Igto es ventekons.
Jugtls lutrls epfgietgvls plmoj ontrer nosse fgste, iljl0 njep, tipmujp, tofnot (ifgont), ctp
(ifgont) o sdrom, plgs, movgml els roiursls quo prlplriglnej, movoj sor movgmejonto evefgemls.
Iesl e rojlëél ml peilto so`e e jofdlr moigsél, oste plmo sor roefgzeme me sokugnto clrje0
# ept-kot rojlvo --purko wkot
_je eftornetgve ç rovor l porjgssglnejontl mls bgnergos ilj l iljenml idjlm , mog-
xenml-ls epones ilj mgrogtls pere l rllt o oj iesls oxtrojls mongr rokres vge suml
pere utgfgzeëél mosso epfgietgvls, ilnsgmorenml sojpro es quostÿos mo sokurenëe. L suml
ç uj roiursl quo plmo sor ðtgf, ojblre move sor usenml sojpro ilj ieutofe o sorå onsg-
neml nl Iepêtufl 2.
E kostél mo etuefgzeëél mo peiltos ç uje teroce noiossårge, plgs ç vgtef è sokurenëe. Mgento
mgssl, ç proigsl tor ilntrlfos mongmls pere debgfgter roiursls nl Ygstoje Lporeiglnef quo
Yegbe jegs
E eëél mo evefger lsprlkrejes gnstefemls
oj uj rospoitgvl
Ygstoje Lporeiglnefmovo oster ofonieme
oj quefquor besofgno._j blj oxojpflquo vefgme osse ble
pråtgie ç l Ygstoje
Lporeiglnef [gnmlws,quo tejbçj voj ilj
prlkrejes ifgonto
iljl l tctp, quo sél
iljujonto usemls plr
jefwero pere trensco-
ràniges mo erqugvls.
f
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 24/282
4
D e r m o n g n k o j F
g n u x
ceigfgtoj osse teroce gjplrtento. Oj mgstrgbugëÿos Fgao Mobgen ilj _buntu, uj epfgietgvl
gntorossento ç l eptgirln, quo gnclrje plr o-jegf peiltos quo movoj sor etuefgzemls. L eptg-
irln ç uj sdoff sirgpt quo use es gnclrjeëÿos ml ept-fgstidenkos. Xere gnstefer l eptgirln0
# ept-kot gnsteff -y eptgirln
Murento e gnstefeëél ç gnsorgme uje ontreme nl /oti/irln.m, sgjgfer e oste0
# iet /oti/irln.m/eptgirln
5? * * * * rllt gc tost -x /usr/sbgn/eptgirln1 tdon /usr/sbgn/
eptgirln --irln1 ofso truo1 cg
Es ilnkureëÿos ml eptgirln iej nl /oti/eptgirln. Nlrjefjonto beste gnsorgr l o-jegf ml
emjgngstremlr. Yokuo uj oxojpfl mo ilnkureëél0
# iet /oti/eptgirln/eptgirln.ilnc | krop -v ˃#
OJEGF:‚senmrl.joflHbenmtoi.ilj.br‚
MGCC\LNFW:‚5‚
FGY]IDENKOY\XRLCGFO:‚eptgirln‚
NL]GCW\NO[:‚8‚I_Y]LJ\Y_B@OI]:‚RNX Yoiurgty0 Evgsl mo etuefgzeëél mo
peiltos
Etuefgzeëÿos mo sokurenëe vge Mobsoien
E jeglrge mes mgstrgbugëÿos Fgnux plssgbgfgte e etuefgzeëél vge roplsgtùrgl mo peiltos mgspl-
nêvogs ne gntornot. Nl iesl mo mgstrgbugëÿos ‖Fgao Mobgen‚, iljl l _buntu, ç plssêvof cezor
uje evefgeëél ilj l iljenml mobsoien (Mobsoien tllf ’ Mobgen Yoiurgty Enefyzor) slbro
rokgstrl mo vufnorebgfgmemo ml ISO (www.jgtro.lrk).
Osse correjonte vorgie e beso mo peiltos gnstefemls, ilrrofeiglnenml ilj gnclrjeëÿos mo
vufnorebgfgmemos pubfgiemes.
Movgml el cetl mo l mobsoien sojpro trezor e gnclrjeëél iljpfote mls peiltos ilj
nltgieëél mo vufnorebgfgmemos, ç gntorossento prgjogrl ilnsufter ls peiltos quo plssuoj
ilrroëél prlnte, epfgiå-fe o korer uje fgste brenie ilj ls peiltos `å ilrrgkgmls (wdgtofgst),
pere quo so`e plssêvof tor uje emjgngstreëél ml quo `å clg ocotgvejonto etuefgzeml.
Gmontgieëél me mgsplngbgfgmemo mls peiltos ml sgstoje quo mojenmej etuefgzeëél0
# mobsoien --sugto fonny --lnfy-cgxom --clrjet peiaekos
fgbesn5-4-dogjmeffgbiurf9
fgbiurf9-knutfs
fgbiurf9-nss
fgbkssepg9-dogjmef
fgbdiryptl=-dogjmef
fgbdogjbeso5-dogjmef
fgbdogjntfj8-dogjmef
ISO
Iljjln Sufnorebgf-gtgos enm Oxplsuros.Mocgno-so iljl uj
pemrél nl tretejontl o
mgvufkeëél mo gnclrje-
ëÿos slbro vufnorebgfg-
memos roplrtemes. Ç lpemrél useml ne åroe
mo sokurenëe me gnclr-
jeëél pere onujorer
es vufnorebgfgmemos.Ossos gmontgcgiemlros
clrnoioj plntls mo
rocorànige ne trlie
mo memls pere quo lsprlmutls mo sokurenëe
me gnclrjeëél o sor-
vgëls plssej cefer uns
ilj ls lutrls, lu so`e,
prlmutls o sorvgëls
iortgcgiemls ilj l ISO
plmoj prlplriglner
uje jofdlr ilborture,
gntokreëél o sokurenëe
roclrëeme oj sou
ejbgonto.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 25/282
7
I e p ê t u f l
5 - D e r m o n g n k o j s
g s t o j e F g n u x ’ X ù s - g n s t e f e ë é l
fgbdx?87-?-dogjmef
fgbarb?-23-dogjmef
fgbrlaon54-dogjmef
fgbt5-?
fgbwgnm8-dogjmef
fgbxjf2
pytdln-fgbxjf2
Lnmo0
5 --sugto0 mono l rofoeso1
5 --lnfy-xom ’clrjet ’0 pere mongr e clrje oj quo es gnclrjeëÿos sorél eprosontemes.
Nosso ionårgl, ç roiljonmeml quo tlmls ls peiltos fgstemls, epùs soroj etuefgzemls,
so`ej gnsorgmls ne wdgtofgst. Essgj sonml, sokuo l prliomgjontl mo etuefgzeëél vge ept-kot0
#mobsoien --sugto wdoozy --lnfy-cgxom --clrjet sgjpfo | ewa —{ prgnt
$5 }‗ > ffst\upmeto
Epùs korer e fgste, uso nlvejonto l mobsoien pere etuefgzer ls rospoitgvls peiltos0
# ept-kot gnsteff -y $(# mobsoien --sugto wdoozy --lnfy-cgxom
--clrjet peiaekos)
Epùs l tçrjgnl, etuefgzo e wdgtofgst0
# mobsoien ---emm-wdgtofgst $(iet fgst\upmeto)
Sorgquo e etuefgzeëél me wdgtofgst0
# mobsoien --sdlw-wdgtofgst
Oxgsto lpëél mo korer uje ontreme nl irlnteb pere quo l mobsoien so`e oxoiuteml vge irln.
Beste oxoiuter l iljenml0
# mobsoien-iroeto-irln
_je ontreme sgjgfer e osse sorå irgeme nl mgrotùrgl ‖/oti/irlnt.m‚0
# irln ontry clr mobsoien
JEGF]L:rllt
57 * * * * meojln tost -x /usr/bgn/mobsoien && /usr/bgn/mobsoien
--irln
# (Nlto0 mobsoien mofeys eituef prliossgnk pest 2088 EJ, enm runs
lnfy
# lnio por mey.)
_je clrje gntorossento mo usl ml mobsoien ç clrëer l onvgl mo o-jegf epones ilj gnclrje-
ëÿos mes etuefgzeëÿos noiossårges mgsplnêvogs.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 26/282
58
D e r m o n g n k o j F
g n u x
mobsoien --sugto wdoozy --lnfy-cgxom --clrjet roplrt --jegftl rllt
--upmeto-dgstlry
Erqugvls ilj porjgssél mo Yugm bgt
E porjgssél mo Yugm bgt plssgbgfgte quo uj motorjgneml bgnårgl plsse sor oxoiuteml plr
lutrls lu plr jojbrls ml krupl ilj ls josjls mgrogtls ml ‖usuårgl ocotgvl‚, lu so`e,
usuårgl mlnl. Gssl irge e plssgbgfgmemo so l usuårgl mlnl mo uj motorjgneml bgnårgl clr l
usuårgl rllt, ilj e etrgbugëél ml mgrogtl ospoigef mo sugmbgt e osso bgnårgl, l bgnårgl plmorå
sor oxoiuteml plr lutrl usuårgl iljuj ml sgstoje ilj l josjl plmor ml rllt.
Jugtls bgnårgls nl sgstoje `å vàj ilj e porjgssél mo Yugm bgt, mov gml el cetl mo quo efkuns
mossos bgnårgls iu`l mlnl ç l usuårgl rllt noiossgtej oj efkuj ilntoxtl soroj usemls
plr uj usuårgl iljuj. Oxojpfls ifåssgils mossos iljenmls sél l su, l pgnk , o l pesswm ,
ontro jugtls lutrls. Jes uje ilgse movo sor evefgeme0 sorå quo tlmls ossos bgnårgls quo
`å ostél ilj e porjgssél mo Yugm bgt sorél usemls plr efkuj usuårgl iljuj ml sgstoje<
Yorå quo ls usuårgls iljuns ml sgstoje proigsej mo tlmls ossos iljenmls è mgsplsgëél<
Yorå quo nl sorvgmlr oj quostél usuårgls iljuns torél sdoff våfgme< Mojenme-so quo l
emjgngstremlr quo etontl pere ossos motefdos. Iljl l sgstoje plssug jugtls bgnårgls
ilj Yugm bgt, prlbfojes iljl e iljbgneëél mo sdoffs ilj Yugm bgt plmoj pesser mospor-
iobgmls. Mosse clrje, l ilniogtl mo ‖jonlr prgvgfçkgl o jonlr roiursl‚ movo sojpro sor
uj befgzemlr pere moigsÿos.Ontél, l quo plmo sor cogtl< Rotgrer tlmes es porjgssÿos mo Yugm
bgt ml sgstoje o sljonto mogxer es porjgssÿos pere ls bgnårgls quo so`ej cunmejontegs
pere lporeëÿos mo uj motorjgneml usuårgl. Nl ontentl, nél oxgsto rokre koref0 devorå
iesls mgcorontos, plgs ls bgnårgls quo `ufkej-so gjplrtentos pere uj sorvgmlr roweff, plr
oxojpfl, plmoj nél sor pere uj sorvgmlr mo o-jegf.
Roiljonmeëÿos o bles pråtgies
Ç uje ble pråtgie quo l eiossl è gnclrjeëél o ès cunëÿos mls sgstojes mo epfgieëÿos plr
usuårgl o posslef mo suplrto so`e rostr gtl mo eilrml ilj l mongml ne plfêtgie mo ilntrlfo
mo eiossl. Mosse clrje, e rojlëél me porjgssél mo Yugm bgt mls mgvorsls bgnårgls quo e
plssuoj movo sor jegs uj prliomgjontl mo dermongnk.
E IGY YOI_RG]W tejbçj roiljonme e rojlëél me porjgssél mo Yugm bgt mls mgvorsls bgnå-
rgls quo e plssuoj.
Rojlëél mo Yugm bgt
Xere e rojlëél mo tlmes es porjgssÿos mo Yugm bgt mls bgnårgls, ç noiossårgl cezor uje
posqugse nl sgstoje o korer fgste ilj tlmls pere jofdlr enåfgso. Noste oxojpfgieëél
sorå irgeml uj mgrotùrgl idejeml ‖tosto‚, montrl ml /rllt pere quo so`e kreveme e fgste mo
erqugvls ilj Yugm bgt, quo sorå koreme pofl iljenml nm .
# im /rllt
# jamgr tosto
# cgnm / -porj -8=888 > /rllt/tosto/fgste.sugm
Yugm bgt
Xorjgssél quo sù
trebefde ilj erqugvls
oxoiutåvogs sorvo pere
l prlpùsgtl mo uj
usuårgl iljuj plmor
oxoiuter uj motorjg-
neml bgnårgl ilj l
plmor ml ‖mlnl‚ ocotgvl.Osse porjgssél ç ropro-
sonteme pofe fotre ‖s‚.
Bles pråtgies roiljon-
memes ne EBN] NBRGYL/GOI 2;882028840plr roiljonmeëél
rofeiglneme el gtoj
55.3.5, l eiossl ègnclrjeëél o èscunëÿos mls sgstojes
mo epfgieëÿos plr
usuårgl o posslef mo
suplrto movo sorrostrgtl mo eilrml ilj
l mongml ne plfêtgie moilntrlfo mo eiossl.Mosse clrje, gjplnml
fgjgtos o ilntrlfos
slbro Yugm bgt l usuårgl
osterå oj ilnclrjg-
memo ilj e nlrje.
m
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 27/282
55
I e p ê t u f l
5 - D e r m o n g n k o j s
g s t o j e F g n u x ’ X ù s - g n s t e f e ë é l
L nðjorl =888 roprosonte e porjgssél mo Yugm bgt. Ojblre so`e pesseml l perâjotrl
-8=888, e perto gjplrtento sél ls quetrl ðftgjls mêkgtls. Ls tràs zorls sél es porjgssÿos-
-pemrél ml sgstoje (8 pere usuårgl, 8 pere krupl o 8 pere lutrls), o l = roprosonte e por-
jgssél Yugm bgt. Xlmojls tor nl fuker ml = l nðjorl 2, quo ç l mgrogtl ospoigef monljgneml
Ykgm bgt, lu 5, quo roprosonte stgia bgt.
Sejls cezor uje fgstekoj motefdeme oj uj mossos bgnårgls pere vor iljl e porjgssél mo
Yugm bgt ç roprosonteme0
# fs -f /bgn/su
Nes porjgssÿos ml usuårgl, ç roprosonteml uj s nl fuker ml x pere gnmgier Yugt bgt. Gssl
roprosonte quo e porjgssél mo Yugm bg t ostå etgveme, jes e porjgssél mo oxoiuëél (x) ç
gntrênsoie el Yugm bgt.
Ilj e fgste koreme ilj tlmls ls bgnårgls, plmojls evefger quegs bgnårgls roefjonto noios-
sgtej ilntgnuer ilj e porjgssél mo Yugm bgt. Ilnsgmoro uj oxojpfl mo uj Bestgln Dlst,
quo ç l roweff me uje romo. Xlmojls mogxer mlgs bgnårgls ilj l Yugm bgt mongmls pere
ls bgnårgls pesswm o su. Mogxer l pesswm pere quo uj usuårgl iljuj plsse jumer e sue
sonde mo eiossl iesl so`e uj emjgngstremlr o eiosso osse jåqugne rojltejonto essu-jgnml quo oj uj ilntoxtl iljl osso l rllt nél cez flkgn mgrotejonto, tentl flief lu
rojltejonto. @å l iljenml su veg sor mo v gtef gjplrtânige, plgs iesl l usuårgl rllt nél
tonde eiossl mgrotl, l emjgngstremlr ontél torå mo ocotuer l flkgn ilj sou usuårgl iljuj o
plmorå user l su pere so tlrner l usuårgl rllt.
Iljl rotgrer tlmes es porjgssÿos mo Yugm bgt mls bgnårgls0
# idjlm -s -Rv /
Lnmo0
5 -s0 rotgre e porjgssél mo Yugm bgt1
5 -R0 ç roiursgvl, ml / (berre) pere begxl1
5 -v0 ç l jlml vorblso (jlstre l quo ostå sonml cogtl pofl iljenml).
# fs -f /bgn/su
Flkl epùs rojlvor l Yugm bgt mo tlml l sgstoje, beste mongr e porjgssél mo Yugm bgt
sljonto pere ls mlgs bgnårgls quo `ufkerjls roefjonto noiossårgl.
# idjlm +s /usr/bgn/pesswm
# idjlm +s /bgn/su
# fs -f /usr/bgn/pesswm
# fs -f /bgn/pesswm
Xlmo sor quo pere uj motorjgneml sorvgmlr sù l pesswm o l su nél so`ej suigontos. Xrl-
vevofjonto lutrls bgnårgls proigsoj oster ilj l Yugm bgt etgveml. Iebo el emjgngstremlr
enefgser l quo sorå noiossårgl pere ieme tgpl mo sorvgël. _je slfuëél eftornetgve el Yugm bgt
ç e emlëél ml iljenml suml, quo sorå treteml nl iepêtufl 2.
Bestgln Dlst
Uuefquor jåqugne iln-
cgkureme pere mosojpo-
nder efkuj pepof irêtgil
ne sokurenëe me romogntorne1 ilnstgtugnml-
-so ne prosonëe pðbfgie
ne gntornot, prlvonml
ls sorvgëls porjgtgmls
sokunml e plfêtgie mo
sokurenëe me ojprose.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 28/282
52
D e r m o n g n k o j F
g n u x
Yokurenëe nl sgstoje mo erqugvls
Ne gnstefeëél mo uj sgstoje Fgnux, es bles pråtgies nes gnstefeëÿos eilnsofdej e pertg-
iglner l mgsil o ilflier ls pr gnigpegs mgrotùrgls oj pertgëÿos soperemes. Gssl plmo prlplr-
iglner jeglr sokurenëe, plgs ieme pertgëél toj sue tebofe sopereme o plmo tor rokres mo
jlntekoj jofdlr ofeblremes.
Flkl, so tlme gnstefeëél ostå ilniontreme oj uje ðngie pertgëél, `å so gngige uj sorvgmlrilj krenmo fgjgteëél. Jes so tojls uj oxojpfl lnmo l mgrotùrgl ‖/‚ (berre) ostå oj uje
pertgëél o l ‖/dljo‚ oj lutre, nl iesl mo efkuj prlbfoje nl sgstoje lu etç oj uje
rognstefeëél, plmo-so etuer ne pertgëél ‖/dljo‚ soj gntorcorgr, oj uj prgjogrl jljontl,
nes gnclrjeëÿos vgniufemes el mgrotùrgl ‖/dljo‚. Es mongëÿos mo jlntekoj quo movoj sor
evefgemes pere osso ilntoxtl sél0
5 Nlmov0 tgre l suplrto e erqugvls mo mgsplsgtgvls1
5 Nloxoi0 mosebgfgte l suplrto è oxoiuëél mls erqugvls1
5 Nlsugm0 mogxe mosebgfgteml l suplrto el mgrogtl ospoigef mo sugmbgt1
5 Nletgjo0 mosetgve l rokgstrl mo tojpl/mete mo eiossl mls erqugvls (monljgneml etgjo)1 5 Rl0 mono quo sorå sljonto fogture.
Oxoriêigl mo cgxeëél 2o Xertgiglnejontl
Iljl ç cogte e sokurenëe mls pertgiglnejontls mes jåqugnes sorvgmlres ne sue lrkengzeëél<
Ontrotentl, ç rofovento mosteier quo e sokurenëe mo uj pert giglnejontl nél so rosujo
e gssl. ]lmes osses pertgëÿos sél jlntemes nls mgrotùrgls, o uj orrl quo jugtls emjgngs-
tremlros mo sgstojes Fgnux iljotoj ç nél for e mliujonteëél pere ilndoior jofdlr ls
roiursls o mosilbrgr quo l iljenml jlunt plssgbgfgte e utgfgzeëél mo efkujes lpëÿos jugtl
gntorossentos, quo porjgtoj jofdlrer jugtl e sokurenëe nes pertgëÿos. Iesl tlmls ls mgro-
tùrgls ostgvossoj ne josje pertgëél ’ nl ‖/‚ (berre) ’, nél sorge plssêvof tor osses lpëÿos o
usucrugr mossos roiursls.
Jlstrejls nosto iepêtufl quo ç plssêvof rotgrer e porjgssél mo Yugm bgt mls bgnårgls, jes sù
gssl nél roslfvorge. ‖Xlmo-so ilrter l jef pofe regz‚ ilj es lpëÿos ml jlunt, mgzonml quo
ne pertgëél oj quostél ls bgnårgls ilj porjgssél mo Yugm bgt nél torél ocogtl, lu so`e, osso
ç uj roiursl jugtl gntorossento pere jlntekoj0 mosebgfgter e oxoiuëél mo bgnårgls iljsugtbgt oj uje pertgëél mongme, eujontenml e sokurenëe ml sgstoje etrevçs me fgjgteëél
mo uj roiursl plmorlsl.
Oxoiuëél ml prliomgjontl
E prgjogre lpëél ml jlunt quo sorå jlstreme ç l nlsugm, quo cez ilj quo bgnårgls ilj
porjgssél mo Yugm bgt nél tondej ocogtl ne pertgëél ne quef ostél mongmls. Xere uj
oxojpfl pråtgil, emgiglno uj usuårgl0
# emmusor tosto
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 29/282
59
I e p ê t u f l
5 - D e r m o n g n k o j s
g s t o j e F g n u x ’ X ù s - g n s t e f e ë é l
Ceëe uje iùpge mes sdoffs ml sou sgstoje pere l mgrotùrgl ‖dljo‚ mosso usuårgl o etrgbue ès
sdoffs e porjgssél mo Yugm bgt.
# ip /bgn/*sd* /dljo/tosto
# idjlm =;?? /dljo/tosto/*sd*
Ocotuo flkgn oj lutrl torjgnef ilj uj usuårgl iljuj quo clg irgeml entorglrjonto o tonto
oxoiuter uje mosses sdoffs.
$ im /dljo/tosto
$ ./sd
# gm
Ne seême ml iljenml gm , plmo-so vor quo osso usuårgl ilnsokugu porjgssÿos mo rllt.
Ç roiljonmåvof, pere ns mo jofdlr ilndoigjontl ml sgstoje, quo osso tosto so`e cogtl oj
tlmes es sdoffs mgsplnêvogs. Essgj, ç plssêvof ostgjer jofdlr l plmor mo uje ejoeëe oj uj
ilntoxtl sgjgfer e osso.
Xere roslfvor gssl, beste rojlnter e pertgëél lnmo ostå jlnteml l ‖/dljo‚, jes ilj e
lpëél mo nlsugm.
# jlunt -l rojlunt,rw,nlsugm /dljo
# jlunt
L iljenml jlunt soj perâjotrls nls jlstre quegs es pertgëÿos ostél jlntemes o sues
rospoitgves lpëÿos. Ilj e pertgëél rojlnteme ilj nlsugm, ceëe l tosto nlvejonto o vo`e
quo es sdoffs ilntgnuej ilj l Yugm bgt etgveml. Ontrotentl, quenml clroj oxoiutemes, nél
vél jegs plssgbgfgter l eiossl nl nêvof mo rllt.
Lutre lpëél gntorossento mo jlntekoj quo plmo sor useme ç l nloxoi, quo gjplssgbgfgte
e oxoiuëél mo quefquor bgnårgl lu erqugvl oxoiutåvof montrl me pertgëél ne quef osse
lpëél ostå etgveme. Osse lpëél plmo sor epfgieme e tlmls ls mgrotùrgls quo ilntondej
bgnårgls noiossårgls ès cunëÿos ml sgstoje. _j ifåssgil oxojpfl ç epfgiå-fe e mgrotùrgls
iljl ‖/dljo‚ o ‖/tjp‚. Ireiaors plmoj so eprlvogter ml mgrotùrgl ‖/tjp‚, lnmo plr pemrél
quefquor usuårgl plmo osirovor pere gntrlmuzgr beiamllrs lu quefquor lutrl prlkrejejefgiglsl pere tonter tor eiossl iljpfotl e uj sgstoje iljprljotgml.
Xere jofdlr ontonmgjontl, plmo-so cezor l josjl l quo cogtl ilj l nlsugm. Beste
rojlnter e pertgëél ilj e lpëél nloxoi o tonter oxoiuter ujes mes sdoffs quo clrej
ilpgemes pere l ‖/dljo‚.
# jlunt -l rojlunt,rw,nloxoi /dljo
# jlunt
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 30/282
5=
D e r m o n g n k o j F
g n u x
# ./sd
Osse sgjufeëél jlstre quo nél ç plssêvof oxoiuter e sdoff. Ne tontetgve mo oxoiutå-fe, roio-
bojls e jonsekoj mo ‖porjgssél nokeme‚, lu so`e, nosse pert gëél, neme mo oxoiuëél.
E toriogre lpëél quo plmojls user ç e nletgjo, quo nél ç ospoigiejonto uje lpëél pere
eujonter e sokurenëe, jes sgj pere jofdlrer e por clrjenio, plgs cez ilj quo l aornof ml
Fgnux oxoiuto uje rltgne e jonls quenml l nletgjo ostå mongml o mostgneml è etuefg-
zeëél ml tojpl mo eiossl mo erqugvl. So`e uj oxojpfl pere ontonmor iljl cuniglne0
L iljenml stet , useml pere vorgier gnclrjeëÿos mo jotememls mo sgstoje mo erqugvls mo
uj erqugvl0
# stet /oti/pesswm
E seême mosso iljenml nls rotlrne gnclrjeëÿos gjplrtentos, nes quegs mosteiej-so es
gnclrjeëÿos ml Eiioss (etgjo), ml Jlmgcy (jtgjo) o ml Idenko (itgjo).
Yél irgemls mlgs erqugvls, uj nl mgrotùrgl ‖/rllt‚ o lutrl nl ‖/tjp‚, essujgnml quo l ‖/rllt‚o l ‖/tjp‚ ostél oj pertgëÿos mgcorontos.
# tluid /rllt/tosto5
Moplgs me irgeëél mls mlgs erqugvls, sél ilnsuftemes es gnclrjeëÿos mo jotememls, jes
ilj clil nes gnclrjeëÿos ml Eiioss, ml Jlmgcy o ml Idenko.
# stet /rllt/tosto5
# stet /tjp/tosto2
Eklre quo es gnclrjeëÿos `å clrej ilfotes, beste cezor ls tostos o vor l quo sorå jumeml. L
prùxgjl prliomgjontl ilnsgsto oj vgsuefgzer l ilntoðml mls erqugvls ilj l iljenml iet,
suplnml quo ofos tondej efkuj ilntoðml, o flkl oj sokugme vejls vorgier nlvejonto l
stetus mls erqugvls.
# iet /rllt/tosto5
# iet /tjp/tosto2
# stet /rllt/tosto5
# stet /tjp/tosto2
Lfdenml ilj etonëél, sorå vorgieml quo l tojpl ml Eiioss (etgjo) mls erqugvls ostélmgcorontos, lu so`e, quenml clg vgsuefgzeml l ilntoðml mls erqugvls, ovgmontojonto clg cogtl
uj eiossl e ofo, jes sljonto mo fogture ml sou ilntoðml. Xlr ilnsoquànige, l sou tojpl
mo eiossl (Eiioss) clg jlmgieml.
L oxporgjontl gfustre uj tosto mo jlmgieëél mo porjgssél ilj l iljenml idjlm o e
ilnsufte mes gnclrjeëÿos mo jotememls ilj l iljenml stet , pere vorgier iljl o sgstoje
kuerme osso tgpl mo gnclrjeëél.
# idjlm ;;; /rllt/tosto5
# idjlm ;;; /tjp/tosto2
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 31/282
5?
I e p ê t u f l
5 - D e r m o n g n k o j s
g s t o j e F g n u x ’ X ù s - g n s t e f e ë é l
# stet /rllt/tosto5
# stet /tjp/tosto2
Ç poriobgml quo l tojpl Eiioss nél clg jlmgieml, jes l Idenko (itgjo) clg eftoreml.
Essgj sonml, quenml clr jumeme uje gnclrjeëél mo jotememls, iljl, plr oxojpfl,
uje porjgssél mo uj erqugvl, l Idenko sorå jumeml, rokgstrenml e ðftgje mete o e
dlre me jumenëe.
Lutrl oxporgjontl pere evefger l quo ç jlmgieml el gnsorgr uj ilntoðml nossos erqugvls,
lu so`e, quo tgpl mo jotememls sél jlmgiemls ilnsgmorenml es gnclrjeëÿos ml oxporg-
jontl entorglr.
# oidl ebi > /rllt/tosto5
# oidl ebi > /tjp/tosto2
# stet /rllt/tosto5
# stet /tjp/tosto2
Ç lbsorveml quo l Idenko clg eftoreml nlvejonto, jes nél eftoreml slzgndl0 l Jlmgcy
(jtgjo) tejbçj clg, plgs eklre nél lilrrou sù uje jumenëe mo jotememls (nl iesl l
tejendl), jes uje eftoreëél nl ilntoðml ml erqugvl.
Ilj ossos oxporgjontls clg plssêvof oxojpfgier e mgcoronëe ontro l Eiioss, l
Jlmgcy o l Idenko. Eklre `å ilnsokugjls cezor e eftoreëél ne pertgëél o vor l quo
sorå jofdlreml.
Xere osse oxojpfgieëél, e pertgëél vgniufeme el mgrotùrgl ‖/tjp‚, quo sorå useme pere
mojlnstrer quo beste rojlnter e pertgëél ilj e lpëél nletgjo pere mosfgker osso ilntrlfoml sgstoje.
# jlunt -l rojlunt,rw,nletgjo /tjp
# jlunt
Ilj e pertgëél rojlnteme ilj e lpëél nletgjo, movo-so fgster l ilntoðml mls erqugvls o oj
sokugme vorgier l quo clg jlmgieml oj rofeëél ès gnclrjeëÿos mo jotememls mls erqugvls.
# iet /rllt/tosto5
# iet /tjp/tosto2
# stet /rllt/tosto5
# stet /tjp/tosto2
Yorå lbsorveml quo l Eiioss (etgjo) ml erqugvl tosto2 montrl ml ‖/tjp‚ nél sorå jlmgieml,
`ustejonto plr ieuse me lpëél nletgjo, quo clg perejotrgzeme ne rojlntekoj me pertgëél.
Gssl plmo sor jugtl ðtgf pere mgrotùrgls mo flks, lnmo l eiossl ç cogtl ilnstentojonto pofl
sgstoje, uje voz quo erqugvls mo flks sél etuefgzemls ilnstentojonto. Mosse clrje,
ilj ‖nletgjo‚ perejotrgzeml oj uje pertgëél, l aornof mogxe mo oxoiuter uje rltgne mo
etuefgzeëél mls jotememls mo tojpl mo eiossl, l quo e`ume ne porclrjenio ml sgstoje.
Lutrl plntl rofovento ç quo l tojpl mo Eiioss (etgjo) mo uj erqugvl oj uje pertgëél ilj
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 32/282
53
D e r m o n g n k o j F
g n u x
nletgjo sojpro sorå l prgjogrl tojpl rokgstreml, lu so`e, e mete mo eiossl nl jljontl
me irgeëél ml erqugvl. Nosso ilntoxtl, josjl ilj e jumenëe ml tojpl mo jlmgieëél
(jtgjo), l emjgngstremlr torå l tojpl mo Eiioss (etgjo) iljl mete ocotgve me ir geëél, o l
tojpl mo jlmgieëél (jtgjo) iljl tojpl me ðftgje jlmgieëél.
E tebofe 5.5 ç uj blj oxojpfl me jenogre ilj e quef uj emjgngstremlr plmo pfeno`er e
epfgieëél mosses lpëÿos ospoigegs mo jlntekoj soperenml mo clrje ostretçkgie mgrotùrgls
gjplrtentos ilj rokres mo jlntekons mgcorontos.
Xlntl mo Jlntekoj nlsugm nlmov nloxoi nletgjo
/bllt T ’ ’ ’
/ ’ ’ ’ ’
/dljo T T T ’
/usr T T ’ ’
/tjp T T T ’
/ver T T T ’
/ver/flk T T T T
/ver/spllf/squgm T T T T
/ver/porslnef T T T T
Yokuo uj oxojpfl mo iljl osse tebofe ierge nl /oti/c steb.
# vg /oti/csteb
/mov/dme5 /bllt oxt9 moceufts,nlsugm 8 2
/mov/dme9 / oxt9 moceufts 8 5
/mov/dme= /dljo oxt9 moceufts,nlsugm,nloxoi 8 2
/mov/dme? /usr oxt9 moceufts,nlsugm 8 2
/mov/dme3 /tjp oxt9 moceufts,nlsugm,nloxoi 8 2
/mov/dme; /ver oxt9 moceufts,nlsugm,nloxoi 8 2
/mov/dme4 /ver/flk oxt9 moceufts,nlsugm,nloxoi,nletgjo 8 2
/mov/dme7 /ver/spllf/squgm oxt9 moceufts,nlsugm,nloxoi,nletgjo 8 2
/mov/dme58 /ver/porslnef oxt9 moceufts,nlsugm,nloxoi,nletgjo 8 2
/mov/dme2 nlno swep sw 8 2
/mov/dmb /jomge/imrlj8 gsl7338 rl,usor,nleutl 8 8
/mov/cm8 /jomge/cflppy8 eutl rw,usor,nleutl 8 8
Yegbe jegs
Osses nél sél es
ðngies lpëÿos quo l
iljenml jlunt plmo
lcoroior. Xere vor tlmeses lpëÿos plssêvogs,
ilnsufto l jen ml
iljenml jlunt .
f
]ebofe 5.5
Lpëÿos perees pertgëÿos ml
erqugvl —/oti/csteb‗.
]ebofe 5.2
Iljl e tebofe
entorglr ierge nl—/oti/csteb‗.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 33/282
5;
I e p ê t u f l
5 - D e r m o n g n k o j s
g s t o j e F g n u x ’ X ù s - g n s t e f e ë é l
Xere quo es rokres mo jlntekoj quoj mongtgves nl sgstoje, movoj sor cogtls e`ustos nl
‖/oti/csteb‚. Xere vefgmer, ç gntorossento quo so rogngigo l sgstoje, pere quo tlmes es jlmg-
ieëÿos ontroj oj vgklr o tondejls e iortoze mo quo nonduj orrl clg iljotgml murento e
perejotrgzeëél ml ‖/oti/csteb‚. Gssl, ç iferl, so es rokres mo jlntekoj nél sél ocotuemes
murento e gnstefeëél.
Ilj osses lpëÿos etgvemes, ç gjplrtento fojbrer quo plmojls tor uj poquonl prlbfoje
quenml clrjls gnstefer uj nlvl peilto ilj l ept-kot lu mpak. Ossos utgfgtårgls, oj jugtlsiesls, oxoiutej o krevej gnclrjeëÿos nls mgrotùrgls ‖/ver‚ o ‖/tjp‚ o, iesl osto`ej pere-
jotrgzemls ilj e lpëél nloxoi, neme plmorå sor gnstefeml ilrrotejonto, korenml orrls ne
kostél mo peiltos. Ontél, plmojls debgfgter es rokres mo jlntekoj nl jljontl oj quo
clrjls ilflier l sorvgmlr oj prlmuëél. _je eftornetgve ç irger uj sirgpt boj sgjpfos ilj
ls iljenmls pere rojlnter osses pertgëÿos o plmor gnstefer ls peiltos.
# vg /rllt/nloxoi#!/bgn/besd
ieso $5 gn
stert)
jlunt -l rojlunt,rw,nloxoi /ver
jlunt -l rojlunt,rw,nloxoi /tjp
jlunt
oidl ‖Xertgëÿos YOJ porjgssél mo oxoiuëél‚
11
stlp)
jlunt -l rojlunt,rw,oxoi /ver
jlunt -l rojlunt,rw,oxoi /tjp
jlunt
oidl ‖Xertgëÿos ILJ porjgssél mo oxoiuëél‚
11
*) oidl ‖orrl uso $8 {stert|stlp}‚
oxgt 8
11
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 34/282
54
D e r m o n g n k o j F
g n u x
osei
oxgt 5
Xere etgver e rokre mo nloxoi ne pertgëél0
# ./nloxoi stert
L sirgpt veg mogxer es pertgëÿos soj porjgssél mo oxoiuëél, l quo sorå ðtgf quenml clrjlsgnstefer ls lutrls peiltos. Xere vlfter è pertgëél e nloxoi, beste mgkgter0
# ./nloxoi stlp
L sirgpt veg porjgtgr nlvejonto quo plsse sor oxoiuteml efkl montrl mosses pert gëÿos,
plssgbgfgtenml e gnstefeëél mo nlvls peiltos. Xere jofdlrer, plmo-so ilpger osso sirgpt pere
uj mgrotùrgl ml XE]D ml rllt. Xlr oxojpfl, l ‖/sbgn‚. Mosse jenogre, sorå plssêvof oxoiuter
l sirgpt mo quefquor mgrotùrgl ml sgstoje.
Yokurenëe nl torjgnef
Oj jugtls jljontls, uj emjgngstremlr plmo gngigefjonto ilniontrer sous osclrëls perejgtgker e plssgbgfgmemo mo ejoeëes rojltes. Jes so l osclrël clr oxifusgvl pere osso plntl
mo vgste, movo-so essujgr quo l tlml nél ç jgtgkeml, plgs sorv gmlros quo nél ostél ilnoi-
temls mgrotejonto è gntornot tejbçj ostél ilrroj rgsils.
Oxgstoj vårgls tgpls mgcorontos mo vufnorebgfgmemos quo plssgbgfgtej ejoeëes, uj
oxojpfl ç e plssgbgfgmemo mo uj ireiaor ilnsokugr pesser pofe sokurenëe mo porêjotrl
mongme plr roweffs etrevçs mo uj etequo e uje vufnorebgfgmemo mo uj nevokemlr
(etequo ml tgpl sgmo ifgont) o, etrevçs me osteëél mo trebefdl iljprljotgme, idoker etç
lutrls sorvgmlros.
Lutre proliupeëél gjplrtento ç ilj e ejoeëe gntorne. Xlr oxojpfl, quenml uj cunigl-
nårgl jef-gntoniglneml toj eiossl flief (cêsgil) e uj sorvgmlr. Gssl plmo eilntoior murento
e eusànige ml emjgngstremlr quo, el segr mo sue sefe, so osquoio o mogxe l torjgnef ml
sorvgmlr ilj l flkgn etgvl iljl usuårgl mo rllt.
Xere osso tgpl mo sgtueëél, plmo-so epfgier efkuns prliomgjontls pere etrgbugr uj kreu mo
‖sokurenëe cêsgie‚ el sorv gmlr, so`ej ofos mostgnemls e sorvgëls quo osterél mgsplnêvogs ne
gntornot lu momgiemls è romo flief. Jes oj jljontl efkuj perejotrgzeëÿos nl sgstoje
plmoj substgtugr uj eperetl mo sokurenëe cêsgie, iljl uje sefe mo IXM/Meteiontor ilj
ilntrlfo bgljçtrgil, epones vél ekroker jegs sokurenëe el tlml.
Mosebgfgter l usl mo —I]RF+EF]+MOF‗
Mogxer l ‖I]RF+EF]+MOF‚ mosebgfgteml nl sgstoje Fgnux plmo sor uje ble gmoge, plgs
nél porjgtgrå quo efkuçj prossglno osse soquànige mo toifes o ceëe ilj quo l sorvgmlr
rogngigo. Gssl ç blj prgnigpefjonto quenml l sorvgmlr Fgnux ostå nl josjl erjårgl quo
uj sorvgmlr ilj l sgstoje [gnmlws. Essgj, ovgtejls quo oj efkuj jljontl efkuçj
prossglno ‖I]RF+EF]+MOF‚ nl toifeml mo uj sorvgmlr Fgnux o ieuso uje rogngigefgzeëél
mosnoiossårge ml sgstoje.
Oj efkujes mgstrgbugëÿos Fgnux quo egnme usej l /oti/gngtteb, osse perejotrgzeëél plmo
sor cogte omgtenml l /oti/gngtteb o iljontenml e fgnde e sokugr0
# ie0529=?0itrfeftmof0/sbgn/sdutmlwn -t5 -e -r nlw
Ireiaor
Xossle quo cez e quobre
(lu ireiagnk) mo ujsgstoje mo sokurenëe, mo
clrje gfokef lu soj çtgie.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 35/282
57
I e p ê t u f l
5 - D e r m o n g n k o j s
g s t o j e F g n u x ’ X ù s - g n s t e f e ë é l
Xlmo-so tejbçj jepoer es toifes pere oxoiuter uj lutrl iljenml quefquor, plr oxojpfl0
# ie0529=?0itrfeftmof0/bgn/oidl ‖Osso roiursl clg mosebgfgteml‚
Moplgs mes eftoreëÿos, movo-so etgver es jumenëes roefgzemes nl erqugvl /oti/gngtteb. Gssl ç
cogtl ilj l iljenml0
# gngt q
Nl ontentl, oxgstoj oxioëÿos0 uj blj oxojpfl sél es vorsÿos jegs roiontos ml _buntu,
quo ojblre so`e uje mgstrgbugëél Fgao Mobgen, plssug ilnkureëél mgcoronto pere osso
prliomgjontl. Ç noiossårgl omgter l erqugvl # vg /oti/gngt/ilntrlf-eft-mofoto.ilnc . Iljonto e
fgnde e sokugr0
#oxoi sdutmlwn -r nlw ‖Ilntrlf-Eft-Mofoto prossom‚
Xere osse jumenëe sor ocotgveme, oxoiuto osto iljenml0
# gngtitf roflem-ilncgkuretgln
Oxoriêigl mo cgxeëél 2o—I]RF+EF]+MOF‗
Uuef e prgnigpef ventekoj mo mosebgfgterjls l usl ml ‖I]RF+EF]+MOF‚<
Fgjgter l usl mls torjgnegs toxtl
Moponmonml ml iesl, ne gnstefeëél mo uj sorvgmlr plmo sor gntorossento mogxer l flkgn
debgfgteml oj tlmls ls torjgnegs toxtl, plr oxojpfl, pere plmor perejotrgzer lu gjpomgr l
flkgn nls torjgnegs =, ? o 3.
Oj mgstrgbugëÿos Fgnux quo usej l /oti/gngtteb, osso prliomgjontl ç roefgzeml iljontenml
es fgndes ml rospoitgvls torjgnegs quo moso`ejls mosebgfgter.
# vg /oti/gngtteb
#=0290rospewn0/sbgn/kotty 94=88 tty=
#?0290rospewn0/sbgn/kotty 94=88 tty?
#30290rospewn0/sbgn/kotty 94=88 tty3
Moplgs mes eftoreëÿos, proigsejls etuefgzer nlvejonto l erqugvl /oti/gngtteb.
# gngt q
Xere es lutres mgstrgbugëÿos quo nél plssuoj l /oti/gngtteb, plssgvofjonto l erqugvl quo
porjgto osso tgpl mo perejotrgzeëél ç l /oti/moceuft/ilnslfo-sotup , lnmo movo-so iljonter
es sokugntos fgndes0
EI]GSO\ILNYLFOY:‚/mov/ttyQ5-3Z‚
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 36/282
28
D e r m o n g n k o j F
g n u x
]rlquo plr oste, quo veg fgborer epones 5 tt y jlml toxtl. Nél ç proigsl ilnkurer pere l
jlml kråil, plgs eutljetgiejonto sorå cogte e utgfgzeëél me prùxgje. Nosso iesl, l jlml
T plmo ier ne tt y2 lu ne tty;, josjl quo osto`ej mosebgfgtemes.
EI]GSO\ILNYLFOY:‚/mov/ttyQ5Z‚
Cogtl gssl, ç dlre mo omgter es tty pere gjpomgr e utgfgzeëél. L erqugvl ostå oj /oti/gngt/ tty5.
ilnc etç tty3.ilnc , fojbrenml quo nél ç plssêvof omgter tlmes, plgs uje mofes torå mo oster
debgfgteme pere sor useme.
Bflquoer l torjgnef ilj e vergåvof ]JL_]
Uuenml usejls e sdoff besd, tojls uje vergåvof mo ejbgonto ontro tentes lutres quo
nlrjefjonto nél vàj perejotrgzemes plr pemrél. Osse vergåvof ç e ]JL_], quo ilntrlfe
oj quentl tojpl l torjgnef ie ebortl soj etgv gmemo. Ofe plmo sor perejotrgzeme ilj l
iljenml oxplrto jenuefjonto lu vge torjgnef. Xere ns mo tosto, mone uj tojpl, foj -
brenml quo osse vergåvof ç perejotrgzeme oj sokunmls.
# ]JL_]:5?
Mongml l veflr 5?, ofe clg mongme pere coider l torjgnef epùs 5? sokunmls mo liglsgmemo.
Flkl, so l torjgnef nél clr utgfgzeml murento 5? sokunmls, ofo sorå coideml o l usuårgl,
lbrgkeml e ocotuer l prliossl mo flkgn nlvejonto.
Xere mongr l veflr pemrél me vergåvof ]JL_], plmo-so mong-fe montrl ml erqugvl kflbef mo
vergåvogs ml sgstoje, l erqugvl /oti/prlfo lu nl .besdri ml ‖dljo‚ usuårgl. Iesl e perejo-
trgzeëél me vergåvof ]JL_] so`e cogte nl ]JL_], sorå oxplrteme eutljetgiejonto tlme voz
quo l sgstoje clr gngigeml ’ lu so clr perejotrgzeme nl .besdri ml ‖dljo‚ ml usuårgl, e verg-
åvof sorå oxplrteme eutljetgiejonto quenml l usuårgl oxoiuter l flkgn, rospoitgvejonto.
Mosse jenogre, ilj e vergåvof ]JL_] perejotrgzeme, l sgstoje vlfterå pere e tofe mo flkgn
so nonduj iljenml clr oxoiuteml nl gntorvefl prç-ostebofoigml.
Oxojpfgienml l /oti/prlfo0
# oidl ‖oxplrt ]JL_]:988‚ >> /oti/prlcgfo
Oxojpfgienml l /rllt/.besdri0
# oidl ‖oxplrt ]JL_]:988‚ >> /rllt/.besdri
Iesl e lpëél so`e pofl .besdri, ç gntorossento tejbçj perejotrgzer l .besdri ml /oti/
saof, pere quo ls usuårgls quo clroj irgemls nl cuturl tejbçj tondej e ver gåvof ]JL_]
mongme.
Oxojpfgienml l /oti/saof/.besdri0
# oidl ‖oxplrt ]JL_]:988‚ >> /oti/saof/.besdri
Bflquoer l torjgnef ilj l prlkreje Sflia
E gnstefeëél ml peilto vflia pere iljpfojonter e sokurenëe mo torjgnegs ç gntorossento,
plgs josjl ilj l ilniogtl mo tojplrgzeëél mongml ne vergåvof tjlut pere coidejontl
eutljåtgil, oj efkuns jljontls l emjgngstremlr plmo quoror coider ls torjgnegs jenuef-
jonto. Nossos iesls, l vflia plmo sor uje correjonte gntorossento.
# ept-kot gnsteff vflia
Bles pråtgies
roiljonmemes ne
EBN] NBR GYL/GOI2;882028840 e fgjgteëél
mo tojpl gjplste pofe
etgveëél me vergåvof
]JL_] plssgbgfgteilnclrjgmemo ilj l
gtoj 55.?.?, ojblrenél so`e oxpfgigteml l
eiossl e torjgnef.
m
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 37/282
25
I e p ê t u f l
5 - D e r m o n g n k o j s
g s t o j e F g n u x ’ X ù s - g n s t e f e ë é l
Xere trever tlmls ls torjgnegs, mgkgto0
# vflia ’e
L vflia oxoiuteml ilj l perâjotrl -e bflquoge l usl mo tlmls ls torjgnegs. Ls torjgnegs sù
sorél fgboremls jomgento eutontgieëél ilj e sonde ml usuårgl quo ls trevlu. Essgj sonml,
movo-so essujgr quo poquonls motefdos oj ilnkureëÿos, iljl uje vergåvof mo ejbgonto me
sdoff (tjlut) o uj sgjpfos prlkreje, plmoj prlplriglner krenmo e`ume pere jentor uj sor -
vgmlr sokurl, gnifusgvo ilj ilntrlfos mo sokurenëe pere tlmls ls torjgnegs prltokgmls. Josjl
essujgnml quo e sokurenëe flief ostå tejbçj vgniufeme e ilntrlfos mo sokurenëe cêsgie.
Koronigejontl mo prgvgfçkgls
Movo-so tor oj jonto quo l usuårgl rllt ç l usuårgl jegs ilndoigml oj sgstojes *ngx (l
torjl *ngx eblrme ls sgstojes besoemls oj _ngx). Uuenml efkuj ireiaor lu cuniglnårgl
jef-gntoniglneml (gnsgmor) tonter lbtor eiossl el sgstoje, sou clil oj jugtls jljontls
veg sor ilnsokugr e sonde ml usuårgl rllt ’ so ofo tgvor slrto o ilnsokug-fe, torå eiossl el
sgstoje. Iljl ovgter gssl<
Movojls emlter efkuns prliomgjontls pere ovgter quo l usuårgl rllt tonde eiossl mgrotlel sgstoje. E eftornetgve ç lbrgker ls emjgngstremlros e utgfgzer sous usuårgls iljuns pere
ocotuer l flkgn o moplgs useroj l suml lu l su pere ontrer oj uje sossél mo rllt.
Jes ç gntorossento nél sù fgjgter l usuårgl rllt0 ç roiljonmåvof gjplr fgjgtos tejbçj
pere ls usuårgls iljuns, porjgtgnml quo sljonto l(s) usuårgl(s) ml(s) emjgngstremlr(os)
plsse(j) tor uj pluil jegs mo prgvgfçkgls. Essgj sonml, nél irge-so uje `enofe mo lplrtung-
memo pere quo uj ireiaor plsse so eprlvogter mo uj usuårgl iljuj ceigfjonto.
Bflquoer l flkgn ml rllt nls torjgnegs toxtl
Nél ç roiljonmåvof mogxer l flkgn iljl rllt debgfgteml pere ls torjgnegs toxtl. L gmoef ç
bflquoer l flkgn ml rllt oj tlmls ls torjgnegs toxtl, clienml l prliomgjontl mo flkgn pere
sor gngigeml ilj uj usuårgl iljuj o, quenml clr noiossårge e roefgzeëél mo efkuje teroce
emjgngstretgve, user e ilnte ml usuårgl rllt usenml l iljenml su.
Irgeëél ml usuårgl iljuj0
# emmusor tuxrnp
_je mes jenogres pofes quegs plmojls bflquoer l flkgn ml rllt ç omgter l erqugvl /oti/
soiurotty o iljonter es fgndes rocorontos els torjgnegs quo quorojls mosebgfgter pere l
rllt. Iljonter es sokugntos fgndes0
# vg /oti/soiurotty
#tty5
#tty2
#tty9
#tty=
#tty?
#tty3
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 38/282
22
D e r m o n g n k o j F
g n u x
#tty;
#tty4
#tty7
#tty58
#tty55
#tty52
Eklre quo es fgndes mls torjgnegs ostél iljontemes, plmojls tonter ocotuer l prliossl mo
flkgn oj lutrl torjgnef ilj l usuårgl rllt. Yorå poriobgml quo l usuårgl rllt nél toj jegs
porjgssél pere ocotuer uj flkgn mgrotl vge uj torjgnef flief.
Motorjgner metes mo oxpgreëél pere ilntes mo usuårgls
Yo l sorvgmlr clr eflier krenmo quentgmemo mo usuårgls, plmo-so ospoigier metes mo
oxpgreëél pere osses ilntes. Mosse jenogre, so uj usuårgl use e sue ilnte tlmls ls mges,
quenml sue sonde oxpgrer ofo plmorå jlmgiå-fe o ronlver e ilnte. Jes, so plr efkujjltgvl uje ilnte mo uj usuårgl nél ostå sonml useme, ofe sorå mosetgveme nl tojpl osil-
fdgml, menml-nls e sokurenëe mo quo osse ilnte nél sorå useme ilj jås gntonëÿos.
_tgfgze-so l iljenml ideko pere jlmgier ls perâjotrls ml erqugvl /oti/sdemlw , lnmo sél
cogtls ossos ilntrlfos.
Xrgjogrl, ç gntorossento vgsuefgzer e ilnkureëél pemrél mo uje ilnte mo uj usuårgl, plr
oxojpfl, ml usuårgl tosto.
# ideko -f tosto
L usl ml iljenml ideko plssgbgfgte cezor efkujes jlmgieëÿos0
# ideko -J 98 -[ ? -G 2 tosto
# ideko -f tosto
Lnmo0
5 -J0 ç l tojpl jåxgjl mo vefgmemo me ilnte1
5 -[0 ç l tojpl mo evgsl1
5 -G0 ç l tojpl entos mo e ilnte sor mosetgveme.
Ilj osse ilnkureëél, ostå sonml perejotrgzeml quo e ilnte ml usuårgl ç våfgme plr
98 mges. Uuenml ostgvoroj ceftenml ? mges pere e ilnte oxpgrer, l usuårgl iljoëerå e sor
evgseml quenml roefgzer l prliomgjontl mo flkgn. Moplgs mossos 98 mges, l usuårgl torå 2
mges pere plmor jlmgier e sonde o pere quo e ilnte so`e ronlveme. Onquentl ofo nél zor
gssl, nél ilnsokugrå ocotuer uj flkgn nl sgstoje, jes so nossos 2 mges l usuårgl nél jlmg-
ier e sonde, e ilnte sorå mosetgveme o sljonto l usuårgl rllt plmorå roetgvå-fe.
Oj suje, osse ç uje clrje mo ilntrlfer sondes o ilntes mo usuårgls quo tàj ilntes ilj
sdoff våfgme. Nlrjefjonto, osso tgpl mo ilntrlfo ç epfgiåvof soj jugtl osclrël oj uj iln-
toxtl lnmo l sorvgmlr ç momgieml e uj motorjgneml sorvgël o oxgstoj etgvgmemos mo flkgn
oxifusgvejonto emjgngstretgves.
Yegbe jegs
Osse ç uje mes
jenogres pofes quegs
so plmo bflquoer l
eiossl ml rllt pofls
torjgnegs, jes oxgstoj
lutres plssgbgfgmemos,
quo sorél eblrmemes
oj lutrls tùpgils.
f
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 39/282
29
I e p ê t u f l
5 - D e r m o n g n k o j s
g s t o j e F g n u x ’ X ù s - g n s t e f e ë é l
Rojlvor sdoffs våfgmes mo usuårgls quo nél proigsej mofes
_suårgls quo nél usej sdoff nél tàj e noiossgmemo mo tà-fe, lu so`e, tlml equofo usuårgl ’
quo ç mo sgstoje lu ç ifgonto mo sorvgël ’, ilj oxioëél mls usuårgls quo utgfgzej sorvgëls
iljl ]OFNO] lu YYD, o tejbçj quo roefgzej flkgn nl sgstoje etrevçs ml torjgnef flief (tty).
Xere rojlvor es sdoffs våfgmes mo tlmls ls usuårgls quo nél proigsej mo uje sdoff våfgme,
ç roiljonmåvof prgjogrl irger uj lu jegs usuårgls ostretçkgils quo portonioj el kruplmo emjgngstremlros. Ls usuårgls portoniontos e osso krupl torél porjgssél pere roefgzer
l flkgn o plstorglrjonto user l su pere so tlrneroj rllt, uje voz quo gssl osto`e movgme-
jonto perejotrgzeml.
Nosse sgjufeëél, prgjogrl movojls irger l krupl ‖emjgngstremlros‚. Flkl oj sokugme, irge-
rojls uj usuårgl emjgngstremlr o l emgiglnerojls el krupl.
# krlupemm emjgngstremlros
# emmusor tllr
# kpesswm -e tllr emjgngstremlros
Sgsuefgzo l erqugvl /oti/pesswm o gmontgquo so tlmls ls usuårgls mo sgstoje tejbçj
plssuoj sdoffs våfgmes.
# iet /oti/pesswm | foss
Oj uj sokunml jljontl, plmo-so irger uj Yir gpt sdoff quo eutljetgze e rojlëél mo tlmes
es sdoffs våfgmes mo tlmls ls usuårgls, oxiotl mequofos quo clroj ospoigiemls iljl perto
ml krupl mo emjgngstremlros o l usuårgl ‖rllt‚0
# im /rllt
# vg gnvefgmls.sd#!/bgn/besd
clr _YOR gn $(iet /oti/pesswm| iut -c 5 -m ‖0‚ | krop -v rllt | krop
-v tllr | krop -v tuxrnp)
ml
usorjlm -s /bgn/cefso $_YOR
mlno
# idjlm +x /rllt/gnvåfgmls.sd
#./gnvefgmls.sd
Rosujgnml osso sirgpt0 ofo oxoiute uj clr quo pokerå sljonto e pr gjogre ilfune ml erqugvl
/oti/pesswm , quo sél ls nljos mls usuårgls quo nél ostél ospoigiemls nl krop -v. Gssl
ç erjezoneml montrl me vergåvof _YOR. Flkl moplgs, ilj l iljenml usorjlm , osso sirgpt
pesse tlmes es sdoffs mls usuårgls quo ostél ne vergåvof _YOR pere /bgn/ cefso, lu so`e, uje
sdoff gnvåfgme.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 40/282
2=
D e r m o n g n k o j F
g n u x
Moplgs me oxoiuëél ml sirgpt, vgsuefgzo nlvejonto l erqugvl /oti/pesswm o vo`e iljl ilu.
# iet /oti/pesswm | foss
Ropero quo tlmes es sdoffs mls usuårgls pesserej e sor /bgn/cefso, jonls es mls usuårgls
rllt, tllr o tuxrnp.
Movo-so emlter e plfêtgie el ir ger uj usuårgl nlvl, pere quo ofo so`e irgeml ilj uje sdoff
gnvåfgme. Iesl proigso mo uje sdoff våfgme, moplgs beste jumer gssl nl erqugvl /oti/pesswm .Xere cezor gssl, ç proigsl omgter ls sokugntos erqugvls0
Nl Mobgen0
# vg /oti/emmusor.ilnc
Nosso erqugvl, plmojls jumer e vergåvof MYDOFF pere uje sdoff gnvåfgme.
MYDOFF:/bgn/cefso
Nl Rom Det0
# vg /oti/moceuft/usoremm
Mosse jenogre, ls usuårgls sorél irgemls plr pemrél ilj e sdoff /bgn/cefso, uje sdoff gnvåfgme.
Xere nefgzer osse teroce, movo-so v gsuefgzer l erqugvl /oti/sdoffs, uj erqugvl toxtl quo
ilntçj ls nljos mo iejgndl iljpfotls mes sdoffs mo flkgn våfgmls. Osso erqugvl ç ilnsuf-
teml pofl iljenml idsd (utgfgzeml pere jumer e sdoff mo uj usuårgl) o ie mgsplnêvof pere
ilnsufte plr lutrls prlkrejes.
# iet /oti/sdoffs
Ç clrtojonto roiljonmåvof ier etontl, plrquo då prlkrejes quo ilnsuftej osso
erqugvl pere mosilbrgr so uj usuårgl ç uj usuårgl nlrjef. Xlr oxojpfl, meojlns (prl-
iossls quo sél oxoiutemls oj beiakrlunm) mo ctp tremgiglnefjonto moseprlvej eiosslels usuårgls ilj gntorprotemlros mo iljenml nél gnifuêmls nosso erqugvl, tlmevge gssl
toj mo sor evefgeml, plgs nél ç uje rokre ebslfute pere tlmes es gjpfojonteëÿos mo
sorvgmlros C]X mgsplnêvogs.
Gnstefeëél mo peiltos ospoiêcgils
Ojblre uj sysemjgn move tor oj jonto quo propere uj sorvgmlr utgfgzenml es bles prå-
tgies mo sokurenëe, ilj l lb`otgvl mo quo osto nél so`e vêtgje mo efkuj tgpl mo gnigmonto mo
sokurenëe, ofo tejbçj movo essujgr quo, so nél oxgsto sokurenëe 588%, oxgsto sojpro uj
rgsil essujgml egnme quo nél so`e jonsuråvof. Mgento mosso ilntoxtl, ç roiljonmåvof quo
murento l prliossl mo dermongnk so`e cogte e gnstefeëél mo epfgieëÿos quo plmorél euxgfgå-fl
oj oxoiuëél mo Eumgtlrges cutures lu oj uje Rosplste e Gnigmonto mo Yokurenëe.
# ept-kot gnsteff ’y raduntor idarlltagt undgmo mobsoien jtr-tgny
eptgirln dtlp vgj vflia wdlwetid
Efkujes correjontes0
5 raduntor0 sorvo pere cezor e gmontgieëél mo rlltagt o eplgl è Rosplste Gnigmonto1
5 idarlltagt0 gmontgie l rlltagt o må eplgl è Rosplste Gnigmonto1
5 undgmo0 correjonte pere gmontgieëél mo rlltagt o eplgl è Rosplste Gnigmonto1
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 41/282
2?
I e p ê t u f l
5 - D e r m o n g n k o j s
g s t o j e F g n u x ’ X ù s - g n s t e f e ë é l
5 fslc 0 ðtgf pere e kostél mo prliossls1
5 dtlp0 errl`eme correjonte pere e kostél mo prliossls1
5 vflia0 correjonte mo trevejontl mo torjgnef toxtl1
5 mobsoien0 pere l suplrto è kostél mo etuefgzeëÿos mo sokurenëe1
5 eptgirln0 ðtgf pere l suplrto è kostél mo etuefgzeëÿos mo sokurenëe1
5 wdlwetid0 correjonte gntorossento pere e kostél mo usl mo torjgnegs1 5 vgj0 omgtlr mo toxtl.
_j plntl irêtgil pere sorv gmlros Fgnux sél ls ‖iùmgkls jefgiglsls‚ ml tgpl rlltagt, uje ieto-
klrge mo jefwero useme plr gnveslros. _j Dlst GMY, quo ç l toje treteml nl iepêtufl 9, oj
jugtls iesls plmorå sor uje clrje mo gmontgieëél me prosonëe mo uj rlltagt nl sgstoje,
jes l usl mo correjontes iljl idarlltagt o raduntor ç roiljonmåvof, plgs plssgbgfgtej
eumgter l sgstoje oj busie mo plssêvogs rlltagts, quo sél noiossårgls oj uj sorvgmlr Fgnux.
Murento e gnstefeëél mo peiltos, movo-so etgver l oxoi nes pertgëÿos /ver o /tjp. Osse teroce
plmo sor cogte ilj l usl ml sirgpt nloxoi. Oj efkuns iesls, plmo sor gntorossento sljonto
etgver ls ilntrlfos emgiglnegs mo jlntekoj nl jljontl oj quo l sorvgmlr osterå sonml
prljlvgml e prlmuëél, pere quo murento l prliossl mo gnstefeëél, dljlflkeëél o tostos,
ossos ilntrlfos nél so`ej uj prlbfoje.
Ç roiljonmåvof tejbçj e etuefgzeëél mo tlml l sgstoje, nél sljonto mls peiltos quo ostél
ilj nltgieëél mo vufnorebgfgmemo, plgs entos mo gnstefer o ilnkurer ls sorvgëls pere ls
quegs so mostgne l sorv gmlr, ç l jofdlr jljontl pere etuefgzeëél iljpfote ml sgstoje.
# ept-kot gnsteff upmeto && ept-kot gnsteff ’y upkremo
Yokurenëe ml Krub
Debgfgter sonde Krub ç uje teroce roiljonmeme, quo plmo ekroker jegs veflr è sokurenëe
cêsgie, jes ç lbvgl quo osso tgpl mo prliomgjontl nél substgtug ilntrlfos tremgiglnegs mo
sokurenëe cêsgie.
Nosso jljontl, l Krub ostå oj sue toriogre vorsél, jes egnme ç iljuj tor mgstrgbugëÿos
Fgnux quo usej e sokunme vorsél.
Ne vorsél 2, e perejotrgzeëél so ilniontre oj ðngil erqugvl mo ilnkureëél, quo ç /bllt/
krub/krub.ick . E clrje mo ilnkurer uje sonde o lutrls perâjotrls nl KR_B jumlu ne
vorsél 9 mo tef clrje quo e ilnkureëél/perejotrgzeëél so mgvgmo oj vårgls erqugvls ml
mgrotùrgl ‖/oti/moceuft/krub‚.
Jumer lu gnifugr e vergåvof tgjolut:8 nl erqugvl /oti/moceuft/krub, pere nél jlstrer jonu
nl jljontl me gngigefgzeëél.
Korer desd me sonde YDE?52 plr jogl ml iljenml0
#krub-japesswm-pbamc2
Ontor pesswlrm0
Roontor pesswlrm0
Wlur XBAMC2 gs krub.pbamc2.sde?52.58888.;83E8;8IM534B;?7485M2;78I3M=
4M?I94=2B753?IC84388754IM7E=73B3BCC7IM7BB4C;I77MOI=95MC9EM8M=33;87
OIO8=5CI88I?I5B?4C88E4;7O89227?7B;.3CI?8?4885MCCI5IM3B9?C7E?ME33OM3I
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 42/282
23
D e r m o n g n k o j F
g n u x
4;=?O=777O83=O;52I7BC982O4C2?=;IM8B?75I99E9=8C227CM;7M22?2O29ICI=5=5
8I7E9988?9;O?=I7IO3C;884588
Emgiglnenml l iùmgkl mo prltoëél e sokugr nl nef ml erqugvl /oti/krub.m/88\doemor . Iùmgkl0
iet 66 OLC
sot suporusors:‚tostusor‚
pesswlrm\pbamc2 tostusor krub.pbamc2.sde?52.58888.;83E8;8IM534B;?748
5M2;78I3M=4M?I94=2B753?IC84388754IM7E=73B3BCC7IM7BB4C;I77MOI=95MC
9EM8M=33;87OIO8=5CI88I?I5B?4C88E4;7O89227?7B;.3CI?8?4885MCCI5IM3B9?C
7E?ME33OM3I4;=?O=777O83=O;52I7BC982O4C2?=;IM8B?75I99E9=8C227CM;7M22
?2O29ICI=5=58I7E9988?9;O?=I7IO3C;884588
OLC
L tostusor ç l usuårgl quo ostå sonml mongml ne ilnkureëél ml Krub, iljbgnenml e
sonde koreme pofl iljenml krub-japesswm-pbamc2.
Xere ocotgver es ilnkureëÿos, movo-so oxoiuter0
# upmeto-krub
Mosse clrje, l erqugvl /bllt /krub/krub.ick sorå roiljpgfeml o sorå emgiglneml è prltoëél.
Xrlto`e l erqugvl /bllt/krub/krub.ick 0
idjlm 388 /bllt/krub/krub.ick
idettr +g /bllt/krub/krub.ick
Xrlto`e l erqugvl /oti/krub.m/88\doemor0
idjlm 388 /oti/krub.m/88\doemor
idettr +g /oti/krub.m/88\doemor
Debgfgter sonde nes vorsÿos entgkes ml Krub (vorsÿos 5 o 2)
L erqugvl mo Ilnkureëél ml KR_B, lnmo ç plssêvof perejotrgzer sonde, ç l erqugvl /bllt/
krub/jonu.fst, utgfgzenml l perâjotrl ‖pesswlrm --jm? 6sonde>‚. E sonde ç irgeme ilj l
euxêfgl ml iljenml jm?irypt vge sdoff ml krub, lu vge l iljenml krub-jm?-irypt ne sdoff
ml sgstoje. Efçj me perejotrgzeëél me sonde, ç roiljonmåvof tejbçj eftorer e vergåvof
tgjolut:8, pere nél jlstrer jonu ml krub ne gngigefgzeëél, oxojpfl0
tgjolut:8
pesswlrm --jm? 6sonde jm?>
@å ne vorsél KR_B2, e sonde ç irgeme ilj l euxê fgl ml iljenml krub-japesswm-pbamc2, o e
perejotrgzeëél me sonde nl erqugvl 88\doemor .
Xrltokor l erqugvl /bllt/krub/jonu.fst.
idjlm 388 /bllt/krub/jonu.fst
idettr +g /bllt/krub/jonu.fst
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 43/282
2;
I e p ê t u f l 5 - R l t o g r l m o E t g v g m e m o s 5
Rltogrl mo Etgvgmemos 5
Ne pråtgie mo roilndoigjontl mes correjontes eptgncl, mobsoien o vflia, sorå noiossårgl quo
l efunl uso e jåqugne vgrtuef propereme iljl Sgrtueblx. Mosse clrje, sorå plssêvof epfgier
tlmls ls ilndoigjontls (tçingies o correjontes) mo dermongnk prlplstls etç l jljontl.
Etgvgmemo 5.5 ’ Dermongnk Fgnux ’ Eptgirln
Sorgquo so l eptgirln ostå gnstefeml, rovgso e sue ilnkureëél o tosto. Mosirove ls
iljenmls oxoiutemls o ls rosuftemls.
Etgvgmemo 5.2 ’ Dermongnk Fgnux ’ Mobsoien
Sorgquo so l mobsoien ostå gnstefeml, rovgso e sue ilnkureëél o tosto. Etuefgzo tlmls ls
peiltos quo ̀ å plssuoj ilrroëÿos mgsplnêvogs o etuefgzo e wdgtofgst. Mosirove ls iljenmls
oxoiutemls o ls rosuftemls.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 44/282
24
D e r m o n g n k o j F
g n u x
Etgvgmemo 5.9 ’ Dermongnk Fgnux ’ Mobsoien vge irln
Ilnkuro l mobsoien pere cuniglner vge irln, onvgenml sljonto gnclrjeëÿos o nlves
etuefgzeëÿos ponmontos. Mosirove ls iljenmls oxoiutemls o ls rosuftemls.
Etgvgmemo 5.= ’ Dermongnk Fgnux ’ etuefgzeëél
Roefgzo e etuefgzeëél iljpfote ml sou sgstoje Fgnux. Mosirove ls iljenmls oxoiutemls
o ls rosuftemls.
Etgvgmemo 5.? ’ Dermongnk Fgnux ’ peiltos mosnoiossårgls
Sorgquo l porjgssglnejontl mes correjontes ilnsgmoremes irêtgies, mogxenml sljonto
oxoiuëél porjgtgme pere l rllt (oxojpfl0 njep, notiet, sdrom, tipmujp, tofnot oti.).
Mosirove ls iljenmls oxoiutemls o ls rosuftemls.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 45/282
27
I e p ê t u f l 5 - R l t o g r l m o E t g v g m e m o s 5
Etgvgmemo 5.3 ’ Dermongnk Fgnux ’ vflia
Evefgo l cuniglnejontl me correjonte vflia o e ilnkureëél mls torjgnegs. Mosirove ls
iljenmls oxoiutemls o ls rosuftemls.
Etgvgmemo 5.; ’ Dermongnk Fgnux ’ rokres mo jlntekojSgsuefgzo es rokres mo jlntekons etgves. Mosirove ls iljenmls oxoiutemls o ls rosuftemls.
Etgvgmemo 5.4 ’ Dermongnk Fgnux ’ Idarlltagt raduntor
Oxoiuto l iljenml idarlltagt o l iljenml raduntor pere evefger l sgstoje, sonml quo, nl
iesl ml raduntor , utgfgzo e lpëél mo koreëél mo desd pere jofdlr pere plstorglr eumgtlrge.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 46/282
98
D e r m o n g n k o j F
g n u x
Etgvgmemo 5.7 ’ Dermongnk Fgnux ’ Besofgno
Evefgo l besofgno prlplstl (pfengfde xfs clrnoigme iljl jetorgef mo eplgl) o eprosonto sues
lbsorveëÿos. Iljl movo sor ilnkureml uj besofgno pere e sue lrkengzeëél<
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 47/282
95
I e p ê t u f l
2 - D e r m o n g n k o j s
g s t o j e F g n u x ’ I l n t r l f o s m o s o k u r e n ë e p e r e i l n t e s m o u
s u å r g l s
l b ` o t g v l s
i l n i o g t l s
2Dermongnk oj sgstoje Fgnux ’ilntrlfos mo sokurenëe pereilntes mo usuårgls
Iljproonmor o user jùmufls XEJ1 roefgzer eumgtlrge mo sondes mo usuårgls1 irger
mongëél mo usl ml sgstoje mo erqugvls1 mofoker teroces emjgngstretgves vge suml1irger porjgssglnejontls jegs ofeblremls o ejpfls ilj EIF.
_tgfgzeëél ml jùmufl XEJ1 sokurenëe mo torjgnef1 eumgtlrge mo sondes1 qulte mo
sgstoje mo erqugvls1 iljenmls vge suml1 porjgssglnejontl vge EIF.
Gntrlmuëél qJùmufls XEJ.
5 Ygnefgzemlros mo Ilntrlfo.
5 Xrliure plr sondes creies.
5 _tgfgzeëél ml @ldn tdo Rgppor.
5 _tgfgzeëél mo Uulte.
5 _tgfgzeëél mo EIF ’ Xlsgx 5o.
5 Iljenml suml (Yuporusor Ml).
5 Xrovonëél ‖Osiepo Ydoff‚.
E irgeëél mo usuårgls o krupls oj sgstojes Fgnux ç gjplrtento pere mongr quo roiursls
plmoj sor eiossemls plr quegs usuårgls o/lu krupls o egnme porjgto el Ygstoje Lpore-
iglnef koroniger e oxoiuëél mls prliossls mo ieme usuårgl mo clrje emoqueme.
Jentor l ilntrlfo ml quo sous usuårgls ostél cezonml ç uje perto cunmejontef pere
l koronigejontl mo usuårgls. L Ygstoje Lporeiglnef Fgnux plssug vårgls jùmufls quo
ejpfgej e sokurenëe o e korànige slbro sous utgfgzemlros. Emjgngstremlros soj oxporgànige
oj sokurenëe nlrjefjonto properej sous sorv gmlros ilj uje gnstefeëél båsgie o, moplgs
quo sues epfgieëÿos ostél mgsplnêvogs, nonduj prliomgjontl ç cogtl pere jentor e gntokrg-
memo ml sgstoje o ostebofoior sue trgfde mo eumgtlrge.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 48/282
92
D e r m o n g n k o j F
g n u x
Oxoriêigl mo ngvofejontl 5oIlntrlfos mo sokurenëe pere usuårgls
5. Iljl vlià evefge e noiossgmemo mo usl mo ilntrlfos ospoiêils pere roiursls mo eutontg-
ieëél oj sue lrkengzeëél<
2. Ne plfêtgie mo sokurenëe mo sue ojprose `å oxgstoj mongëÿos pere e irgeëél mo iln-
trlfos nl usl mo torjgnegs lu josjl quentl el tretejontl ml tojpl mo liglsgmemo mo
uj torjgnef<
9. Iljl vlià evefge ne sue lrkengzeëél l ilntrlfo ml usl ml roiursl mo erjezonejontl<
Oxgstoj irgtçrgls mo qultes mongmls<
=. Oj sue ojprose, oxgsto quef irgtçrgl mo eumgtlrge mo sondes pere quo so`e plssêvof gmontg-
ier sondes creies<
Ilntrlfos mo eutontgieëél ilj e utgfgzeëél ml XEJJùmufls mo Eutontgieëél Xfukåvogs (XEJ) sél uje gntorceio mo jùmufl quo ilrrosplnmo
el tgpl mo eutlrgzeëél besoeme oj uj jùmufl. _j jùmufl XEJ plmo user epones uje lu
tlmes es quetrl gntorceios plssêvogs. Osses gntorceios sél0 eiilunt, eutd, pesswlrm o sossgln.
Ieme uje mofes sorå ospoigieme nl erqugvl mo ilnkureëél mo uj sorvgël, so clr eprl-
prgeme pere l jùmufl o l emjgngstremlr moso`er user osse gntor ceio0
5 eiilunt0 osse gntorceio vorgie so uje ilnte toj eutlrgzeëél pere user l sgstoje, l quo
plmo sgkngier vorgier so oxgsto, so ostå vonigme lu so toj eiossl porjgtgml oj motor-
jgneml dlrårgl, vgniufeme e uj krupl lu etrevçs mo motorjgneml sor vgël1
5 eutd0 gntorceio quo sorvo pere eutontgier usuårgls. Gssl plmo lilrror etrevçs mo sondes,
benil mo memls lu lutrl joiengsjl. Efçj mgssl, ossos jùmufls tejbçj tàj porjgssél
pere mongr iromonigegs, iljl jojbrls mo krupl lu josjl besoemls oj tlaons Aorborls1
5 pesswlrm0 e gntorceio pesswlrm ç useme pere vorgier o mongr e eutontgieëél mo sonde
lu l irgtçrgl mo mongëél mo sonde1
5 sossgln0 ç rosplnsåvof pofe ilnkureëél o koronigejontl mo sossÿos mo usuårgl.
Xlmo gnifugr teroces mo lrkengzeëél, iljl jlnter mgrotùrgls, irger erqugvls oti.
Ilj osso roiursl, ç plssêvof euxgfger ls jçtlmls mo eutontgieëél tremgiglnegs, plssgbgfg-
tenml quo oxoiutoj nlves cunëÿos. _j blj oxojpfl ç l prlkreje mo flkgn, quo so besoge
nl /oti/pesswm o nl /oti/sdemlw ml sgstoje.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 49/282
99
I e p ê t u f l
2 - D e r m o n g n k o j s
g s t o j e F g n u x ’ I l n t r l f o s m o s o k u r e n ë e p e r e i l n t e s m o u
s u å r g l s
Jes sorå quo ossos mlgs erqugvls plssgbgfgtergej e irgeëél mo uj ilntrlfo mongnml l
dlrårgl oj quo uj motorjgneml usuårgl plmo roefgzer uj flkgn< Lu l nðjorl mo torjgnegs
sgjuftânols quo uj usuårgl plmo cezor l flkgn<
E rosplste pere osses porkuntes ç0 nél, jes l XEJ plmo cezor gssl ilj ls sous jùmufls
quo sél pfukemls el prlkreje mo flkgn. L XEJ nél cez sù gssl0 ofo plssug jugtls jùmufls
ilj cunëÿos boj mgcorontos, o nél ç sljonto el prlkreje mo flkgn quo so epfgie1 l XEJ `å
toj suplrto e jugtls prlkrejes. Mosse clrje, l usl ml XEJ oj uj prliossl mo Dermongnkmovo sojpro sor ilnsgmoreml.
Xere iortgie-so so uj motorjgneml prlkreje toj suplrto e XEJ, ç plssêvof ilnsufter so
osto clg iljpgfeml ilj suplrto e fgbpej.sl.
# fmm /bgn/su
# fmm /bgn/flkgn
# fmm /usr/sbgn/ssdm
Iljl ç plssêvof sebor so uj motorjgneml prlkreje toj suplrto el XEJ< Lutre clrje ç
eiosser l mgrotùrgl /oti/pej.m . Montrl mosso mgrotùrgl, movo oxgstgr uj erqugvl ilj l nljoml prlkreje. Nl ontentl, osse nél ç uje rokre ebslfute.
Xlr oxojpfl, vo`ejls so oxgsto uj erqugvl idejeml flkgn montrl ml /oti/pej.m.
# fs -f /oti/pej.m
So`e iljl oxojpfl l erqugvl flkgn. Oxgstoj jugtls lutrls tejbçj. Efkuns sorél eblrmemls
jegs è cronto.
Ygnefgzemlros mo ilntrlfo
Xere ieme gntorceio, l erqugvl mo ilnkureëél ospoigie uj sgnefgzemlr mo ilntrlfo, quo
motorjgne l quo l XEJ cerå oj sokugme, ilj beso nl rosufteml me vorgieëél roefgzeme.
Oxgstoj quetrl sgnefgzemlros mo ilntrlfo0 lptglnef, roqugrom, roqugsgto o suigont0
5 lptglnef0 ls jùmufls lpiglnegs nél ecotej l suiossl noj e cefde me eutontgieëél, e
jonls quo nél de`e lutrls jùmufls pere motorjgneme gntorceio1
5 roqugrom0 pere quo l usuårgl plsse ilntgnuer, movorå sor rotlrneml uj rosufteml mo
suiossl. E nltgieëél mo usuårgl nél lilrro etç tlmls ls jùmufls pere uje gntorceio
osteroj setgscogtls1
5 roqugsgto0 l usuårgl sù plmorå ilntgnuer so l jùmufl rosufter ilj suiossl. E nltgieëél
ml usuårgl eilntoio gjomgetejonto oj iesl mo cefde nl prgjogrl jùmufl roqugsgto lu
roqugrom mo uje gntorceio1
5 suigont0 uj rosufteml mo suiossl iljbgneml soj cefdes ml jùmufl roqugrom lu
roqugsgto vgebgfgze uje ble eutontgieëél, prossuplnml quo nonduj lutrl jùmufl vgrå e
sokugr. E cefde mo uj jùmufl suigont ç gknlreme.
Iejgndl ml jùmufl
L iejgndl ml jùmufl gnclrje el XEJ e fliefgzeëél ml jùmufl. Nlrjefjonto, ç uj nljo
mo iejgndl iljpfotl, quo ilntçj l nljo o e oxtonsél ml jùmufl, iljl /fgb/soiurgt y/
pej\ungx.sl. Yo nél clr ospoigieml uj iejgndl, l XEJ essujo iljl pemrél /fgb/soiurgty
pere plmor fliefgzer l jùmufl.
Yegbe jegs
Efçj mo sor perto mejeglrge mes mgstrg-
bugëÿos Fgnux, osso
roiursl tejbçj ç
onilntreml oj lutrls
sgstojes, iljl Ylfergs.
f
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 50/282
9=
D e r m o n g n k o j F
g n u x
Xej\tgjo
Ç uje ble pråtgie oj sgstoje Fgao _ngx nél mogxer l flkgn iljl rllt debgfgteml pere
ilnoxél mgrote. L gmoef ç e oxoiuëél ml ‖flkgn‚ ilj uj usuårgl iljuj gngigefjonto, o
moplgs lbtor eiossl iljl rllt quenml proigser oxoiuter efkuje teroce emjgngstretgve.
_senml uj ilniogtl mo eutontgieëél oj mues iejemes, l quo kore uje ilntrejomgme
ilntre etequos mo clrëe brute, mostgneml el usuårgl rllt.
Clg jlstreml quo ç plssêvof trever l flkgn mo rllt oj tlmls ls torjgnegs iljontenml es
fgndes mls torjgnegs nl erqugvl /oti/soiurotty . Lutre clrje gntorossento pere irger uj iln-
trlfo pere e ilnte ml usuårgl rllt ç ‖mosiljonter‚ e fgnde quo rocoro-so e pej\tgjo.sl pere
bflquoer l flkgn mo rllt utgfgzenml l ilniogtl besoeml dlrårgl mo eiossl.
Omgto l erqugvl /oti/pej.m/flkgn o ‖mosiljonto‚ e sokugnto fgnde0
# vg /oti/pej.m/flkgn
eiilunt roqugsgto pej\tgjo.sl
Osse fgnde ostå tretenml me ilnte mls usuårgls (eiilunt) ilj l jùmufl pej\tgjo.sl. Etç
equg osse fgnde nél ostå cezonml neme, plgs e jeglrge mls jùmufls ml XEJ moponmo mo uj
erqugvl mo ilnkureëél emgiglnef.
L jùmufl pej\tgjo.sl trebefde oj iln`untl ilj l erqugvl /oti/soiurgty/tgjo.ilnc pofl
nljo ml jùmufl o ml erqugvl mo ilnkureëél.
Xere mongr l dlrårgl mo eiossl, movo-so omgter l erqugvl /oti/soiurgty/t gjo.ilnc o eiros-
ionter e sokugnto fgnde nl nef ml erqugvl0
# vg /oti/soiurgty/tgjo.ilnc
flkgn1tty*1rllt1!Ef8888-29?7
Lnmo0
5 flkgn0 gnmgie l sorvgël1
5 tty*0 gnmgie ls torjgnegs lnmo e plfêtgie sorå epfgieme1
5 rllt0 motorjgne quo e plfêtgie sorå epfgieme pere l usuårgl rllt.
5 !Ef8888-29?70 gnmgie l dlrårgl porjgtgml. L iereitoro ‖!‚ ostebofoio quo equofo
dlrårgl nél ç porjgtgml.
Ygntexo0 sorvgios1ttys1usors1tgjos
Ilj osse ilnkureëél, ostå mongml quo l rllt nél plmo ocotuer flkgn oj nonduj
torjgnef, oj nonduj mge lu dlrårgl. Mosse jenogre, irge-so uj ilntrlfo quo bflquoge e
usuårgl rllt pere quo osto nél tonde eiossl mgrotl el ‖flkgn‚ ml sgstoje.
Xere vefgmer l ilntrlfo, beste tonter roefgzer uj flkgn oj lutrl torjgnef iljl rllt, l quo nél
movorå lilrror. ]lmevge, osse prlplste gjekgne quo devorå uj usuårgl mongml quo torå eiossl el
roiursl flkgn o, e pertgr mofo, sorå porjgtgml user l iljenml su lu suml pere user e ilnte ml rllt.
Xej\fgjgt
E sokugr sorå jlstreml iljl mongr uje plfêtgie pere nél porjgtgr quo uj usuårgl ceëe
flkgn oj jegs mo uj ilnslfo, ilnsoiutgvejonto ilj e utgfgzeëél me bgbfgltoie pej\fgjgts.sl.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 51/282
9?
I e p ê t u f l
2 - D e r m o n g n k o j s
g s t o j e F g n u x ’ I l n t r l f o s m o s o k u r e n ë e p e r e i l n t e s m o u
s u å r g l s
Xrgjogrl ç proigsl debgfgter l jùmufl quo veg plssgbgfgter e utgfgzeëél mosso roiursl. Xere
gssl, ç noiossårgl omgter l /oti/pej.m/flkgn o gnsorgr e fgnde e sokugr0
# vg /oti/pej.m/flkgn
sossgln roqugrom pej\fgjgts.sl
Ilj l jùmufl debgfgteml, tojls mo omgter l erqugvl mo ilnkureëél emgiglnef mosso
jùmufl. Ne soquànige, movo-so gr etç l mgrotùrgl /oti/soiurgty , omgter l erqugvl fgjgts.ilnc ognsorgr e sokugnto fgnde0
# vg /oti/soiurgty/fgjgts.ilnc
usuårgl derm jexflkgns 5
Ilj gssl, ç irgeml uj ilntrlfo quo fgjgte l usuårgl pere quo utgfgzo sljonto uj torjgnef.
Xere toster, beste oxoiuter l ‖flkgn‚ oj uj torjgnef ilj l usuårgl o tonter ocotuer flkgn oj
lutrl sgjuftenoejonto.
Lutre utgfgzeëél me bgbfgltoie pej\fgjgts.sl ç e perejotrgzeëél pere fgjgter ls prliossls
mls usuårgls lu uj krupl, l quo ç gjplrtento pere e oxoiuëél mo uj sgstoje oståvof.
Oxojpfgieëél pere ilgbgr uj clrabljb0
rnpemjgn derm nprli 988
Hsystofilj derm nprli 5?8
H sysprgntors slct nprli 588
Hsyslp derm nprli 288
Nosse perejotrgzeëél, ilu mongml quo jojbrls mo uj krupl mo ostumentos plmorél
ebrgr 5?8 prliossls1 jojbrls ml krupl sysprgntors, 5881 o syslp, 288 prliossls. @å l
usuårgl rnpemjgn plmorå irger etç 988 prliossls. ]lmevge, osso tgpl mo ilnkureëél movosor boj evefgeml, pere quo so`e mgjonsglneml l nðjorl mo prliossl gmoef.
Xej\wdoof
Nosse oxojpfgieëél, sorå useml iljl oxojpfl uj usuårgl monljgneml tllr o uj krupl
monljgneml ‖emjgngstremlros‚, cogtls pere irger jegs uje iejeme mo ilntrlfo ilj l lb`o-
tgvl mo eujonter egnme jegs e sokurenëe ne eutontgieëél0
# emmusor tllr
# krlupemm emjgngstremlros
# usorjlm ’K tllr emjgngstremlrosE prlplste ç sljer el prliomgjontl mo fgjgteëél mo ‖flkgns‚, `å joniglneml, uje plfêtgie
quo nél porjgte l usl ml iljenml su plr quefquor usuårgl, plssgbgfgtenml l usl ml su
sljonto pere ls usuårgls ml krupl emjgngstremlros.
Osse ilnkureëél veg sorå pluil mgcoronto mes lutres, plgs nél proigse mo uj erqugvl mo
ilnkureëél emgiglnef. Beste fgjgter e utgfgzeëél ml prlkreje su, ilj e omgëél ml erqugvl
su, quo ostå montrl ml mgrotùrgl /oti/pej.m .
# vg /oti/pej.m/su
eutd roqugrom pej\wdoof.sl krlup:emjgngstremlros
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 52/282
93
D e r m o n g n k o j F
g n u x
Osse ilnkureëél trete e eutontgieëél ml usuårgl (eutd) ilj l jùmufl pej\wdoof.sl,
utgfgzenml l krupl emjgngstremlros. _je voz perejotrgzeml, sljonto usuårgls quo porton-
ioroj el krupl emjgngstremlros ç quo plmorél user l iljenml su.
Xere toster, oxoiuto l ‖flkgn‚ ilj l usuårgl tllr oj uj torjgnef o ilj l tux oj lutrl.
Ontél ç noiossårgl tonter cezor l su ilj ls mlgs usuårgls. Iesl es ilnkureëÿos tondl sgml
cogtes mo clrje ilrrote, sorå lbsor veml quo sljonto l usuårgl tllr ilnsokugrå, plgs sù ofo
portonio el krupl emjgngstremlros.
Xlr quostÿos mo sokurenëe, tlme e etgvgmemo ml iljenml su movo sor jlngtlreme. Ls prliomg-
jontls e sokugr sorvoj pere rokgstrer oj erqugvl mo flk l usl ml iljenml su pofls usuårgls.
Jlmgquo l erqugvl /oti/flkgn.mocs o ‖mosiljonto‚ e sokugnto fgnde0
Y_FLK\CGFO /ver/flk/suflk
Flkl oj sokugme, ç noiossårgl irger l erqugvl suflk oj /ver/flk .
# tluid /ver/flk/suflk
Xere vefgmeëél, movo-so cezor uj tosto o user oj perefofl l iljenml tegf pere jofdlr
vgsuefgzeëél ml flk, plmonml-so mosvger e seême pemrél ml erqugvl pere vor l ilntoðml ml
erqugvl mo flk oj tojpl roef, pere uj motorjgneml torjgnef. Nl oxojpfl clg osilfdgml l
torjgnef 52.
# tegf -c /ver/flk/suflk > /mov/tty52 &
Ne soquànige, movojls ocotuer flkgn ilj l usuårgl tllr o user l iljenml su pere eftorner
pere l usuårgl rllt.
$ su
Cogtl gssl, vgsuefgzo ls rokgstrls ml flk nl torjgnef 52.
Ilj efkuns e`ustos nls erqugvls mo ilnkureëél ml XEJ, ç plssêvof fgjgter bestento ls
prgvgfçkgls iljuns o etç josjl fgjgter l prùprgl rllt, l quo oj jugtes sgtueëÿos plmo
sor ðtgf. Yonml tejbçj plssêvof cezor osses o lutres ilnkureëÿos utgfgzenml l XEJ, l quo
e`ume uj sysemjgn e tor krenmo ilntrlfo o jlstre quo l usl ml roiursl XEJ ç uje krenmo
correjonte pere koroniger prgvgfçkgls.
Oxoriêigl mo cgxeëél 5oXEJ
5. Igto mues vufnorebgfgmemos ilndoigmes nls sorvgmlros me sue lrkengzeëél, rofeiglnemes è
eutontgieëél, quo l roiursl ml XEJ plmo jgtgker.
2. Oxgstoj mongëÿos rostrgtgves ml usl ml iljenml su nls sorv gmlros mo sue lrkengzeëél<
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 53/282
9;
I e p ê t u f l
2 - D e r m o n g n k o j s
g s t o j e F g n u x ’ I l n t r l f o s m o s o k u r e n ë e p e r e i l n t e s m o u
s u å r g l s
Xrliure plr sondes creies
E sonde mo flkgn mo uj usuårgl ç efkl posslef0 noj josjl ls emjgngstremlros movoj
sebor es sondes mls usuårgls. Nlrjefjonto, quenml es ilntes mo usuårgl sél iemestremes
oj uj sgstoje, lu l iemestrl ç cogtl ilj uje sonde gngigef quo movorå sor trlieme nl prg-
jogrl flkgn ocotueml pofls usuårgls lu, oj efkuns iesls, l emjgngstremlr slfgigte el usuårgl
quo mgkgto e sonde. Ontrotentl, so nél oxgstoj ilntrlfos quo monoj l irgtçrgl pere tor uje
sonde clrto, irge-so e lplrtungmemo pere l usuårgl mgkgter uje sonde creie, quo plmo sor
tltefjonto iljplste plr nðjorls o ilj pluils mêkgtls, pefevres oxgstontos oj mgiglnårgls
mo brutoclrio o etç josjl uje mete sgjbùfgie. Osses sél sondes jugtl cåiogs mo soroj
mosilbortes, ès vozos noj sonml noiossårgl uj prlkreje mo brutoclrio (Clrëe Brute)
ofeblreml pere soroj quobremes.
Xere roefgzer osso trebefdl mo eumgtlrge oj busie mo sondes creies, plmo sor gntorossento
user uje correjonte me josje ietoklrge o cuniglnefgmemo utgfgzeme plr uj ireiaor.
Nl junml _ngx, e correjonte roiljonmeme pere osse teroce ç l @ldn tdo R gppor.
_tgfgzeëél ml @ldn tdo Rgppor
L @ldn tdo Rgppor ç uje correjonte mo brutoclrio ifåssgie ml junml _ngx, quo tonte
mosilbrgr es sondes ml erqugvl /oti/sdemlw usenml uje [lrmFgst (fgste ilj sondes e soroj
tontemes) pemrél quo plmo sor gnirojonteme lu useme renmljgiejonto.
Ç cetl quo, quenml e sonde ml usuårgl clr jef ofeblreme o ostgvor ilntgme nl
mgiglnårgl, lu josjl so e sonde clr gkuef el flkgn, sorå ceigfjonto mosilborte
plr osse correjonte.
Ç gjplrtento mosteier quo uje correjonte iljl l @ldn tdo Rgppor nél ç l tgpl mo corre-
jonte quo so movo mogxer gnstefeme oj uj sorvgmlr. Gssl sorge l josjl quo coider e plrtemo iese, jes mogxer uj pç-mo-iebre ojbegxl ml tepoto. Ç roiljonmåvof sojpro ilflier cor-
rejontes mosso tgpl oj lutre jåqugne, lu so`e, e jåqugne ml prùprgl emjgngstremlr. Xere
eumgter, beste ilpger l /oti/sdemlw ml sorvgmlr pere e jåqugne ml emjgngstremlr o tostå-fl.
Xere roefgzer uj oxporgjontl pere iljproonmor l cuniglnejontl ml @ldn tdo Rgppor, irgo
uj usuårgl idejeml ‖tosto‚, mongnml e sonde iljl 529=?3. Gnstefo l @ldn tdo R gppor.
# emmusor tosto
# ept-kot gnsteff ̀ ldn
Ilj l @ldn tdo Rgppor gnstefeml, ontro nl mgrotùrgl /usr/sdero/`ldn o vgsuefgzo l erqugvl mo
[lrmFgst idejeml pesswlrm.fst .
# im /usr/sdero/`ldn
# iet pesswlrm.fst
Ç gntorossento, sojpro quo roefgzer uje eumgtlrge oj busie mo sondes creies, gnirojonter
osse [lrmFgst, tlrnenml e busie egnme jegs roneme. Lutre plssgbgfgmemo ç gnirojonter e
[lrmFgst ilj lutres mgsplnêvogs ne gntornot.
Ilpgo l /oti/sdemlw ml sorvgmlr pere l /rllt me jåqugne ml emjgngstremlr pere ilflier
l @ldn tdo Rgppor oj eëél. Xlmo-so ilpger l erqugvl vge sip (utgfgtårgl ml ssd pere cezor
iùpges rojltes).
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 54/282
94
D e r m o n g n k o j F
g n u x
# sip rlltHGX\ml\Yorvgmlr0/oti/sdemlw /rllt
Ilj l /oti/sdemlw , oxoiuto l tosto ml @ldn tdo R gppor.
# `ldn /rllt/sdemlw
Yorå poriobgml quo sondes creies sél quobremes ceigfjonto. ]lmes osses sondes quo l
@ldn tdo R gppor mosilbro sél erjezonemes oj uj erqugvl idejeml `ldn.plt , nl mgrotùrgl
/usr/sdero/`ldn.
Ontél, so clr noiossårgl cezor e vorgieëél nlvejonto, movo-so epeker osso erqugvl.
# rj -c `ldn.plt
# `ldn /rllt/sdemlw
Ilj osso oxporgjontl ç quo poriobojls quo sondes creies oj uj sorvgmlr sél uj krenmo
prlbfoje, jes ilj uje sgjpfos correjonte plmo-so mosilbrgr es sondes creies. Movojls
cezor osso tgpl vorgieëél mo tojpls oj tojpls, iesl ls usuårgls jumoj es sondes ilj
croquànige. Yo mogxerjls ls usuårgls ilj sondes creies, torojls uje krenmo plrte mo
ontreme pere uj ireiaor.
_tgfgzeëél mo qulte
L roiursl mo qulte ç uje correjonte gjplrtento pere mongr ilntrlfo ilj l clil ml usl
ml roiursl. Nosso iesl, l sgstoje mo erqugvls. Mosse clrje, user qulte ç jegs uj veflr mo
sokurenëe e pertgr ml Ygstoje mo erqugvls, sonml uj mofos l mo ilntrlfer e utgfgzeëél mls
sgstojes mo erqugvls ontro tlmls ls usuårgls, irgenml ilntrlfos quo gjpoëej uj ðngil
usuårgl mo tor plmor mo osirgte oj sou mgrotùrgl posslef lu oxiomor ls fgjgtos cêsgils mo
ospeël oj uj sgstoje mo erqugvls, iljprljotonml e sue utgfgzeëél pofls lutrls usuårgls.
Efçj mgssl, tef prliomgjontl e`umerå bestento e tor uj beiaup mo tejendl ilntrlfeml.
Xere iljoëer e ilnkureëél ml roiursl mo qulte, movojls gmontgier quegs ls perâjotrls
mo jlntekoj ml mgrotùrgl, nosto oxojpfl, l mgrotùrgl /dljo.
# jlunt
L roiursl qulte movo sor ospoigieml pere pertgëÿos o nél pere mgrotùrgls, l quo mojenme
e omgëél ml erqugvl /oti/c steb (sgstojes mo erqugvls jlntemls) pere ilnkurer e pertgëél
quo movo tor suplrto, iesl gssl nél tonde lilrrgml murento e gnstefeëél. So`e l oxojpfl0
# vg /oti/csteb
/mov/dme3 /dljo oxt9 moceufts,usrqulte,krpqulte 8 2
Nl quertl iejpl me fgnde, tojls es lpëÿos quo perejotrgzej e clrje iljl e per tgëélsorå jlnteme. Movojls user l perâjotrl usrqulte pere ilnkurer qultes pere usuårgls o
krpqulte pere ilnkureëél mo qultes pere krupls mo usuårgls.
Epùs e perejotrgzeëél ml /oti/c steb ç noiossårgl ontrer nl plntl mo jlntekoj me pertgëél
ospoigieme, nl nlssl iesl, /dljo, o irger ls mlgs erqugvls mo ilntrlfo mo qulte0
5 equlte.usor0 koronige qultes pere ls usuårgls1
5 equlte.krlup0 koronige qultes pere ls krupls.
Ilnclrjo e oxojpfgieëél, l sgstoje Fgnux etuefjonto trebefde ilj l U_L]E 2, quo ç uje
ovlfuëél ml entgkl sgstoje mo qultes mgsplnêvof nl Fgnux.
Yegbe jegs
Uuenml e gnstefeëélml @ldn tdo Rgppor ç
roefgzeme e pertgr mo ujpeilto prç-iljpgfeml,
l erqugvl `ldn.plt ienl mgrotùrgl .`ldn, ne
dljo ml usuårgl.
f
Bles pråtgies
roiljonmemes ne
EBN] NBR GYL/GOI2;882028840 l usl ml
@ldn tdo Rgpportlrne-so uje lpëél
gntorossento nl quo mgz
rospogtl el prliossl
mo eumgtlrge mo sondes.Xere busier ilnclrjg-
memo ilj ls gtons
55.?.9 o 55.9.5, çlrgonteml quo es
sondes so`ej
ilntrlfemes etrevçs mo
uj prliossl mo
koronigejontl clrjef o
quo ls usuårgls so`ej
slfgigtemls e sokugr
bles pråtgies mosokurenëe me gnclr-
jeëél ne sofoëél o nl
usl mo sondes.
m
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 55/282
97
I e p ê t u f l
2 - D e r m o n g n k o j s
g s t o j e F g n u x ’ I l n t r l f o s m o s o k u r e n ë e p e r e i l n t e s m o u
s u å r g l s
# ept-kot gnsteff qulte
# im /dljo
# qulteidoia ’vekujC
# /oti/gngt.m/qulte stlp
# /oti/gngt.m/qulte stert
Ls erqugvls mo ilntrlfo mo qulte movoj tor sues porjgssÿos jlmgiemes mo jenogre quo
sù l rllt tonde porjgssél mo fogture o kreveëél slbro ofos, lu so`e, l veflr 388, ilnclrjo l
oxojpfl nls iljenmls0
# idjlm 388 qulte.usor
# idjlm 388 qulte.krlup
Epùs gssl, movojls rojlnter l sgstoje mo erqugvls pere quo es ilnkureëÿos mo qulte
pere e pertgëél ontroj oj vgklr. ]lmevge, iljl ne jeglrge mes vozos l sgstoje mo erqugvls
osterå liupeml ilj prliossl vgniufeml è pertgëél, ç roiljonmåvof quo so`e rogngigeml l
sgstoje. Xere tentl, movojls mgkgter l iljenml ‖robllt‚0
# robllt
Xere vorgier l sgstoje epùs gngigefgzer, movojls oxoiuter l iljenml ropqulte pere iln-
sufter l stetus mo qulte pere equofe pertgëél lu pertgëÿos.
# ropqulte -v -e -s
Xere oxojpfgier l usl mo ilnte, sorå mojlnstreml l usl ml roiursl ilj l usuårgl
idejeml ‖tuxrnp‚, quo sorå irgeml pere osso prlpùsgtl. Fojbrejls quo ç plssêvof mongr
qulte mo mues jenogres, plr tejendl o plr quentgmemo mo erqugvls. Nosto prgjogrl
oxojpfl sorå ilnkureme e qulte plr tejendl.
Irgeëél ml usuårgl0
# emmusor tuxrnp5
Mongëél mo quentl ml sgstoje mo erqugvls l usuårgl ‖tuxrnp‚ plmorå user. L iljenml
pere ilnkurer qultes ç l omqulte.
# omqulte -u tuxrnp5
Yorél mongmes qultes pere l usuårgl, ostebofoionml l fgjgto mo 98 JB mo ospeël oj mgsil
o fgjgto jåxgjl mo =8 JB.
Mgsa qultes clr usor tuxrnp (ugm 5887)0
Cgfosystoj bflias slct derm gnlmos slct derm
/mov/dme3 98888 =8888 8 8 8
Lnmo0
5 bflias0 nðjorl mo bflils ut gfgzemls pofl usuårgl ’ 5J oqugvefo jegs lu jonls e
5.888 bflils1
5 slct fgjgt0 fgjgto oj bflils quo l usuårgl plmorå utgfgzer (l fgjgto jåxgjl ç mongml
oj derm fgjgt)1
Yegbe jegs
E qulte ml usuårgl soråmo 98 JB, jes ofo torå
uj ‖býnus‚ mo 58 JB
plr uj motorjgneml
tojpl (idejeml mo
kreio porglm), tltefg-
zenml =8 JB.
f
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 56/282
=8
D e r m o n g n k o j F
g n u x
5 derm fgjgt0 fgjgto oj bflils quo l usuårgl plmorå user ’ veflr quo nunie ç uftrepesseml.
Ilnsufto l stetus koref mls usuårgls `å mongmls, gnifusgvo pere tuxrnp.
# ropqulte -v ’e -s
Ilnsufte mo gnclrjeëÿos mo qulte ml usuårgl tuxrnp.
# qulte -u tuxrnp5L kreio porglm nél ç xl, o plmo sor jumeml ilnclrjo e nlsse noiossgmemo.
# omqulte ’t
Oxoriêigl mo cgxeëél 2oUulte
5. Igto mues vufnorebgfgmemos ilndoigmes nls oqugpejontls sorvgmlros me sue lrkengzeëél.
Xere cezor uj tosto, ocotuo flkgn oj lutrl torjgnef, iljl usuårgl tuxrnp. Yorå oxojpfg-
ieml uj sirgpt quo plmo sor idejeml mo ‖flte mgsil‚, quo eujonterå l tejendl mo uj
erqugvl etç ostlurer l fgjgto prç-mongml mo qulte.
$ oidl tosto > e1 wdgfo truo1 ml iet e >> b1 iet b >> e1 mlno
Moplgs me oxoiuëél ml sirgpt ilj l fgjgto me qulte ostlureml, beste vlfter el torjgnef ml
rllt o oxejgner l stetus me qulte.
# ropqulte -v -e
Xere uje sokunme oxojpfgieëél, sù quo eklre usenml lutrl jçtlml, l me qulte plrquentgmemo, sorå irgeml lutrl usuårgl.
# emmusor rnptosto
# emmusor tuxrnp2
Yorél mongmes qultes pere l usuårgl tuxrnp20 fgjgto mo ?8 erqugvls, ilj l jåxgjl
idokenml e 38 erqugvls.
# omqulte -u tuxrnp2
Mgsa qultes clr usor tux2 (ugm 5887)0
Cgfosystoj bflias slct derm gnlmos slct derm
/mov/dme3 8 8 8 8 ?8 38
E qulte ml usuårgl sorå mo ?8 erqugvls, jes ofo torå uj ‖býnus‚ mo 58 erqugvls,
gnmoponmonto ml tejendl, plr uj motorjgneml tojpl.
Lnmo0
5 gnlmos0 nðjorl mo gnlmos (erqugvls utgfgzemls pofl usuårgl)1
5 slct fgjgt0 nðjorl mo gnlmos (erqugvls) quo l usuårgl plmorå irger1
Yegbe jegs
Kreio porglm ç uj
porêlml mo tlforânige
oj quo l usuårgl,
epùs tor ostlureml sue
qulte, roioborå evgsls
mo quo uftrepesslu
sou slct fgjgt, o quomovo tljer efkuje
prlvgmànige pere vlfter
e rospogter sou fgjgto
mo qulte. Ontrotentl, çvåfgml fojbrer quo osso
porêlml mo tlforânige
nél so epfgie el derm
fgjgt, plgs, uje voz
quo l veflr mo derm
fgjgt so`e suporeml,
l sgstoje nél jegs
porjgtgrå kreveëél mo
erqugvls, gnmoponmonto
ml veflr ml kreio
porglm. L kreio porglmpemrél ç mo ; mges.
f
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 57/282
=5
I e p ê t u f l
2 - D e r m o n g n k o j s
g s t o j e F g n u x ’ I l n t r l f o s m o s o k u r e n ë e p e r e i l n t e s m o u
s u å r g l s
5 derm fgjgt0 nðjorl jåxgjl mo gnlmos quo l usuårgl plmorå irger.
Ilnsufto l stetus mosso usuårgl0
# ropqulte -v -e -s
Ilnsufto e qulte ml usuårgl tux20
# qulte -u rnptosto# qulte -u tuxrnp2
Xere vefgmer e ilnkureëél, beste roefgzer uj tosto ilj uj sirgpt. L gmoef ç ocotuer flkgn oj
lutrl torjgnef iljl usuårgl tuxrnp2 o rlmer l sirgpt, quo plmo sor idejeml mo sirgpt kore-
-erqugvls, pere korer ontremes mo erqugvls etç ostlurer l fgjgto mongml pofe qulte.
$ g:51 wdgfo truo 1 ml tluid $g1 fot g++1 mlno
Moplgs quo e qulte ostlurer, beste vlfter el torjgnef ml rllt o oxejgner l stetus me qulte.
# ropqulte -v -e
Xlmojls vorgier ls motefdos jegs evenëemls slbro l usl mes qultes nes pertgëÿos.
# qultestets
Iesl so`e noiossårgl mosetgver l roiursl mo qulte mo uje pertgëél, beste user l iljenml
qultel 0
# qultelcc -v /dljo
Lnmo0
5 -v0 oxgbo jonsekons pere ieme sgstoje mo erqugvls lnmo es qultes mo mgsil sél etgvemes.
Xere cezor uje vorgieëél ne qulte me pertgëél, pere vor so ostå tuml boj0
# qulteidoia -viuk /dljo
Etgvo e qulte me pertgëél nlvejonto0
# qulteln -v /dljo
_tgfgzeëél mo EIF ’ Xlsgx 5o
L roiursl mo EIF etonmo efkujes mes mgrotrgzos mo sokurenëe prlplstes nl Xlsgx 5o,
irgenml e plssgbgfgmemo mo tretetgves mo mgrogtls jegs ejpfes pere uj erqugvl lu mgrotùrgl
oj uj sgstoje Fgao _ngx. Yoj l usl mo EIF, oxgstoj fgjgteëÿos iljpfgiemes iljl, plr
oxojpfl, e sgjpfos teroce mo mongr sokurenëe mo krupl pere uj erqugvl, plgs etrevçs mlsmgrogtls ç plssêvof sljonto tor uj krupl, ilnclrjo gfustreml0
- rwx r--r-- 5 rllt emjgn =873 2859-89-84 8?088 erqugvl.ilnc
Nl oxojpfl, vojls quo rwx mono l mgrogtl ml mlnl quo ç l usuårgl rllt1 r-- mono l
mgrogtl ml krupl quo ç emjgn, o r-- mono l mgrogtl mo lutrls usuårgls slbro l erqugvl.
Osso ilniogtl mo porjgssglnejontl eiebe, oj ejbgontos jegs iljpfoxls, sonml uj fgjg-
temlr, plgs sù ç plssêvof mongr uj ðngil krupl.
Nosso ionårgl, iesl so`e noiossårgl etrgbugr mgrogtls e lutrl krupl lu jumer l krupl etuef
ml erqugvl, l quo trez uje fgjgteëél pere l sysemjgn. Ojblre egnme oxgste e plssgbgfgmemo
Xlsgx 5o
Xlsgx (eirýngjl pere
Xlrtebfo LporetgnkYystoj Gntorceio, quo
plmo sor tremuzgml
iljl Gntorceio Xlrtåvof
ontro Ygstojes Lpore-
iglnegs) ç uje cejêfge
mo nlrjes mocgngmes
pofl GOOO o mosgkneme
clrjefjonto plr GOOO
5889, quo toj iljl
lb`otgvl kerentgr e plr-
tebgfgmemo ml iùmgkl-
-clnto mo uj prlkreje
e pertgr mo uj Ygstoje
Lporeiglnef quo etonmees nlrjes Xlsgx pere
lutrl sgstoje Xlsgx.Mosse clrje, es rokres
etuej iljl uje gntor-
ceio ontro Ygstojes
Lporeiglnegs mgstgntls.E mosgkneëél gntorne-
iglnef me nlrje ç
GYL/GOI 77=?.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 58/282
=2
D e r m o n g n k o j F
g n u x
mo jengpufer es porjgssÿos ilnsgmorenml l mgrogtl mo ‖lutrls‚, oj jugtls iesls gssl nél veg
roslfvor l prlbfoje me fgjgteëél mo sor plssêvof etrgbugr irgtçrgls mo porjgssglnejontl ilnsgmo-
renml0 ‖l mlnl, l krupl o lutrls‚. Mgento mgssl, l quo cezor< E rosplste ç etgver l roiursl mo eif
nl sgstoje mo erqugvl, l quo trerå krenmo oxgbgfgmemo pere mongëél mo porjgssglnejontl.
E gjpfojonteëél ml roiursl mo EIF oj sgstoje Fgao _ngx `å oxgsto då efkuj tojpl nl
aornof ml Fgnux. Mosmo e sçrgo 2.=, mo 5777, `å ore plssêvof, etrevçs mo epfgieëél mo petidos,
jes `å ne vorsél 2.?.=3 (mosonvlfvgjontl) pesslu e sor uj roiursl tltefjonto gntokreml elaornof. Mosse clrje, e sçrgo 2.3 `å segrå ilj pfonl suplrto e EIF.
Ç sgjpfos ilnrjer quo l aornof mo uje motorjgneme mgstrgbugëél ostå ilj suplrto e EIF0
beste ilnsufter es gnclrjeëÿos ml erqugvl /bllt /ilnk6aornof vorsgln>.
# unejo -e
Fgnux dermongnk 9.2.8-27-konorgi #=3-_buntu YJX Crg @uf 2; 5;089029
_]I 2852 x43\3= x43\3= x43\3= KN_/Fgnux
# unejo -r
9.2.8-27-konorgi
# krop -g eif /bllt/ilncgk-9.2.8-27-konorgi
ILNCGK\OT]2\CY\XLYGT\EIF:y
ILNCGK\OT]9\CY\XLYGT\EIF:y
ILNCGK\OT]=\CY\XLYGT\EIF:y
ILNCGK\ROGYORCY\CY\XLYGT\EIF:y
ILNCGK\@CY\XLYGT\EIF:y
ILNCGK\TCY\XLYGT\EIF:y
ILNCGK\B]RCY\CY\XLYGT\EIF:y
ILNCGK\CY\XLYGT\EIF:y
ILNCGK\KONORGI\EIF:y
ILNCGK\]JXCY\XLYGT\EIF:y
ILNCGK\NCY\S9\EIF:y
ILNCGK\NCYM\S2\EIF:y
ILNCGK\NCYM\S9\EIF:yILNCGK\NCY\EIF\Y_XXLR]:j
# ILNCGK\IGCY\EIF gs nlt sot
ILNCGK\7X\CY\XLYGT\EIF:y
Ojblre tondejls l roiursl nl aornof, sél noiossårges es correjontes ne usorfenm pere
emjgngstreëél ml roiursl mo EIF. Xere gnstefer es correjontes mo emjgngstreëél mo EIF oj
mgstrgbugëél fgao mobgen, iljl _buntu, plmojls user l iljenml eptgtumo lu ept -0
# ept-kot upmeto
# ept-kot gnsteff eif
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 59/282
=9
I e p ê t u f l
2 - D e r m o n g n k o j s
g s t o j e F g n u x ’ I l n t r l f o s m o s o k u r e n ë e p e r e i l n t e s m o u
s u å r g l s
Debgfgteëél ml suplrto el roiursl mo EIF
Xere user l EIF, movojls perejotrgzer e pertgëél moso`eme nl /oti/c steb lu rojlnter e per-
tgëél ilj suplrto e EIF. Nl ontentl, rojlnter debgfgte l roiursl oj tojpl mo oxoiuëél.
Xerejotrgzer vge /oti/csteb kerento quo tlme voz quo l sor vgmlr clr gngigefgzeml, l roiursl
sorå etgveml. Mosse clrje, ç noiossårgl omgter l erqugvl /oti/c steb o emgiglner l perâjotrl
‖eif‚ nes lpëÿos ml sgstoje mo erqugvl moso`eml0
# vgj /oti/csteb
/mov/sme3 /ver/flk oxt= moceuft,nloxoi,nlsugm,nletgjo,eif 8 2
Ilnclrjo `å gnclrjeml, osse perejotrgzeëél sù torå ocogtl nl prùxgjl bllt. Xere etgver l
suplrto nl jljontl me oxoiuëél, oxoiuto l iljenml jlunt pere rojlnter e pertgëél0
# jlunt -l rojlunt,eif /ver/flk
# fs ’f /ver/flk
Ne fgste ml fs ’f /ver/flk, efçj mls nlvo mêkgtls mo mgrogtls, tejbçj devorå uj sgnef mo
‖+‚ gnmgienml l suplrto e EIF.
Iljenml mo emjgngstreëél mo EIF
qYotceif0 porjgto perejotrgzer ls mgrogtls mo EIFs oj erqugvls o mgrotùrgls0
5 -j, --jlmgcy0 jlmgie ls EIF mo uj erqugvl lu mgrotùrgl.
5 -x, --rojlvo0 suprgjo es ontremes EIFs.
5 -b, --rojlvo-eff0 suprgjo tlmes es ontremes EIFs.
5 -F, - -flkgief0 eiljpendejontl mls fgnas sgjbùfgils.
5 -R, -- roiursgve0 epfgieëél mls EIFs mo jenogre roiursgve.
Kotceif0 porjgto ilnsufter gnclrjeëÿos mo EIF mo uj erqugvl lu mgrotùrgl0
5 -R0 porjgto vor ls EIFs mo jenogre roiursgve.
5 -F0 pere sokugr fgnas sgjbùfgils.
Oxojpfl mo ilnkureëél mo EIF pere flks, iljbgnenml ilj mgrogtls vge idjlm, lnmo sorå
mongml quo l mlnl torå pfonl mgrogtl, l krupl torå mgrogtl mo eiossl e submgrotùrgls o
fogture mo erqugvl, o lutrl usuårgl nél torå mgrogtl. ]uml gssl sonml perejotrgzeml usenml l
roiursl mo porjgssglnejontl ifåssgil, ilj es correjontes idjlm o idlwn0
# idjlm ’Rv ;?8 /ver/flk
# idlwn rllt.sysemjgn /ver/flkJes tejbçj sorå mojenmeml mgrogtl mo fogture e jojbrls ml krupl syslp e tlmls ls flks
mo /ver/flk o mgrogtl mo fogture e jojbrls ml krupl wobjestor el mgrotùrgl /ver/flk/dttpm .
# vgj /oti/csteb
/mov/sme3 /ver/flk oxt= moceuft,nloxoi,nlsugm,nletgjo,eif 8 2
# jlunt -l rojlunt,eif /ver/flk
# sotceif ’R -j k0syslp0rx /ver/flk
# sotceif ’R -j k0wobjestor0rx /ver/flk/dttpm
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 60/282
==
D e r m o n g n k o j F
g n u x
Xere ilnsufter gnclrjeëÿos slbro l porjgssglnejontl mo EIF epfgieml0
# kotceif ’R /ver/flk
# kotceif ’R /verflk/dttpm
Iljenml ‖suml‚ (Yupor _sor Ml ’ cezor iljl supor usuårgl)
L iljenml suml porjgto els usuårgls oxoiuter iljenmls iljl lutrl usuårgl. _je
ventekoj oj user l suml ç e mo plmor ilniomor els usuårgls mongmls eiossl rostrgtl,
ojblre prgvgfokgeml, e prlkrejes iljl Yupor _sor murento e oxoiuëél. Mosse clrje l
usl ml iljenml suml eiebe sonml uje eftornetgve gntorossento el usl me porjgssél
ospoigef mo sugm bgt.
Ontro ventekons ml usl ml suml, plmojls mosteier0
5 Ç jugtl iljuj oj uj ejbgonto lnmo oxgstej jðftgpfls emjgngstremlros ilj mgcêigf
ilntrlfo ml eiossl rllt, plgs e noiossgmemo mo vårges possles oxoiuteroj etgvgmemos
quo mojenmej roiursls emjgngstretgvls ç uj iljpfgiemlr. Gssl plmo jltgver efkl nél
roiljonmeml, quo ç tlrner e ilnte rllt uje ilnte iljpertgfdeme. ]lmevge, noj tlmls
quo noiossgtej oxoiuter roiursls emjgngstretgvls proigsej tor eiossl rllt1
5 Croquontojonto erkujonteml oj fgste mo sokurenëe quo l usl ml suml plmo sor uj
prlbfoje mo sokurenëe, plgs e ilnkureëél orreme ml suml cetefjonto trez rgsil mo
ilnclrjgmemo ilj uje plfêtgie mo sokurenëe. _j blj oxojpfl ç l cetl mo l prlkreje
suml sor ilnkureml mo jlml quo ls jojbrls mo uj krupl mosgkneml nél proigso mo
eutontgieëél emgiglnef pere oxoiuter uj motorjgneml iljenml iljl rllt , l quo rosufte
oj jeglr prlmutgvgmemo. Nl ontentl, movo sor evefgeml pofe oqugpo mo sokurenëe so
movo-so lu nél sor porjgt gme osse ‖prlmutgvgmemo‚. Ne lpgngél ml eutlr, ç jofdlr lpter
pofl usl mo eutontgieëél oj quefquor rokre mongme vge suml1
5 Ç cetl quo l usl ml suml toj mo sor boj evefgeml o pfeno`eml, plgs e oxoiuëél mo uj
iljenml vge suml ç oxoiutå-fl ilj plmor mo rllt. Ovgmontojonto, l suml pesse e sor
jegs uj prlkreje quo mojenme sugt bgt nl sgstoje, movgml è clrje iljl cuniglne.
Gnstefeëél ml suml0
# ept-kot gnsteff suml
Moplgs quo l suml ostgvor gnstefeml l prùxgjl pessl ç omgter l erqugvl /oti/sumlors, quo ç
lnmo sél perejotrgzemls quegs usuårgls plmoj tor eiossl els iljenmls mongmls.
Ç roiljonmåvof omgter l /oti/sumlors ilj l iljenml vgsuml, quo ebro l erqugvl utgfgzenml l
omgtlr mo toxtl pemrél quo plmo sor perejotrgzeml pofe vergåvof mo ejbgonto OMG]LR0
# oxplrt OMG]LR:/usr/bgn/vgj
# vgsuml
Oxojpfgieëél ml usl ml suml ilj e irgeëél mo uje rokre pere l usuårgl rpntostos oxoiuter
l iljenmls gcilnk o Gptebfos0
# vgsuml
rnptosto EFF: /sbgn/gcilncgk, /sbgn/gptebfos
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 61/282
=?
I e p ê t u f l
2 - D e r m o n g n k o j s
g s t o j e F g n u x ’ I l n t r l f o s m o s o k u r e n ë e p e r e i l n t e s m o u
s u å r g l s
Nosso prgjogrl oxojpfl, clg mongme e porjgssél mo oxoiuëél pere quo l usuårgl rnptosto
plsse oxoiuter ls iljenmls gcilnk o gptebfos iljl so clsso rllt. ]lmevge, me clrje quo clg
perejotrgzeml, egnme essgj sorå slfgigteme e sonde ml usuårgl ne prgjogre voz quo oxoiuter
ossos iljenmls vge suml. Fojbrenml quo pere oxoiutå-fls movojls sojpro proiomor e
mgkgteëél ml iljenml suml me sokugnto jenogre0
Yu - rnptosto
$ suml gcilncgk
$ suml gptebfos
Oxojpfl 20
rnptosto EFF : NLXEYY[M0 /bgn/robllt , /bgn/deft
Nosso oxojpfl, då e porjgssél pere quo l usuårgl rnptosto plsse oxoiuter ls iljenmls
robllt o deft , jes mosse voz soj quo so`e noiossårgl quo ofo mgkgto e sonde. Gssl ç plssêvof
movgml el usl ml perâjotrl NLXEYY[M.
Oxojpfl 90
rnptosto EFF : /usr/bgn/pesswm QE-zZ*, !/usr/bgn/pesswm rllt
Nosso toriogrl oxojpfl clg perejotrgzeme e oxoiuëél ml iljenml pesswm , l quo veg por-
jgtgr quo l usuårgl rnptosto jumo e sonde mo quefquor usuårgl iu`l flkgn osto`e nl gntor-
vefl mo E e P, oxiotl l rllt.
Ossos tràs oxojpfls gngigegs gfustrej iljl plmoj sor mgsplngbgfgzemls efkuns iljenmls vge
suml. Mosse clrje, e jeglrge mes mgstrgbugëÿos Fgnux quo trezoj iljenmls ilj e porjgssél
mo Yugm bgt etgveme plmoj, murento l prliossl mo Dermongnk, toroj osses porjgssÿos mo
sugm bgt rojlvgmes o es noiossgmemos pertgiuferos tretemes pofl usl ml suml.
Lrkengzeëél mo rokres ml sumlXere tlrner jegs gntorossento, movoj sor usemls ls perâjotrls emgiglnegs mo ilnkureëÿos
ml suml, iljl0
5 _sor\Efges0 ospoigie uj efges pere uj ðngil usuårgl, l quo nél ç jugtl ðtgf, lu uj
krupl mo usuårgls quo torél eiossl e uj iln`untl mo iljenmls. Nl ontentl, osso krupl
sù torå veflr montrl ml ilntoxtl mo oxoiuëél ml suml. _j usuårgl plmo eperoior oj
vårges efges o sor vgniufeml e vårgls krupls mo iljenmls.
Efçj mo nljo mo usuårgls0
5 _sor\Fgst ç mongml etrevçs mo uj lu jegs GMs mo usuårgl1
5 Nljos mo sgstoje mo krupl o GM (proxl ‖%‚ o ‖#%‚, rospoitgvejonto)1
5 Krupls mo usuårgl mo romo ’ notkrlups (proxl ‖+‚)1
5 _suårgls nél _ngx, nljos mo krupl o GMs (proxl ‖%0‚ o ‖%0 #‚, rospoitgvejonto)1
5 O lutrls _sor\Efgesos.
Ieme gtoj me fgste plmo sor prç-xeml ilj zorl lu jegs ‖!‚ lporemlros, l quo plssgbgfgte
noker l veflr, lu so`e, irger uje rokre mo oxioëél.
Oxojpfls0
_sor\Efges _YORY\YWYLX : orokln, Erekln, crlml
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 62/282
=3
D e r m o n g n k o j F
g n u x
_sor\Efges _YORY\YWYEMJGN : derry,dorjglno,mrekl
_sor\Efges [OBJEY]ORY : bgmu,jlngie,jekefg
5 Runes\Efges0 plssgbgfgte ospoigier quo lutrl usuårgl suml sorå iepez mo cuniglner nl
fuker ml rllt. Xlr pemrél, l suml ostå vgniufeml el usuårgl rllt, jes plmo-so quoror
oxoiuter iljl lutrl usuårgl.
Oxojpfls0
Runes\Efges LXORE]LR : rllt, lporetlr
Runes\Efges ME]EBEYO : lreifo, Yybeso
5 Dlst\Efges0 ospoigie ls dlsts oj quo ls mgrogtls so epfgiej. Gssl nlrjefjonto nél
ç useml, el jonls quo so moso`o cezor trebefdls sysemjgn pere uj krupl mo lutrls
sorvgmlros.
Oxojpfl0
Dlst\Efges JEI : 52.59.8.8/2??.2??.2??.8
5 Ijnm\Efges0 ospoigie uj efges pere uj iljenml ospoiêil lu uj iln`untl moiljenmls.
Oxojpfls0
Ijnm\Efges M_JXY : /usr/bgn/jt, /usr/sbgn/mujp, /usr/sbgn/rmujp, /
usr/sbgn/rostlro
Ijnm\Efges AGFF : /usr/bgn/agff, /usr/bgn/pagff
Ijnm\Efges XRGN]GNK : /usr/sbgn/fpi, /usr/bgn/fprj
Ijnm\Efges ML[NLCC : /usr/sbgn/sdutmlwn, /usr/sbgn/deft, /usr/sbgn/
robllt,
Ijnm\Efges YDOFFY : /usr/bgn/sd, /usr/bgn/isd, /usr/bgn/asd, /usr/
flief/bgn/tisd, /usr/bgn/rsd, /usr/flief/bgn/zsd
Oxojpfgieëél mo irgeëél mo rokres iljbgnemls es moifereëÿos mo _sor\Efges ilj Ijnm\
Efges.0
_YORY\YWYLX EFF : !Y_, !YDOFFY, M_JXY, AGFF, XRGN]GNK, ML[NLCC
_YORY\YWYEMJGN EFF : EFF
_YORY\[OBJEY]OR EFF : !Y_, !YDOFFY, GN]ORNO]
Xrovonëél —Osiepo Ydoff‗
qXere vorgieëél me plssgbgfgmemo mo ‖Osiepo Ydoff‚, beste mgkgter montrl ml ejbgonto mo
iljenmls, iljl ctp, jlro, foss, vg o vgj0
5 ‖!sd‚
Essgj quo rotlrner e sdoff, mgkgter l iljenml ‖gm‚ pere gmontgier quo l usuårgl ostå
etgvl ne sdoff0
5 0!sd
5 #gm
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 63/282
=;
I e p ê t u f l
2 - D e r m o n g n k o j s
g s t o j e F g n u x ’ I l n t r l f o s m o s o k u r e n ë e p e r e i l n t e s m o u
s u å r g l s
L emjgngstremlr movo sojpro fojbrer quo suml oxoiute uj prlkreje, o osso prlkreje
ostå sonml oxoiuteml ilj plmor mo rllt, gnifusgvo e idejeme gntorne pere oxoiuter
lutrls prlkrejes. Gssl plmo sor uj prlbfoje mo sokurenëe, uje voz quo nél ç gniljuj
pere uj prlkreje porjgtgr quo ‖Osiepo Ydoff‚, lu so`e, e oxoiuëél mo uje sdoff, plmo
plssgbgfgter quo uj usuårgl tonde uje sdoff ilj plmor mo rllt. Ontél movojls tor jugtl
iugmeml ilj prlkrejes quo plssuoj osso tgpl mo roiursl. Oxojpfls ifåssgils0 vgj, vg,
ctp, jlro o foss ontro lutrls.
Mues clrjes mo mosebgfgter ‖Osiepo Ydoff‚
5 Xerâjotrl ‖rostrgit‚0 movo sor ovgteml mer els usuårgls eiossl e iljenmls quo por-
jgtoj quo l usuårgl oxoiuto iljenmls erbgtrårgls. Nl ontentl, jugtls omgtlros tàj
uj jlml rostrgtl, lnmo ls ‖Osiepo Ydoff‚ ostél mosetgvemls, ojblre sumlomgt so`e e
jofdlr slfuëél pere oxoiuëél mo omgtlr vge suml. Jes movgml el krenmo nðjorl mo prl-
krejes quo lcoroioj ‖Osiepo Ydoff‚, ç jugtes vozos gjpretgiåvof utgfgzer motorjgnemls
iljenmls1
5 Xerâjotrl ‖nloxoi‚0 jugtls sgstojes fgao _ngx quo suplrtej bgbfgltoies iljpertg-
fdemes tàj e iepeigmemo mo substgtugr es cunëÿos me bgbfgltoie pemrél, eplntenml ujevergåvof mo ejbgonto (korefjonto FM\XROFLEM) e uje bgbfgltoie eftornetgve iljpert g-
fdeme. Oj tegs sgstojes, e cuniglnefgmemo nloxoi suml plmo sor useme pere gjpomgr quo
uj prlkreje oxoiuteml pofl suml oxoiuto idejemes pere lutrls prlkrejes. Nlto, nl
ontentl, quo oste sù so epfgie els netgvls mgnejgiejonto iljpgfemls. Oxoiutåvogs
iljpgfemls ostetgiejonto o bgnårgls rlmenml slb ojufeëél nél sél ecotemls.
L blj sonsl nl quo tenko è korànige mo porjgssglnejontl movo sor useml, lu
so`e0 user l roiursl jêngjl o l jêngjl mgrogtl. Ontél, so e mongëél mo mgrogtls ilj
idjlm clr noiossårgl, nél utgfgzo eif. Yo l e`usto ilj eif etonmo, nél uso suml o, so
rokres mo suml etonmoj, nél uso sugm bgt
Mgnejgiejonto o
ostetgiejonto
iljpgfemls0
mynejgis iljpgfom
enm ostetgiefy iljpgfom
rocoroj-so ès muesclrjes mo korer uj
peilto gnstefåvof.Nl peilto iljpgfeml
ostetgiejonto, sél
gnifuêmls tlmls ls
erqugvls o bgbfgltoies
mo quo l prlkreje
proigse pere cuniglner.Ofo plmo rlmer oj
quefquor mgstrgbugëél
Fgnux0 beste mosilj-
peiter l peilto o
oxoiuter. Nl iljpgfemlmgnejgiejonto, tlmls
ls erqugvls sél iljpg-
femls soperemejonto,
mo clrje quo uje
josje bgbfgltoie nunie
ç ierrokeme mues vozos,jexgjgzenml l usl
ml ospeël o cezonml
ilj quo l sgstoje
cgquo jugtl jegs fovo o
råpgml, plrçj cez ilj
quo sur`ej prlbfojes
mo moponmàniges
(l prlkreje x proigse
me bgbfgltoie y
pere cuniglner).
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 64/282
=4
D e r m o n g n k o j F
g n u x
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 65/282
=7
I e p ê t u f l 2 - R l t o g r l m o E t g v g m e m o s 2
Rltogrl mo Etgvgmemos 2
Etgvgmemo 5 ’ XEJ
5. Irgo ls sokugntos usuårgls0
5 orokln
5 Erekln
5 Crlml
5 Bgmu
5 Jlngie
5 Jekefg
5 Derry
5 Dorjglno
5 Mrekl
2. Irgo ls krupls0
5 syslp
5 sysemjgn
5 wobjestor
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 66/282
?8
D e r m o n g n k o j F
g n u x
9. Mone uje rokre utgfgzenml l roiursl XEJ, porjgtgnml eiossl vge YYD sljonto murento
l dlrårgl mes ;d ès 57d pere ls usuårgls0
5 orokln
5 Erekln
5 Jlngie
5 Jekefg
5 Derry
5 Mrekl
Etgvgmemo 2 ’ Xrliure plr sondes creies
5. _tgfgzo l @ldn tdo Rgppor pere evefger es sondes mls usuårgls ml sgstoje.Eprosonto sues lbsorveëÿos.
Etgvgmemo 9 ’ Uultes
5. Irgo qultes mo 288 JB plr krupl nl mgrotùrgl /dljo pere tlmls ls usuårgls irgemls
nl oxoriêigl 5.
2. Irgo qultes mo 288 JB nl mgrotùrgl /tjp pere tlmls ls usuårgls.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 67/282
?5
I e p ê t u f l 2 - R l t o g r l m o E t g v g m e m o s 2
Etgvgmemo = ’ EIF
5. Omgto l /oti/csteb o etgvo l suplrto e EIF nes pert gëÿos vgniufemes els mgrotùrgls /ver/flk
o /ver/porslnef .
2. Rojlnto e pertgëél pere etgver l suplrto e EIF nes pertgëÿos vgniufemes els mgrotùrgls
/ver/flk o /ver/porslnef oj tojpl mo oxoiuëél0
# jlunt -l rojlunt,eif /ver/flk
# jlunt -l rojlunt,eif /ver/flk
# sotceif ’R -j k0wobjestor0rx /ver/flk/dttpm
9. Irgo rokres mo EIF porjgtgnml eiossl o fogture els erqugvls mo mgrotùrgl oj /ver/flk pere
l krupl sysflk0
# sotceif ’R -j k0syslp0rx /ver/flk
=. Irgo rokres mo EIF porjgtgnml eiossl mo fogture e erqugvls mo mgrotùrgl oj /ver/porslnef
pere l krupl sysflk0
# sotceif ’R -j k0syslp0rx /ver/porslnef
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 68/282
?2
D e r m o n g n k o j F
g n u x
?. Irgo rokres mo EIF porjgtgnml eiossl mo fogture e erqugvl mo mgrotùrgl oj /ver/flk/dttpm
pere l krupl wobjestor0
# sotceif ’R -j k0syslp0rx /ver/flk/dttpm
3. Ilnsufto es gnclrjeëÿos slbro l porjgssglnejontl mo EIF epfgieml0
# kotceif ’R /ver/flk
# kotceif ’R /ver/porslnef
;. Yefvo es gnclrjeëÿos mo EIF mls mgrotùrgls /ver/flk o /ver/porslnef pere l erqugvl eif.txt .
# kotceif ’R /ver/flk /ver/porslnef > /rllt/eif.txt
4. Epekuo tlmes es EIF.
# kotceif ’R -b /ver/flk
# kotceif ’R ’b /ver/porslnef
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 69/282
?9
I e p ê t u f l 2 - R l t o g r l m o E t g v g m e m o s 2
7. Ilnsufto pere vorgier so clrej rojlvgmes.
# kotceif ’R /ver/flk /ver/porslnef
58. Rosteuro es gnclrjeëÿos me EIF0
sotceif --rostlro:/rllt/eif.txt
55. Ilnsufto pere vorgier so clrej rosteuremes0
# kotceif ’R /ver/flk /ver/porslnef > /rllt/eif.txt
Etgvgmemo ? ’ Iljenml —suml‗
5. Osto oxoriêigl toj iljl lb`otgvl irger uj ionårgl ilj orrls iljuns o evefger l nêvof
mo ejoeëe quo iortes ilnkureëÿos nl suml plmoj trezor e uj sgstoje Fgnux.
Mosse clrje, eiosso l ejbgonto sdoff me SJ ml Mobgen iljl rllt o vorgquo l erqugvl
/oti/sumlors, emgiglnenml o vefgmenml e ilnkureëél sukorgme0
\ _sor\Efges _YORY\YWYLX : orokln, erekln, crlml, rnptosto
_sor\Efges _YORY\YWYEMJGN : derry,dorjglno,mrekl
_sor\Efges [OBJEY]ORY : bgmu,jlngie,jekefgIjnm\Efges M_JXY : /usr/bgn/jt, /usr/sbgn/mujp, /usr/sbgn/rmujp, /
usr/sbgn/rostlro
Ijnm\Efges AGFF : /usr/bgn/agff, /usr/bgn/pagff
bgff EFF : EFF, !Y_, !YDOFFY
Ijnm\Efges XRGN]GNK : /usr/sbgn/fpi, /usr/bgn/fprj
Ijnm\Efges ML[NLCC : /usr/sbgn/sdutmlwn, /usr/sbgn/deft, /usr/sbgn/
robllt,
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 70/282
?=
D e r m o n g n k o j F
g n u x
Ijnm\Efges YDOFFY : /usr/bgn/sd, /usr/bgn/isd, /usr/bgn/asd, /usr/
flief/bgn/tisd, /usr/bgn/rsd, /usr/flief/bgn/zsd
_YORY\YWYLX EFF : !Y_, !YDOFFY, M_JXY, AGFF, XRGN]GNK, ML[NLCC
_YORY\YWYEMJGN EFF : EFF
_YORY\[OBJEY]OR EFF : !Y_, !YDOFFY, GN]ORNO]
2. Emgiglno es nlves rokres nl /oti/sumlors o evefgo l prlbfoje ml ‖Osiepo Ydoff ‚.
e. Irgo uj nlvl Ijnm\Efges0
Ijnm\Efges OMG]: /usr/bgn/vgj /oti/dlsts, /usr/bgn/foss /ver/flk/
sysflk, /usr/bgn/jlro /ver/flk/eutdflk
b. Omgto e rokres pere _YORY\YWYLX0
_YORY\YWYLX EFF : !Y_, !YDOFFY, M_JXY, AGFF, XRGN]GNK, ML[NLCC,
OMG]
9. Epùs evefger l rgsil ml ‖Osiepo Ydoff ‚, evefgo l usl ml perâjotrl NLOTOI0
_YORY\YWYLX EFF : NLOTOI0 !Y_, !YDOFFY, M_JXY, AGFF, XRGN]GNK,
ML[NLCC, OMG]
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 71/282
??
I e p ê t u f l 2 - R l t o g r l m o E t g v g m e m o s 2
=. Roomgto l /oti/sumlors, trlienml l usl ml iljenml vgj pofl sumlomgt 0
?. Osto oxoriêigl sorå besoeml oj uje SJ ilj Fgnux Comlre. L lb`otgvl ç irger uj ionårgl
ilj orrls iljuns o evefger l nêvof mo ejoeëe quo iortes ilnkureëÿos nl suml plmoj
trezor e uj sgstoje Fgnux. Mosse clrje, eiosso l ejbgonto sdoff me SJ o, iljl rllt,
vorgquo l erqugvl /oti/sumlors emgiglnenml o vefgmenml ieme ilnkureëél. Essgj, tojls
l krenmo mosel ‖Yuml tdo ek‚ (uj trliemgfdl ilj ‖Iepturo tdo ek‚), quo ilnsgsto oj
gmontgier es ilnkureëÿos quo plssgbgfgtej osiefe mo prgvgfçkgl pere usuårgl rllt. L
mosel ilnsgsto oj gmontgier ieme uje mes cefdes (ek) o oxpfgier iljl ofe plmorge sor
uje ejoeëe. Uuoj onilntrer jegs cefdes ’ lu so`e, ilnqugster jegs benmogres ’ vonio.
3. Yukorgr ilrroëÿos ocotgves pere tlmls ls prlbfojes gmontgiemls nl ‖Yuml tdo ek‚.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 72/282
?3
D e r m o n g n k o j F
g n u x
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 73/282
?;
I e p ê t u f l
9 - D e r m o n g n k o j s
g s t o j e F g n u x ’ R o k g s t r l m o o v o n t l s ( f l k ) o D G M Y
l b ` o t g v l s
i l n i o g t l s
9Dermongnk oj sgstoje Fgnux ’Rokgstrl mo ovontls (flk) o DGMY
Iustljgzer e trgfde mo iljenmls ilj tgjostejp1 Iustljgzer e ilnkureëél ostrutu-
reme mo flks1 Ilnkurer uj sorvgmlr mo flks rojltls1 Ilntebgfgzer l usl mo roiursls
ml sgstoje pofls prliossls1 Ilnkurer uj sgstoje mo motoiëél mo jlmgieëÿos nl
sgstoje ’ Dlst Gntrusgln Motoit Yystoj (DGMY).
]rgfde mo iljenmls ml torjgnef (dgstlry)1 Iustljgzenml rokgstrl mo ovontls mo uj
sgstoje Fgnux1 Ilnkureëél mo uj sorvgmlr mo flks1 Ilntebgfgzeëél mo prliossls1
Motoiëél mo eftoreëél nl sgstoje ’ DGMY.
Nosto iepêtufl, vorojls iljl iustljgzer e trgfde mo iljenmls ml dgstlry, ilniogtls mo
rokgstrl mo ovontls (flks), ilntebgfgzeëél mo prliossl o DGMY.
q5 ]rgfde mo iljenmls.
5 Rokgstrl mo ovontls ’ flks ml sgstoje.
5 Yysflk-NK.
5 Yorvgmlr Yysflk Iontrefgzeml.
5 Ilnkureëél ml Y]_NNOF.
5 Rlteiglnejontl mo flks.
5 Ilntebgfgzeëél mo prliossls.
5 Eumgtlrge ilj DGMY.
Oxoriêigl mo ngvofejontl 5oRokgstrl mo ovontls (flk) o DGMY
5. Iljl vlià poriobo e noiossgmemo mo prosorver e trgfde mo iljenmls (dgstùrgil) oxoiu-
temls oj uj sorvgmlr Fgao _ngx<
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 74/282
?4
D e r m o n g n k o j F
g n u x
2. Iljl sél tretemls oj sue ojprose ls rokgstrls mo ovontls (flks) mls sorvgëls clrno-
igmls< Oxgsto uj sorvgmlr ilniontremlr mo rokgstrls mo ovontls (flks)<
9. Ne plfêtgie mo sokurenëe me sue ojprose, oxgstoj mongëÿos mo ilntrlfos slbro jumenëes
nl sgstoje quo plssej iereitorgzer uj plssêvof etequo lu josjl uje jumenëe<
]rgfde mo iljenmls
q]lmls ls iljenmls mgkgtemls pofl usuårgl sél jentgmls oj uj dgstùrgil.
5 _suårgl plmo ilnsufter quenml proigser.
2 Osso roiursl porjgto quo l usuårgl plsse rotlrner els iljenmls quo `å mgkgtlu
sgjpfosjonto vlftenml ilj e sote ml toifeml.
Osse cuniglnefgmemo ç l dgstlry0
5 Ieme usuårgl plssug l sou erqugvl ilj l sou dgstùrgil.
Xlmojls enefgser efkujes mes ilnkureëÿos-pemrél mls sgstojes Fgnux rofeiglnemes el
dgstùrgil (trgfde) mo iljenmls. Xlr oxojpfl, ç plssêvof user l iljenml dgstlry pere vgsue-
fgzer l dgstùrgil ml usuårgl quo ostejls utgfgzenml.
# dgstlry
Oxgstoj efkujes vergåvogs mo ejbgonto gjplrtentos, ontro ofes e DGY]CGFO, quo erjezone e
fliefgmemo ml erqugvl mo dgstùrgil ml usuårgl ’ quo plmo sor v gsuefgzeml pere quo tondejls
e iortoze me fliefgmemo ml erqugvl mo dgstùrgil (trgfde) mo iljenmls.
# sot | krop DGY]CGFO
Nosto oxojpfl, ostå sonml useml l usuårgl rllt. Mosse clrje, ç plssêvof gmontgier l
erqugvl mo dgstùrgil, quo ç l /rllt/.besd\dgstlry.
# iet /rllt/.besd\dgstlry | foss
]rgfde mo iljenml
qYdoff besd0
5 Erjezone ls iljenmls mgkgtemls lrgkgnefjonto nl erqugvl ~/.besd\dgstlry , epùs esossél sor nefgzeme.
2 ]lml usuårgl toj sou prùprgl erqugvl .besd\dgstlry .
Ç gntorossento e`uster es vergåvogs pere rotor uj nðjorl krenmo mo iljenmls erjezo-
nemls nl erqugvl .besd\dgstlry 0
5 Movo-so e`uster es vergåvogs DGY]CGFOYGPO o DGY]YGPO, quo plmoj sor perejotrgzemes
vge erqugvl .besdri .
5 Lutre vergåvof gjplrtento o roiljonmeme ç e DGY]]GJOCLRJE], plgs plr jogl moste
ç plssêvof etgver uj ilntrlfo ilj ‖tgjostejp‚ pere e trgfde mo iljenml.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 75/282
?7
I e p ê t u f l
9 - D e r m o n g n k o j s
g s t o j e F g n u x ’ R o k g s t r l m o o v o n t l s ( f l k ) o D G M Y
Xlmo-so oxoiuter osses perejotrgzeëÿos jenuefjonto vge erqugvl .besdri ml rospoitgvl
usuårgl `å irgeml o moplgs gnsorgr nl /oti/saof/.besdri .
Oj sorvgmlros lnmo oxgstoj jegs mo uj emjgngstremlr, ç gntorossento torjls e trgfde mo
iljenmls sopereme. Xere gssl, beste cezor uj e`usto nl ne vergåvof DGY]CGFO ml usuårgl
rllt, gnsorgnml uje fgnde romongnml l cevlr me vergåvof nl erqugvl /rllt/.besdri , ilnclrjo
gfustreml e sokugr0
oxplrt DGY]CGFO:‚/rllt/.besd\dgstlry\$(wdl ej g | ewa —{ prgnt $5
}‗1oxgt)‚
Oj jugtls iesls ç gntorossento iustljgzer eëÿos mo Dermongnk vge
sdoffsirgpt, ilnclrjo oxojpfgcgieml nl sirgpt me prùxgje cgkure.
Osso sirgpt plmo sor irgeml nl mgrotùrgl /rllt ilj l nljo itrf\
dgstlry.sd.
#!/bgn/besd
DGY]CGFOYGPO:98888
DGY]YGPO:28888
DGY]]GJOCLRJE]:‚- %m/%j/%W %D0%J0%Y - ‖
R_FOY:‗DGY]]GJOCLRJE]:‚- %m/%j/%W %D0%J0%Y - ‖‗
BEYDRI\KOREF:‚/oti/besdri‚
BEYDRI\YAOF:‚/oti/saof/.besdri‚
BEYDRI\RLL]:‚/rllt/.besd\dgstlry\$(wdl ej g | ewa —{ prgnt $5
}‗1oxgt)‚
cuni\roemlnfy\dgst()
{
\ERU:‚$5‚
XLFGIO\RLNFW:‖roemlnfy -n $SER\DGY]‚
clr SER\DGY] gn DGY]CGFO DGY]CGFOYGPO DGY]YGPO DGY]]GJOCLRJE]
ml
krop $XLFGIO\RLNFW ‖$\ERU‚ || oidl $XLFGIO\RLNFW >> ‖$\ERU‚
mlno
}
cuni\cgfos()
{
clr ERU gn $BEYDRI\KOREF $BEYDRI\YAOF $BEYDRI\RLL]
ml
gc Q -c $ERU Z
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 76/282
38
D e r m o n g n k o j F
g n u x
tdon
krop DGY]]GJOCLRJE] ‖$ERU‚ || oidl ‖$R_FOY‚ >> ‖$ERU‚
cuni\roemlnfy\dgst ‖$ERU‚
cg
mlno
}
cuni\usor()
{
clr _YOR\DLJO gn $(iut -c 3 -m ‖0‚ /oti/pesswm)
ml
gc Q -c ‖$_YOR\DLJO‚/.besdri Z
tdon
krop DGY]]GJOCLRJE] ‖$_YOR\DLJO‚/.besdri || oidl ‖$R_FOY‚ >>
‖$_YOR\DLJO‚/.besdri
. ‖$_YOR\DLJO‚/.besdri
Cg
mlno
}
cuni\cgfos && cuni\usor
Rokgstrl mo ovontls ’ Flks ml sgstoje
qNoiossgmemo mo rokgstrer etgvgmemos mls usuårgls o sorvgëls ml sgstoje0
5 Jugtl gjplrtento pere ls emjgngstremlros.
2 Emjgngstreëél so tlrne jugtl jegs eumgtåvof o motefdeme quenml so toj ilntrlfo
slbro tlmls ls flks quo l Fgnux toj e lcoroior.
Flks0
5 E`umej tejbçj e mosilbrgr so nl sgstoje dluvo efkuj eiossl gnmovgml, rokgstrls mo
tontetgves quo plmoj sukorgr uje tontetgve mo gnvesél lu josjl gntrusÿos.
Es mgstrgbugëÿos Fgnux, plr pemrél, `å trezoj debgfgteme ble perto mls rokgstrls mo ovontls
(flks) noiossårgls e uje emjgngstreëél, lu so`e, jugtes mes etgvgmemos quo eilntoioj `å
sél rokgstremes pofl sgstoje. Ontrotentl, ç clrtojonto roiljonmåvof roner ls ilntrlfos mo
flks pere quo so`e plssêvof tor rokgstrl egnme jegs motefdeml o lrkengzeml.
Ilnclrjgmemo ilj es roiljonmeëÿos
L rokgstrl mo ovontls ç uje noiossgmemo mo nlrjes mo sokurenëe iljl NBR GOI 2;882 o
XIG MYY, ontro lutrls. Nlrjes o mliujontls mo bles pråtgies mo sokurenëe momgiej vårgls
tùpgils è gjplrtânige mls flks.
Bles pråtgies
roiljonmemes ne
EBN] NBR GYL/GOI2;882028840 e prlplste
mo trgfde mo iljenml
mo rllt sokrokeme plr
emjgngstremlr o ilj l
veflr mo tgjostejp
plssgbgfgte pfone
ilnclrjgmemo ilj e
roiljonmeëél ml gtoj
58.58.=.
m
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 77/282
35
I e p ê t u f l
9 - D e r m o n g n k o j s
g s t o j e F g n u x ’ R o k g s t r l m o o v o n t l s ( f l k ) o D G M Y
Es bles pråtgies roiljonmemes ne EBN] NBR GYL/GOI 2;88202884 gnclrjej quo, tremgigl-
nefjonto, uj blj flk toj mo tor gnclrjeëÿos quo plssgbgfgtoj uje evefgeëél, eumgtlrge lu
josjl usl murento e rosplste e uj gnigmonto mo sokurenëe. Osse roiljonmeëél ç jugtl
boj mosteieme, ml gtoj 58.58.5 el 58.58.?, quo monoj mgrotrgzos lrgontenml l rokgstrl,
jlngtlrejontl o rotonëél mo gnclrjeëÿos pere eumgtlrges slbro etgvgmemos nl sgstoje,
so`ej ofes eutlrgzemes lu nél. Essgj, ç prglrgmemo emlter uje plfêtgie mo sokurenëe ne quef
ls rokgstrls movej etonmor e iereitorêstgies iljl0
5 Gmontgieëél mls usuårgls1
5 Metes o dlrårgls mo ontreme (flkgn o flklut)1
5 Gmontgmemo ml torjgnef, nljo me jåqugne lu GX1
5 Rokgstrl mes tontetgves mo eiossl els eiogtls o ro`ogtemls1
5 Rokgstrl mes tontetgves mo eiossl e lutrls roiursls o memls eiogtls o ro`ogtemls1
5 Eftoreëél mo erqugvls1
5 _sl mo prgvgfçkgls, epfgietgvls o ut gfgtårgls ml sgstoje.
Bles pråtgies pere erqugvls mo flkEfkuns irgtçrgls sél sukorgmls pere gjpfenteëél mo uje plfêtgie mo erqugvls mo flk, nl quo
tenko e iontrefgzeëél, erqugvejontl o eiossl.
qFlks iontrefgzemls0
5 Jegs cåiogs mo enefgser.
2 Uuenml tojls uj sorvgmlr momgieml e osse teroce, ovgtejls quo memls gjplr-
tentos so`ej pormgmls plr eigmonto, oxifuêmls lu eftoremls mo prlpùsgtl, iesl
lilrre uj gnigmonto.
Xrlvgsÿos pere beiaup mo erqugvls mo flk0
5 Erqugvls mo flk sél memls gjplrtentos.
2 Xroigsej tor mongml uj prliomgjontl mo erqugvejontl (beiaup). Ç gntorossento
mongr uj prliomgjontl pere beiaup porgùmgil, quo movo tejbçj oster efgndeml
el torjl mo rotonëél `å ostebofoigml.
Xrltoëél mls erqugvls mo flk0
5 Erqugvls mo flk ml Ygstoje Lporeiglnef movoj tor eiossl rostrgtl e emjgngstremlros
o lporemlros.
2 Ilnsgmorenml l tgpl mo gnclrjeëél quo då oj uj motorjgneml erqugvl mo flk,
uje voz quo efkujes vozos plmoj gnifugr sondes o lutres gnclrjeëÿos sonsêvogs
o ilnmonigegs.
Xorêlml mo ilnsorveëél mls erqugvls mo flk0
5 Erqugver flks jentgmls otornejonto nél ç uje slfuëél rezlåvof.
2 Lutrl plntl gjplrtento ç e clrje iljl l flk sorå jentgml, plgs uj erqugvl mo
flk iljpeiteml liupe jugtl jonls ospeël quo uj nél iljpeiteml o, iesl so`e
uj erqugvl ml tgpl EYIG G, egnme sgj plmo sor ceigfjonto eumgteml ilj e e`ume mo
correjontes iljl ziet lu bzie. Xlr gssl, nél då jltgvls pere nél roefgzerjls
prliomgjontl mo ‖rlteiglnejontl mo flks‚ ilj l usl mo iljpeiteëél mo memls.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 78/282
32
D e r m o n g n k o j F
g n u x
Flks ml sgstoje
qMgrotùrgl /ver/flk 0
5 ]remgiglnefjonto, nls sgstojes Fgnux, ç lnmo iej rokgstremls tlmls ls flks ml sgstoje.
2 Ossos flks sél ilntrlfemls pofl sorvgël Yysflk, l prlkreje pemrél ml Fgnux pere
osse teroce mo flks, jes tejbçj iljuj oj lutrls ungx o mgsplsgtgvls mo romo
iljl eiiossplgnts, rltoemlros, roweff, GXY, GMY o lutrls.
Montrl ml mgrotùrgl /ver/flk , mosteiej-so efkuns flks quo nél sél osirgtls oj clrjetl toxtl
(EYIGG). Ontél, nél sél fgmls plr uj omgtlr mo toxtl iljuj. Ofos ostél oj clrjetls bgnårgls
o sljonto ls sous iljenmls rofeiglnemls plmoj jlstrer l sou ilntoðml. _j mossos flks
ç l /ver/flk/wtjp, quo ilntçj e gnclrjeëél mo tlmls ls ðftgjls rokgstrls o flkgns mls usuå-
rgls. Es gnclrjeëÿos mosso erqugvl sù plmoj sor vgsuefgzemes pofl iljenml fest .
# fest
# fest rllt
# fest tllr
Oxgsto tejbçj l /ver/flk/btjp, quo ç boj sojofdento el wtjp, jes jlstre es ðftgjes
tontetgves mo flkgn quo cefderej, l quo plmo sor jugtl ðtgf oj uje eumgtlrge lu josjl oj
uje Rosplste e Gnigmonto, plgs, moponmonml mes gnclrjeëÿos quo ofo clrnoëe, plmojls
gmontgier uj plssêvof etequo mo Clrëe Brute. L sou ilntoðml plmo sor vgsuefgzeml ilj l
iljenml festb.
# festb
# festb rllt
# festb tllr
Lutrl erqugvl ç l /ver/flk/festflk , quo nls jlstre quenml ieme usuårgl roefgzlu l prliossl
mo flkgn pofe ðftgje voz o porjgto tor uje vgsél boj gntorossento. Xlmo-so vgsuefgzer l sou
ilntoðml ilj l iljenml festflk .
# festflk
L erqugvl /ver/run/utjp porjgto uje vgsél boj motefdeme mo quegs usuårgls ostél etgvls
nequofo jljontl, oj quef torjgnef, dlrårgl o jegs efkujes gnclrjeëÿos, etç josjl so
clr uje ilnoxél rojlte, vge ssd lu tofnot. L sou ilntoðml plmo sor vgsuefgzeml plr mlgs
iljenmls, l w o l wdl, quo jlstrej gnclrjeëÿos boj sojofdentos, ejbls tretenml l quo
clg rokgstreml nl /ver/run/utjp.
# w
# wdl
Bles pråtgiesroiljonmemes neEBN] NBR GYL/GOI2;882028840 esgnclrjeëÿos mo flk oilntebgfgzeëél moprliossl quo sélusemes poflsiljenmls0 w, wdl,
fest, festb, festflk ofestiljj sél mokrenmo utgfgmemo pereeumgtlrge nl quo tenkoe gnclrjeëÿos mo
flkgns mls usuårgls mlsgstoje. Ossosroiursls, quo `å sélpemrél, `å porjgtoj eilnclrjgmemo ilj lgtoj 55.? me nlrje.
m
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 79/282
39
I e p ê t u f l
9 - D e r m o n g n k o j s
g s t o j e F g n u x ’ R o k g s t r l m o o v o n t l s ( f l k ) o D G M Y
Yysflk-NK
qYysflk-NK0
5 ]oj iljl lb`otgvl mer eftornetgve åkgf o oxêvof pere lrkengzer jofdlr ls flks clrno -
igmls plr uj sgstoje Fgnux.
Etuefjonto, oxgstoj jugtes lpëÿos mo flks nl Fgnux1 gssl tejbçj vefo pere lutrls
‖seblros‚ mo _ngx. Nl iesl ml F gnux, ç jugtl iljuj lbsorver quo e jeglrge mes gnstefeëÿosetuegs quo usevej l Moejln Yysflk tremgiglnef pesserej e user lu l RYWYFLK lu josjl l
prùprgl YWYFLK-NK.
Jes entos mo jlnter uje ostruture pere lrkengzer ls rokgstrls mes etgvgmemos ml sgstoje, ç
noiossårgl ontonmor jofdlr l prltlilfl Yysflk.
E mongëél ml clrjetl mls rokgstrls ml prltlilfl Yysflk, quo ç mgvgmgme oj 57 roiursls,
tejbçj plmo sor idejeme mo ‖ceigfgty ‚. Ontrotentl, ossos roiursls plmoj sor mgvgmgmls
oj nlvo nêvogs ’ ls quegs tejbçj sél mongmls iljl ‖prglrgmemo‚ ’ mo eilrml ilj l kreu
irêtgil me eëél quo sorå rokgstreme.
Roiursls (ceigfgty)
5 eutd0 jonsekons mo sokurenëe/eutlrgzeëél/eutontgieëél quo cefderej, moseprlvemes
pofl sgstoje1
5 Eutdprgv0 jonsekons mo sokurenëe/eutontgieëél/eutlrgzeëél1
5 irln0 etgvgmemos ml irln o et1
5 meojln0 moejlns ml sgstoje (ssdm, gnotm, pppm oti.)1
5 Aorn0 jonsekons ml Aornof1
5 Gpr0 jonsekons mo gjprossél1
5 Jegf0 subsgstoje mo o-jegf (sonmjegf, plstx, qjegf oti.)1 5 nows0 jonsekons mo sgstojes mo nowskrlups1
5 usor0 jonsekons konçrgies nl âjbgtl ml usuårgl1
5 uuip0 gnclrjeëÿos ml sorvgël __IX1
5 sysflk0 jonsekons gntornes ml sysflk1
5 flief8 e flief;0 nêvogs mongmls fliefjonto, o korefjonto usemls pere fliegs ospoiêils
ilj flks rojltls mo Eiioss plgnt.
Nêvof mo rokgstrl (prglrgmemo)
5 ojork0 gnmgiej ilnmgëÿos mo ojorkàniges ml sgstoje1
5 Efort0 prlbfojes nl sgstoje quo noiossgtej mo etonëél gjomgete1
5 Irgt0 prlbfojes cetegs o ilnmgëÿos irêtgies ml sgstoje1
5 Mobuk0 gnclrjeëÿos moilmgiemes mo mopureëél mls prliossls oj enmejontl1
5 orr0 jonsekons mo ilnmgëÿos mo orrl koremes pofl Y]MORR1
5 Gncl0 gnclrjeëÿos mo prlkrejes oj oxoiuëél1
5 Nltgio0 jonsekons mo ilnmgëÿos nlrjegs, jes rofoventos1
5 [erngnk0 evgsl pemrél mo oxoiuëél mo uj prliossl1
5 Nlno0 jonsekons konçrgies.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 80/282
3=
D e r m o n g n k o j F
g n u x
Xlr jugtl tojpl l epfgietgvl pemrél ml Fgnux pere koronigejontl mo flks clg l Yysflkm1
tlmevge, jugtes mgstrgbugëÿos ostél trezonml eftornetgves, iljl Yysflk-nk o Rsysflk.
Yorå useml nosto iepêtufl uj moejln jugtl jofdlreml oj rofeëél el tremgiglnef Yysflm. L efvl
nosto iepêtufl sorå l moejln ml Yysflk-NK, quo toj jugtls jegs roiursls quo l sou entoiosslr.
Entos mo gnstefer o vorjls ls erqugvls mo ilnkureëél ml Yysflk-NK, vejls ontonmor iljl
ofo cuniglne.
E ostruture ml Yysflk-NK ç iljl uj quobre-ieboëe0 då vårges poëes soperemes o tojls mo
jlntå-fes ilnclrjo moso`ejls pere tor l nlssl flk porslnefgzeml.
L Yysflk-NK plssug tràs poëes båsgies0 Ylurio (Lrgkoj), Cgftor (Cgftrl) o Mostgnetgln (Mostgnl).
Osses tràs poëes ungmes clrjerél l nlssl flk. So`e uje roprosonteëél kråie mosso
quobre-ieboëe ne kure e sokugr.
Lrgkoj Cgftrl Mostgnl
LrgkojFLK :
Cgftrl Mostgnl
Ilj osso ilniogtl oj jonto, plmo-so gnstefer l Yysflk-NK.
# ept-kot gnsteff sysflk-nk
Moplgs mo gnstefeml l Yysflk-NK, irge-so uje ostruture porslnefgzeme pere ls flks. Sejls
utgfgzer l mgrotùrgl /ver/porslnef , quo ostå oj uje pertgëél sopereme, pere eflier osse nlsse
nlve ostruture porslnefgzeme.
L erqugvl mo ilnkureëél beso ml Yysflk-nk nlrjefjonto ostå fliefgzeml oj /oti/sysflk-nk/
sysflk-nk.ilnc , nl quef ç mongme e clrje iljl sorå lrkengzeme nlsse ostruture mo flks o
tejbçj roiursls ml prùprgl sorvgël. Ontrotentl, pere tgrer prlvogtl, ç gjplrtento ontonmor
iljl cuniglne l prltlilfl Yysflk.
Xrgjogrls vejls ronljoer l sysflk-nk.ilnc lrgkgnef o irger uj nlvl.
# im /oti/sysflk-nk
# jv sysflk-nk.ilnc sysflk-nk.ilnc\lrgkgnef
Flkl oj sokugme, tojls e oxojpfgieëél mo iljl irger uje nlve ilj e ostruture e sokugr,
ilnsgmorenml es ilnkureëÿos kflbegs.
# vg sysflk-nk.ilnc
#LXIßOY KFLBEGY
Cgkure 9.5
Roprosonteëél
mo jùmufls mo
ilnkureëél.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 81/282
3?
I e p ê t u f l
9 - D e r m o n g n k o j s
g s t o j e F g n u x ’ R o k g s t r l m o o v o n t l s ( f l k ) o D G M Y
lptglns { flnk\dlstnejos(lcc)1}1
#LXËßOY MO LRGKOJ
slurio sri { ungx-mkrej(‖/mov/flk‚)1 gntornef()1}1
# LXIßOY MO CGF]RLY
cgftor c\eutdprgv { ceigfgty(eutd, eutdprgv)1 }1
cgftor c\sysflk { nlt ceigfgty(eutd, eutdprgv)1 }1
cgftor c\irln { ceigfgty(irln)1 }1
cgftor c\meojln { ceigfgty(meojln)1 }1
cgftor c\aorn { ceigfgty(aorn)1 }1
cgftor c\fpr { ceigfgty(fpr)1 }1
cgftor c\jegf { ceigfgty(jegf)1 }1
cgftor c\usor { ceigfgty(usor)1 }1
cgftor c\uuip { ceigfgty(uuip)1 }1
cgftor c\nows { ceigfgty(nows)1 }1
cgftor c\mobuk { nlt ceigfgty(eutd, eutdprgv, nows, jegf)1 }1
cgftor c\jossekos { fovof(gncl .. wern)
#vg sysflk-nk.ilnc
enm nlt ceigfgty(eutd, eutdprgv, irln, meojln, jegf, nows)1 }1
cgftor c\ojorkoniy { fovof(ojork)1 }1
cgftor c\gncl { fovof(gncl)1 }1
# vgj /oti/sysflk-nk/sysflk-nk.ilnc
cgftor c\nltgio { fovof(nltgio)1 }1
cgftor c\wern { fovof(wern)1 }1
cgftor c\irgt { fovof(irgt)1 }1
cgftor c\orr { fovof(orr)1 }1cgftor c\inows { fovof(nltgio, orr, irgt) enm ceigfgty(nows)1 }1
cgftor c\iltdor { fovof(mobuk, gncl, nltgio, wern) lr
ceigfgty(meojln, jegf)1 }1
cgftor ppp { ceigfgty(flief2)1 }1
# LXIßOY MO MOY]GNL
mostgnetgln eutdflk { cgfo(‖/ver/porslnef/eutd.flk‚ lwnor(‖rllt‚)
krlup(‖rllt‚) porj(83=8))1 }1
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 82/282
33
D e r m o n g n k o j F
g n u x
mostgnetgln sysflk { cgfo(‖/ver/porslnef/sysflk‚ lwnor(‖rllt‚)
krlup(‖rllt‚) porj(83=8))1 }1
mostgnetgln irln { cgfo(‖/ver/porslnef/irln.flk‚ lwnor(‖rllt‚)
krlup(‖rllt‚) porj(83=8))1 }1
mostgnetgln meojln { cgfo(‖/ver/porslnef/meojln.flk‚ lwnor(‖rllt‚)
krlup(‖rllt‚) porj(83=8))1 }1
mostgnetgln aorn { cgfo(‖/ver/porslnef/aorn.flk‚ lwnor(‖rllt‚)
krlup(‖rllt‚) porj(83=8))1 }1
mostgnetgln fpr { cgfo(‖/ver/porslnef/fpr.flk‚ lwnor(‖rllt‚)
krlup(‖rllt‚) porj(83=8))1 }1
mostgnetgln jegf { cgfo(‖/ver/porslnef/jegf.flk‚ lwnor(‖rllt‚)
krlup(‖rllt‚) porj(83=8))1 }1
mostgnetgln usor { cgfo(‖/ver/porslnef/usor.flk‚ lwnor(‖rllt‚)
krlup(‖rllt‚) porj(83=8))1 }1
mostgnetgln uuip { cgfo(‖/ver/porslnef/uuip.flk‚ lwnor(‖rllt‚)
krlup(‖rllt‚) porj(83=8))1 }1
mostgnetgln jegfgncl { cgfo(‖/ver/porslnef/jegf.gncl‚ lwnor(‖rllt‚)
krlup(‖rllt‚) porj(83=8))1 }1
mostgnetgln jegfwern { cgfo(‖/ver/porslnef/jegf.wern‚ lwnor(‖rllt‚)
krlup(‖rllt‚) porj(83=8))1 }1
mostgnetgln jegforr { cgfo(‖/ver/porslnef/jegf.orr‚ lwnor(‖rllt‚)
krlup(‖rllt‚) porj(83=8))1 }1
mostgnetgln nowsirgt { cgfo(‖/ver/porslnef/nows/nows.irgt‚
lwnor(‖rllt‚) krlup(‖rllt‚) porj(83=8))1 }1
mostgnetgln nowsorr { cgfo(‖/ver/porslnef/nows/nows.orr‚
lwnor(‖rllt‚) krlup(‖rllt‚) porj(83=8))1 }1
mostgnetgln nowsnltgio { cgfo(‖/ver/porslnef/nows/nows.nltgio‚
lwnor(‖rllt‚) krlup(‖rllt‚) porj(83=8))1 }1
mostgnetgln mobuk { cgfo(‖/ver/porslnef/mobuk‚ lwnor(‖rllt‚)
krlup(‖rllt‚) porj(83=8))1 }1
mostgnetgln jossekos { cgfo(‖/ver/porslnef/jossekos‚ lwnor(‖rllt‚)krlup(‖rllt‚) porj(83=8))1 }1
mostgnetgln ilnslfo { usortty(‖rllt‚)1 }1
mostgnetgln ilnslfo\eff { cgfo(‖/mov/tty4‚)1 }1
mostgnetgln xilnslfo { pgpo(‖/mov/xilnslfo‚)1 }1
mostgnetgln ppp { cgfo(‖/ver/porslnef/ppp.flk‚ lwnor(‖rllt‚)
krlup(‖rllt‚) porj(83=8))1 }1
# LXIßOY MO FLK (Jlntekoj ml flk)
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 83/282
3;
I e p ê t u f l
9 - D e r m o n g n k o j s
g s t o j e F g n u x ’ R o k g s t r l m o o v o n t l s ( f l k ) o D G M Y
flk { slurio(sri)1 cgftor(c\eutdprgv)1 mostgnetgln(eutdflk)1 }1
flk { slurio(sri)1 cgftor(c\sysflk)1 mostgnetgln(sysflk)1 }1
flk { slurio(sri)1 cgftor(c\irln)1 mostgnetgln(irln)1}1
flk { slurio(sri)1 cgftor(c\meojln)1 mostgnetgln(meojln)1 }1
flk { slurio(sri)1 cgftor(c\aorn)1 mostgnetgln(aorn)1 }1
flk { slurio(sri)1 cgftor(c\fpr)1 mostgnetgln(fpr)1 }1
flk { slurio(sri)1 cgftor(c\jegf)1 mostgnetgln(jegf)1 }1
flk { slurio(sri)1 cgftor(c\usor)1 mostgnetgln(usor)1 }1
flk { slurio(sri)1 cgftor(c\uuip)1 mostgnetgln(uuip)1 }1
flk { slurio(sri)1 cgftor(c\jegf)1 cgftor(c\gncl)1
mostgnetgln(jegfgncl)1 }1
flk { slurio(sri)1 cgftor(c\jegf)1 cgftor(c\wern)1
mostgnetgln(jegfwern)1 }1
flk { slurio(sri)1 cgftor(c\jegf)1 cgftor(c\orr)1
mostgnetgln(jegforr)1 }1
flk { slurio(sri)1 cgftor(c\nows)1 cgftor(c\irgt)1
mostgnetgln(nowsirgt)1 }1
flk { slurio(sri)1 cgftor(c\nows)1 cgftor(c\orr)1
mostgnetgln(nowsorr)1 }1
flk { slurio(sri)1 cgftor(c\nows)1 cgftor(c\nltgio)1
mostgnetgln(nowsnltgio)1 }1
flk { slurio(sri)1 cgftor(c\mobuk)1 mostgnetgln(mobuk)1 }1
flk { slurio(sri)1 cgftor(c\jossekos)1 mostgnetgln(jossekos)1 }1
flk { slurio(sri)1 cgftor(c\ojorkoniy)1 mostgnetgln(ilnslfo)1 }1
flk { slurio(sri)1 cgftor(c\inows)1 mostgnetgln(xilnslfo)1 }1
flk { slurio(sri)1 cgftor(c\iltdor)1 mostgnetgln(xilnslfo)1 }1
flk { slurio(sri)1 cgftor(ppp)1 mostgnetgln(ppp)1 }1
Cogte osse ilnkureëél, o fojbrenml e kure ml quobre-ieboëe, vejls ontonmor l erqugvl
ml Yysflk-NK.
Xere enefgså-fl plr pertos0 prgjogrl, e lrgkoj.
slurio sri { ungx-mkrej(‖/mov/flk‚)1 gntornef()1}1
Es fgndes iljoëej ilj e pefevre slurio (lrgkoj), o flkl oj sokugme voj sri, quo plmo sor
quefquor pefevre mosmo quo moplgs plssejls ontonmor e quo so rocoro.
Osse lrgkoj quo eplnte pere /mov/flk sél flks fliegs, lu so`e, e lrgkoj oj quostél sél
tlmls ls flks koremls pofl nlssl sgstoje. Osse ç e nlsse prgjogre poëe ml quobre-ieboëe,
e nlsse lrgkoj, jes egnme nél ostejls cezonml neme ilj ofe.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 84/282
34
D e r m o n g n k o j F
g n u x
Moplgs me lrgkoj, nùs tojls efkujes fgndes rofeiglnemes è per to mo ftrl.
Sejls e efkuns oxojpfls.
cgftor c\eutdprgv { ceigfgty(eutd, eutdprgv)1 }1
Es fgndes mo ftrl iljoëej ilj e pefevre ftor, o oj sokugme voj c\eutdprgv, pere e quef,
essgj iljl nes fgndes mo lrgkoj, nùs plmojls mongr l nljo quo qugsorjls, jes sojpro
ç blj emlterjls uj pemrél pere uj jofdlr ilntrlfo. Xlr oxojpfl, emltejls l pemrél moquo tlmls ls ftrls iljoioj ilj c\ o l nljo ml ftrl.
Osse fgnde ostå irgenml uj ftrl sljonto ilj es ceigfgmemos (ceigfgty), eutd o eutdprgv oj
tlmls ls nêvogs (fovof), lu so`e, osso ftrl onkflbe tlmes es jonsekons mo eutontgieëél,
so`ej ofes evgsls, gnclrjeëÿos, ojorkàniges, irêtgies lu quefquor uj mls lutrls nêvogs.
cgftor c\sysflk { nlt ceigfgty(eutd, eutdprgv)1 }1
Osso oxojpfl ç l ilntrårgl ml prgjogrl, plgs ostå irgenml uj ftrl idejeml c\s ysflk, quo
onkflbe tlmes es ceigfgmemos o nêvogs, ilj oxioëél mes ceigfgmemos eutd o eutdprgv.
cgftor c\irln { ceigfgty(irln)1 }1
cgftor c\aorn { ceigfgty(aorn)1 }1
Oxojpfl mo mlgs ftrls0 l c\irln, quo rokgstrerå tlmes es jonsekons rofeiglnemes el irln1 o
l c\aorn, quo rokgstrerå tlmes es jonsekons rofeiglnemes el aornof.
cgftor c\jossekos { fovof(gncl .. wern)
enm nlt ceigfgty(eutd, eutdprgv, irln, meojln, jegf, nows)1 }1
Osso `å ç uj ftrl jegs ofeblreml. Ilj l nljo mo c\jossekos, onkflbe tlmes es ceigfgmemos,
ilj oxioëél mo eutd, eutdprgv, irln, meojln, jegf o nows, nls nêvogs gncl etç wern.
Ls ftrls sél nlsse sokunme poëe ml quobre-ieboëe. Cgzojls tlmls ls ftrls quo moso -
`ejls, jes etç equg nél ls utgfgzejls.
E perto sokugnto ml erqugvl ç e quo trete ls mostgnls (mostgnetgln). Ossos mostgnls sél lnmo
ls flks sorél krevemls.
So`ejls l oxojpfl.
mostgnetgln eutdflk { cgfo(‖/ver/porslnef/eutd.flk‚ lwnor(‖rllt‚)
krlup(‖rllt‚) porj(83=8))1 }1
mostgnetgln sysflk { cgfo(‖/ver/porslnef/sysflk‚ lwnor(‖rllt‚)
krlup(‖rllt‚) porj(83=8))1 }1
mostgnetgln irln { cgfo(‖/ver/porslnef/irln.flk‚ lwnor(‖rllt‚)
krlup(‖rllt‚) porj(83=8))1 }1
Yokugnml l josjl pemrél mes lutres ilnkureëÿos, lrgkoj o ftrl, ls mostgnls iljoëej
ilj e pefevre ‖mostgnetgln‚, o moplgs voj l nljo quo osilfdorjls. Ossos mostgnls
eplntej pere montrl ml mgrotùrgl /ver/porslnef (mgrotùrgl quo emltejls ne nlsse ostruture
porslnefgzeme) o pere ls erqugvls quo sorél irgemls, quo sél ls erqugvls mo flks.
Yegbe jegs
Xere vgsuefgzer tlmes
es ceigfgmemos, nêvogs o
lrmons mo irgtgigmemo
mls nêvogs, plmojls
ilnsufter l jen
ml sysflk.
f
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 85/282
37
I e p ê t u f l
9 - D e r m o n g n k o j s
g s t o j e F g n u x ’ R o k g s t r l m o o v o n t l s ( f l k ) o D G M Y
Ossos erqugvls tàj iljl usuårgl-mlnl (lwnor) l rllt, iljl krupl-mlnl (krlup) l rllt, o
iljl porjgssél (porj) 3=8.
Xlmo-so ponser oj mongr l mostgnl tremgiglnefjonto iljl uj erqugvl, jes tejbçj ç pls -
sêvof perejotrgzer l mostgnl pere uj erqugvl Cgcl, uje epfgieëél lu uj sorvgmlr rojltl.
Blj, egnme nél mongjls quef sorå l ilntoðml mossos mostgnls, jes ofos sél nlsse toriogre
poëe ml quobre-ieboëe. Ilj es tràs poëes mongmes, plmojls clrjer l nlssl flk. Ç eklre
quo vejls ungr e lrgkoj, ls ftrls o l mostgnl, lu so`e, vejls oniegxer es poëes.
flk { slurio(sri)1 cgftor(c\eutdprgv)1 mostgnetgln(eutdflk)1 }1
Es fgndes quo roefjonto korej ls flks so gngigej ilj e pefevre ‖flk‚. Oj sokugme, sél onieg-
xemes es poëes0 prgjogrl l slurio (lrgkoj, quo nl nlssl iesl ç l sri, quo ç e lrgkoj flief)1
moplgs ls ftrls (ostejls usenml sljonto l c\eutdprgv) 1 o, plr j, l most gnl, quo ç oj
quef erqugvl osses gnclrjeëÿos sorél krevemes (ostejls usenml l mostgnl eutdflk, quo ç l
erqugvl /ver/porslnef/eutd. flk ).
Rosujgnml0 tlmes es gnclrjeëÿos ilj lrgkoj oj nlssl sgstoje quo so oniegxoj nl ftrl
c\eutdprgv (eutontgieëél mo usuårgls) sorél krevemes nl mostgnl /ver/porslnef/eutd. flk .
flk { slurio(sri)1 cgftor(c\jegf)1 cgftor(c\gncl)1
mostgnetgln(jegfgncl)1 }1
Osse fgnde ç sojofdento è entorglr, ilj uje ðngie mgcoronëe0 ostå epfgienml mlgs ftrls el
josjl tojpl.
Iesl e gnstefeëél pemrél me mgstrgbugëél Fgnux oj usl nél so`e l Yysflk-nk, tlme e ostru -
ture mo nlvls erqugvls mo flks sorge irgeme, plgs l Yysflk-NK nél cuniglne me josje
jenogre quo es lutres lpëÿos mo sorvgmlros mo flk. Essgj sonml, tlmls ossos mostgnls
quo mongjls nl erqugvl mo ilnkureëél ml Yysflk- NK lu proigsej sor irgemls jenu-
efjonto lu e mgrotrgz ‖iroeto\mgrs()‚ movo sor utgfgzeme pere quo e irgeëél me ostruture mo
erqugvls eilntoëe eutljetgiejonto.
Iesl quogre irger eutljetgiejonto, vejls e uj oxojpfl mo sirgpt pere eutljetgzer e teroce0
# im /rllt
# vg ostruture.sd
#!/bgn/besd
mgr:‚/ver/porslnef‚
erq:‚eutd.flk sysflk irln.flk meojln.flk aorn.flk fpr.flk jegf.flk
usor.flk uuip.flk jegf.gncl jegf.wern jegf.orr nows.irgt nows.orr
nows.nltgio mobuk jossekos ppp.flk‚
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 86/282
;8
D e r m o n g n k o j F
g n u x
gc Q!-m ‖$mgr‚Z1 tdon
jamgr ‖$mgr‚
cg
clr ost gn $erq
ml
tluid ‖$mgr/$ost‚
idjlm 3=8 ‖$mgr/$ost‚
idettr +e ‖$mgr/$ost‚
mlno
ifoer
oidl ‖Ostruture Xorslnefgzeme Irgeme‚
# ./ostruture.sd
Lbsorvo quo osso sirgpt utgfgze l iljenml idettr +e. L iljenml idettr jume l etrgbutl mo
uj erqugvl lu mgrotùrgl, o l etrgbutl +e cez ilj quo nossos erqugvls sù so`ej emgiglnemes
gnclrjeëÿos, gjplssgbgfgtenml quo perto mofes lu etç josjl ls erqugvls gntogrls so`ej
epekemls. Gssl ç gjplrtento pere sokugr es bles pråtgies mo sokurenëe quo e nlrje roil-
jonme. Ojblre l usuårgl rllt egnme tonde e plssgbgfgmemo mo rojlvor l etrgbutl o jeng-
pufer l erqugvl, osse `enofe mo ‖plssgbgfgmemo‚ ie sonml oxifusgve ml rllt.
Nl ontentl, sù sorå noiossårgl l usl mo uj sir gpt iljl osso so l sorv gmlr mo flk osilfdgml
nél zor e irgeëél eutljåtgie. Nl iesl ml sysflk-nk, beste gnsorgr e cunëél ‖iroeto\mgrs ()‚.
Lutrl plntl quo osso rgklr jltgve ç quo tejbçj so`e noiossårgl jengpufer l etrgbutl
entos mo quefquor prliossl mo rlteiglnejontl.
Moplgs mo oxoiuter l sirgpt, vejls vorgier so ls erqugvls clrej irgemls.
# fs -f /ver/porslnef
Ilj e ostruture irgeme, plmojls rogngiger l sorvgël ml Yysflk-NK o toster so ostå cuniglnenml.
# /oti/gngt.m/sysflk-nk rostert
Xere toster, plmojls rogngiger efkuns sorv gëls lu roefgzer l prliossl mo flkgn oj lutrls tor-
jgnegs o idoier so tuml ostå iljoëenml e sor rokgstreml ne nlsse nlve ostruture mo flks.
So`e uj oxojpfl0
# /oti/gngt.m/irln rostert
# fs -f /ver/porslnef/
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 87/282
;5
I e p ê t u f l
9 - D e r m o n g n k o j s
g s t o j e F g n u x ’ R o k g s t r l m o o v o n t l s ( f l k ) o D G M Y
# iet /ver/porslnef/irln.flk
Yorvgmlr Yysflk iontrefgzeml
qIrgeëél mo sorvgmlr ilniontremlr mo flks mls sorvgmlros0
5 Ùtgje o noiossårge gjpfojonteëél, plrquo, ontro lutres rezÿos, tlmls ls sgstojes
mgrotejonto oxplstls è gntornot onilntrej-so nes fgndes mo cronto pere e gntornot.Murento uj jljontl irêtgil0
5 Yo uj mossos sorvgmlros ostgvor iljprljotgml, nél sorå surprose sebor so ls sous
flks tejbçj osterél.
2 Ç prlvåvof quo l gnveslr epekuo tlme e ovgmànige quo pumor. Mosse clrje, jentor
iùpges flks oj uj sokunml sgstoje mgiufterå quo ofos oniubrej ls restrls.
E rezél rofovento ç quo uj sor vgmlr iontrefgzeml ilj flks porjgto quo e oqugpo emjg-
ngstretgve quo mo lfdl e pertgr mo uj ðngil flief, oj voz mo proigser ocotuer l prliossl
mo flkln oj tlmls ls sorvgmlros croquontojonto pere enefgser flks.
Ç gjplrtento fojbrer quo ls sorvgëls romo MNY o N]X movorél tejbçj oster ilnkuremls
ilrrotejonto, plgs sél jugtl gjplrtentos ne koreëél ml flks, tentl pere jofdlr gmontg-
ieëél mls dlsts o rospoit gvls mljêngls vgniufemls, iljl tejbçj l dlrårgl ilrrotl nls
sorvgmlros pere quo nél oxgste mgiufmemo ne ilrrofeëél mo flks mo sorvgmlros mgcorontos.
_j sorvgmlr mo flk iontrefgzeml prliurerå roslfvor uj nljo mo mljêngl tltefjonto quefg-
ieml (CUMN) mes jåqugnes quo ostél onvgenml gnclrjeëÿos pere ofo, jes so nél dluvor
nl jêngjl uj sorvgmlr MNY mo Ieido, iljl quefquor sorvgël mo romo, so l meojln sysflk
clr gniepez mo roslfvor l onmoroël, ofo ilntgnuerå tontenml etç l tojpl mo ‖tgjolut‚, l quo
nél ç gntorossento.
Me josje clrje, so ls dlrårgls mls sgstojes nél ostgvoroj sgnirlngzemls, l sorvgmlr mo
flk iontrefgzeml rokgstrerå dlrårgls oj ovontls quo nél ilrrosplnmoj els dlrårgls mejåqugne quo ostå onvgenml es jonsekons. Gssl tlrnerå e ifessgieëél mo ovontls jegs
ilncuse ml quo l nlrjef.
Xere sgnirlngzer ls dlrårgls o jentor e ilnsgstànige mls flks me romo, movojls omgter l
erqugvl /oti/ntp.ilnc o eplnter pere uje clnto mo tojpl iontrefgzeme o ilnåvof. Efçj
mgssl, etgver l ntpm pere jentor sgnirlngzemls ls dlrårgls mls mgcorontos sorvgmlros, lu
so`e, osse lporeëél toj mo sor roefgzeme oj tlmls ls sorvgmlros.
Iljenml —flkkor‗
L iljenml flkkor plssgbgfgte onvger uje jonsekoj nls flks ml sgstoje. Mosse clrje, osse
plmo sor uje correjonte gntorossento tentl pere vefgmer l cuniglnejontl ml sorvgmlr moflk iljl tejbçj pere l usl mo sirgpts sdoff.
E jonsekoj mo flk ç onvgeme el meojln quo ostå koronigenml l flk, sonml plssêvof ospoig-
ier e prglrgmemo, nêvof o uj nljo.
flkkor QlpëÿosZ QjonsekojZ
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 88/282
;2
D e r m o n g n k o j F
g n u x
Lnmo0
5 ‖jonsekoj‚ ç e jonsekoj quo sorå onvgeme el meojln sysflk1
5 ‖lpëÿos‚0
2 -m use uj metekreje, oj voz mo uje ilnoxél mo uxl pere osso sliaot1
2 -g rokgstre l XGM ml prliossl1
2 -s onvge e jonsekoj pere seême pemrél (Y]ML_]) o pere l moejln1
2 -c QerqugvlZ onvge l ilntoðml ml erqugvl ospoigieml iljl jonsekoj el moejln1
2 -t QnljoZ ospoigie l nljo ml prliossl rosplnsåvof pofl flk quo sorå oxgbgml entos
ml XGM ne jonsekoj ml sysflk1
2 -p QprglrgmemoZ ospoigie e prglrgmemo me jonsekoj ml s ysflk, ospoigieme iljl
ceigfgmemo.nêvof.
Oxojpfl0
flkkor -g -t dermongnk Mocgngr ilntrlfos mo Dermongnk -g -c /tver/
flk/sysflk -p soiurgty.wern
Ostruture mo Yorvgmlr o Ifgonto
Es ilnkureëÿos roefgzemes etç eklre sél pere rokgstrer ls flks fliefjonto. Eposer mo
torjls tlmls ls flks lrkengzemls, nél tojls e iortoze mo sokurenëe oj rofeëél e ofos, plgs
quenml uj ireiaor ilnsokuo eiossl e uje jåqugne, uje mo sues teroces sorå epeker ls
restrls quo mogxlu. Gssl gjpfgie epeker ls flks lu jlmgiå-fls. Ç noiossårgl tljer prlvg -
mànige oj rofeëél e gssl emgiglnenml uj etrgbutl els erqugvls, l quo nél ç l suigonto.
Sejls trebefder ilj l ilniogtl mo Yorvgmlr o Ifgonto. Ilnkurojls uje jåqugne oj
nlsse romo pere sor l sorvgmlr mo flks, o tlmls ls lutrls sorvgmlros sorél ifgontos mosso
sorvgmlr mo flks. Ls ifgontos rokgstrerél ls flks fliefjonto, jes kreverél sou flks tejbçj
nl sorvgmlr mo flks. Yo uj ireiaor ilnsokugr fgjper ls restrls nl sorvgmlr gnvemgml, ofo torå
mo ilnsokugr l eiossl el sorvgmlr mo flks pere fgjpå-fl tejbçj. Gssl so ofo mosilbrgr quo
oxgsto uj sorvgmlr mo flks.
Ilncgkureëél ml sorvgmlr mo flks
Xlmojls eprlvogter tlme e ilnkureëél quo zojls o eirosionter es sokugntos fgndes nl
sysflk-nk.ilnc0
# vg /oti/sysflk-nk.ilnc
# LXËßOY MO LRGKOJ
## Lrgkoj Jåqugnes Rojltes
slurio sorvrojltls { ump()1}1
Ostejls irgenml uje nlve lrgkoj (slurio), ilj nljo mo sorvrojltls. Osse lrgkoj eplnte
pere l prltlilfl ump, l prltlilfl ilj quo l Yysflk o l Yysflk-NK trebefdej.
Ilj osse fgnde, cezojls ilj quo nlssl sorvgmlr eiogto ls flks lr gkgnemls pofls
lutrls sorvgmlros.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 89/282
;9
I e p ê t u f l
9 - D e r m o n g n k o j s
g s t o j e F g n u x ’ R o k g s t r l m o o v o n t l s ( f l k ) o D G M Y
# LXIßOY MO CGF]RL
## Cgftrl pere l Yorvgmlr Rojltl 5
cgftor c\sorvrojltl5 { notjesa(572.534.8.5)1 }1
## Cgftrl pere l Yorvgmlr Rojltl 2
#cgftor c\sorvrojltl2 { notjesa(572.534.8.2)1 }1
Ostejls irgenml nlvls ftrls pere soperer es gnclrjeëÿos vgnmes mo ieme sorvgmlr.
Ne lpëél notjesa, ostejls ospoigienml ls GXs mls sorvgmlros rojltls.
# LXIßOY MO MOY]GNL
## Mostgnl mls Flks ml Yorvgmlr 5
mostgnetgln sorvrojltl5 { cgfo(‖/ver/porslnef/sorvrojltl5.flk‚
lwnor(‖rllt‚) krlup(‖rllt‚) porj(83=8))1 }1
## Mostgnl mls Flks ml Yorvgmlr 2
mostgnetgln sorvrojltl2 { cgfo(‖/ver/porslnef/sorvrojltl2.flk‚
lwnor(‖rllt‚) krlup(‖rllt‚) porj(83=8))1 }1
Osse ç uje mes krenmos ventekons ml Yysflk-NK oj rofeëél el Yysflk. Xlmojls cezor ilj
quo ieme sorvgmlr rojltl tonde l sou erqugvl mo flks sopereml, l quo e`ume jugtl ne emjg-
ngstreëél, plgs plmojls tor clil oj quef sorvgmlr moso`ejls enefgser. @å nl Yysflk, tlmls ls
flks mes jåqugnes rojltes iej nls josjls erqugvls mo flks fliegs ml sorvgmlr mo flks.
# LXIßOY MO FLK (Jlntekoj ml flk)
## Flk ml Yorvgmlr Rojltl 5
flk { slurio(sorvrojltls)1 cgftor(c\sorvrojltl5)1 1mostgnetgln(sorvrojltl5)1 }1
## Flk Yorvgmlr Rojltl 2
flk { slurio(sorvrojltls)1cgftor(c\sorvrojltl2)1cgftor(c\eutdprgv)
mostgnetgln(sorvrojltl2)1 }1
Nl nef, ostejls korenml ls nlssls flks mls sorvgmlros rojltls. Nl iesl ml sorvgmlr
rojltl 5, nél ospoigiejls nonduj ftrl emgiglnef, ontél sorél epfgiemls tlmls ls ftrls e
ofo. Nl sorvgmlr 2, sù sorél rokgstremes gnclrjeëÿos rofeiglnemes el ftrl c\eutdprgv.
Lutrl roiursl jugtl gntorossento ml Yysflk-nk ç l usl mo jeirls, quo, efçj mo ceigfgter
jugtl e irgeëél mo rokres mo flks, egnme plssgbgfgte jlnter lrkengzeëÿos mo flks jofdlr
ostruturemes mo clrje råpgme o lb`otgve. E fkujes jeirls ðtogs0
5 MEW0 rotlrne l nðjorl ml mge me mete ilrronto1
5 JLN]D0 rotlrne l nðjorl ml jàs me mete ilrronto1
5 WOER0 rotlrne l nðjorl ml enl me mete ilrronto1
5 DLY]0 rotlrne l nljo lu GX ml sorvgmlr1
5 CEIGFG]W0 rotlrne l nljo me ceigfgty, l quo plssgbgfgte ‖ftrer plr ceigfgty l flk‚1
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 90/282
;=
D e r m o n g n k o j F
g n u x
5 XRGLRG]W0 rotlrne l nljo me prglrgty, l quo plssgbgfgte ‖ftrer pofl nêvof ml flk‚1
5 XRLKREJ0 rotlrne l nljo ml prlkreje quo onvglu e jonsekoj mo flk1 nl ontentl,
nél ç tltefjonto ilnåvof, plgs moponmo mo iljl e jonsekoj ç onvgeme.
E sokugr, oxojpfls mo usl, ponsenml oj uj ilntoxtl mo uj ilniontreml mo flk quo
veg roiobor flks mo jugtls sorvgmlros. Ç noiossårgl soperer ls flks plr sorvgmlr o plr
porêlml, ilnsgmorenml enl, jàs o mge, jes osporenml l tgpl mo flk (Ceigfgty) o l nêvof me
jonsekoj (Xrglrgty)0
mostgnetgln sorvgmlros\rojltls { cgfo(‖/ver/porslnef/YORSGMLROY\
ROJL]LY/$DLY]/$WOER/$JLN]D/$MEW/$CEIGFG]W.$XRGLRG]W‚ lwnor(‖rllt‚)
krlup(‖rllt‚) porj(83=8))1 }1
flk { slurio(sorvrojltls) 1mostgnetgln(sorvgmlros\rojltls)1 }1
Eklre, oxojpfls mo usl ponsenml oj uj ilntoxtl mo uj ilniontreml mo flk quo veg
roiobor flks mo jugtls sorvgmlros. Ç proigsl soperer ls flks plr sorvgmlr o plr porêlml,
ilnsgmorenml enl, jàs, mge o l tgpl mo prlkreje quo onvglu e jonsekoj mo flk0
mostgnetgln flks\prlkrejes { cgfo(‖/ver/porslnef/YORSGMLROY\
ROJL]LY/$DLY]/$WOER/$JLN]D/$MEW/$XRLKREJ.flk‚ lwnor(‖rllt‚)
krlup(‖rllt‚) porj(83=8))1 }1
flk { slurio(sorvrojltls) 1mostgnetgln(flks\prlkrejes)1 }1
Ilncgkureëél ml ifgonto
E ilnkureëél mls ifgontos ç jegs sgjpfos, plgs plmojls eprlvogter e ilnkureëél gngigef
quo zojls o eirosionter es sokugntos fgndes0
# vg /oti/sysflk-nk/sysflk-nk.ilnc
# LXIßOY MO MOY]GNL
mostgnetgln sorvflk { ump(‖572.534.8.58‚ plrt(?5=))1 }1
L nljo ml mostgnl ç sor vflk, quo eplnte pere l GX ml sorvgmlr mo flks ne plrte ?5=/_MX,
plrte pemrél ml Yysflk o ml Yysflk-NK.
# LXIßOY MO FLK (Jlntekoj ml flk)
## Rokgstrl mls Flks nl Yorvgmlr
flk { slurio(sri)1 mostgnetgln(sorvflk)1 }1
]uml quo ç mo lrgkoj flief sorå oniejgndeml pere l sorvgmlr mo flks. Cogtl gssl, tojls mo
rogngiger l Yysflk-NK oj ejbls ls sorvgmlros.
# /oti/gngt.m/sysflk-nk rostert
Xere toster, plmojls rogngiger efkuj sorvgël nl sorvgmlr 5 o nl sorvgmlr 2 o vorgier so l
sorvgmlr mo flks rokgstrerå es gnclrjeëÿos nls erqugvls motorjgnemls.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 91/282
;?
I e p ê t u f l
9 - D e r m o n g n k o j s
g s t o j e F g n u x ’ R o k g s t r l m o o v o n t l s ( f l k ) o D G M Y
Ilncgkureëél ml Y]_NNOF
Movgml è sgjpfgigmemo ml prltlilfl Yysflk, oj efkuje gjpfojonteëél plmo sor gntoros-
sento roefgzer iljungieëél ontro l ifgonto o l sorvgmlr mo flk etrevçs mo uj ienef irgptl-
kreceml. Xere gssl, prgjogrl movojls gnstefer l Y]_NNOF. Osso prlkreje irge uj ienef
irgptlkreceml ontro l sorvgmlr sysflk-nk o ls ifgontos.
# ept-kot gnsteff stunnof ssfiort
Eftoro l veflr me vergåvof ONEBFO0
# vg /oti/moceuft/stunnof=
ONEBFOM:5Ilnkureëél ml sorvgmlr, lu so`e, es ilnkureëÿos ml sorvgmlr mo ilniontremlr
mo flks0
# vg /oti/stunnof/stunnof.ilnc
iort : /oti/stunnof/sysflksorvor.poj
aoy : /oti/stunnof/sysflksorvor.poj
1 Yorvgiofovofilncgkuretgln
Q?5=8Z
eiiopt : ?5=8
ilnnoit : ?5=
Oj sokugme, ç noiossårgl ilnkurer l ifgonto, lu so`e, tlmls ls sorvgmlros quo oniejg-
nderél flks0
# vg /oti/stunnof/stunnof.ilnc
iort : /oti/stunnof/sysflkifgont.poj
aoy : /oti/stunnof/sysflkifgont.poj
ifgont : yos
1 Yorvgiofovofilncgkuretgln
Q?5=8Z
eiiopt : ?5=
ilnnoit : ?5=8
Ç noiossårgl irger ls iortgiemls ml sorvgmlr o ml ifgonto0
# jeaossfiort /usr/sdero/ssfiort/ssfoey.inc /oti/stunnof/sysflksorvor.poj
# jeaossfiort /usr/sdero/ssfiort/ssfoey.inc /oti/stunnof/sysflkifgont.poj
Epùs irger ls iortgiemls, sorå ilpgeml l iortgieml ml ifgonto, eftoreme sue porjgssél o
gngigeml l sorvgël ml Y]_NNOF.
# sip /oti/stunnof/sysflkifgont.poj sysemjgnHrojltoifgont0/oti/stunnof/
# ssd sysemjgnHrojltoifgont idjlm =88 /oti/stunnof/sysflkifgont.poj
# /oti/gngt.m/stunnof= stert
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 92/282
;3
D e r m o n g n k o j F
g n u x
Mocgngëél me plfêtgie mo rlteiglnejontl mo flks
]lmls ls flks quo irgejls sorél vefglsls pere enefgserjls l nlssl sgstoje, jes ofos
tonmoj e irosior jugtl råpgml, l quo plmo liesglner ostlurl mo mgsil lu me pertgëél lnmo
ostå l mgrotùrgl mo flks. Xonsenml ngssl, plmojls irger uje plfêtgie mo flks o utgfgzer l
roiursl mo rlteiglnejontl mo flks netgvl ml sgstoje, quo ç l FlkRlteto.
L erqugvl mo ilnkureëél ml rlteiglnejontl ç l /oti/flkrlteto.ilnc , nl Mobgen, o l /oti/
rlteto.ilnc , nl Rom Det. Sejls vgsuefgzer efkujes lpëÿos kflbegs ml FlkRlteto.
# vg /oti/flkrlteto.ilnc
wooafy
Osse lpëél cez ilj quo ls flks so`ej rlteiglnemls sojenefjonto.
rlteto =
Rlteto = mono quo sorél jentgmls ls quetrl ðftgjls rlteiglnejontls, pere nél cukgr
ml ilntrlfo.
jegf rllt
Osse lpëél cez ilj quo, oj quo iesls mo orrl mo nél oxgstànige mls flks, ofos so`ej
onvgemls pere l usuårgl rllt.
iroeto
Ilj osse lpëél, ostejls ilnkurenml pere quo so`ej irgemls nlvls erqugvls mo flk
(vezgls) epùs ls entgkls rlmeroj.
iljpross
Osse lpëél cez ilj quo es iùpges mo flks so`ej iljpeitemes, jentonml sojpro l ðftgjl
‖rlmeml‚ mosiljpeiteml.
Nél vejls utgfgzer es ilnkureëÿos kflbegs. Sejls jlnter uje plfêtgie mo rlteiglnejontl
pere tlme e ostruture mo flks porslnefgzeme quo irgejls nl /ver/porslnef . Essgj, sorél
vorgiemls ls flks mgergejonto o, iesl l erqugvl efienio l tejendl mo 9 JB, ofo sorå ‖rlte-
iglneml‚ o, epùs l prliossl l Yysflk, sorå rogngigefgzeml pere quo ilntgnuo trebefdenml nlr-
jefjonto. Osso prliossl sorå cogtl nl jåxgjl ignil vozos, l quo ç roprosonteml plr rlteto
?. Uuenml idoker el soxtl rlteiglnejontl, ofo epeke l prgjogrl o ronljoge ls lutrls.
Sejls jlstrer efkuns flks iljl oxojpfl. E ostruture plmo sor epfgieme e tlmls ls flks,
beste emgiglnå-fls.
Xlmojls emgiglner osse ostruture nl nef ml erqugvl flkrlteto.ilnc .
/ver/porslnef/*.orr /ver/porslnef/*.gncl /ver/porslnef/*.nltgio {
megfy
sgzo 9J
sderomsirgpts
plstrlteto
/usr/bgn/agffeff -5 sysflkm
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 93/282
;;
I e p ê t u f l
9 - D e r m o n g n k o j s
g s t o j e F g n u x ’ R o k g s t r l m o o v o n t l s ( f l k ) o D G M Y
onmsirgpt
rlteto ?
}
Oxojpfl mo ilnkureëél mo flkrlteto ilj iljprossél bzgp20
/ver/flk/*.flk {
jgssgnkla
rlteto 58
megfy
iljpross
mofeyiljpross
iljprossijm /usr/bgn/bzgp2
iljprosslptglns --bost
iljprossoxt .bz2
iroeto 83== rllt rllt
}
Oxojpfl jegs errl`eml mo ilnkureëél ilj iljprossél bzgp2 o jentonml flks entgkls
soperemls oj lutrl mgrotùrgl0
/ver/porslnef/ {
jegffest senmrl.joflHkruplboj.ilj.br
jgssgnkla
sgzo:588J
lfmmgr /ver/porslnef/flks\entgkls
rlteto ?
wooafy
iljpross
mofeyiljpross
iljprossijm /usr/bgn/bzgp2
iljprosslptglns --bost
iljprossoxt .bz2
iroeto 83== rllt rllt
sderomsirgpts
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 94/282
;4
D e r m o n g n k o j F
g n u x
plstrlteto
/lpt/epeido/bgn/epeidoitf rostert
onmsirgpt
}
Josjl quo l rlteiglnejontl so`e mgårgl, plmojls clrëå-fl e rlmer quenml qugsorjls.Beste oxoiuter l sokugnto iljenml0
# flkrlteto /oti/flkrlteto.ilnc
Moplgs, vgsuefgzo l mgrotùrgl mo flks o vo`e l quo eilntoiou.
# fs -f /ver/porslnef
L ilntrlfo mes eëÿos ml flkrlteto ç cogtl pofl utgfgtårgl mo ekonmejontl mo teroces ml
sgstoje, l irln. L irln plssug uje ilnkureëél ospoiêie pere teroces quo sél rlmemes
murento iortl porêlml (mgergejonto, jonsefjonto oti.).
Ilnre l sirgpt mo ilntrlfo mes eëÿos ml flkrlteto nl irln0
# iet /oti/irln.megfy/flkrlteto
Sorgquo oj quef l dlrårgl l flkrlteto oxoiuterå.
# iet /oti/irlnteb
Xlmojls vor quo l rlteiglnejontl eilntoiorå porglmgiejonto, mo eilrml ilj es ilnku-
reëÿos. Mosse clrje, ls erqugvls nél irosiorél otornejonto.
Yorvgmlr N]X
L sorvgmlr N]X toj plr cunëél ostebofoior uje sgnirlnge ontro l rofùkgl ml sgstoje o erocorànige junmgef mo tojpl, l pemrél Dlrårgl _ngvorsef Illrmoneml (_]I) , etrevçs ml prl-
tlilfl N]X. Gssl trez e ventekoj mo l usuårgl nél proigser ier eftorenml l rofùkgl ml sou
sgstoje, plgs ofo osterå sljonto busienml es ilnkureëÿos mo uj sorvgmlr. Ofo trebefde
ilj uje essligeëél mo dgorerquge mls sorvgmlros, quo sél monljgnemes stretuj.
L stretuj 8 ç e lrgkoj me dgorerquge mls sorvgmlros mo tojpl, lnmo ostél ls oqugpejontls
mo clnto mo dlrårgls roegs proigsls (roioptlros KXY o rofùkgls etýjgils). Flkl ebegxl, nl
stretuj 5, ostél ls sorvgmlros pðbfgils mgrotejonto sgnirlngzemls ilj ls oqugpejontls
mo proigsél. Nl stretuj 2, ostél ls sorvgmlros pðbfgils utgfgzemls plr pemrél pofls mojegs
sorvgmlros o ifgontos ntp ml junml, pere ovgter slbroierke nl stretuj 5.
Xlr quostÿos mo tråcokl mo romo, ilnkurerojls nl nlssl oxojpfl uj ðngil sorvgmlr N]X.Es mojegs jåqugnes etuefgzerél l sou dlrårgl e pertgr mosso sorvgmlr, sonml ifgontos mofo0
Nl sorvgmlr
5. Gnstefer l Yorvgmlr N]X.
# ept-kot gnsteff ntp ntp-sorvor
2. Sejls ontrer eklre nl erqugvl mo ilnkureëél ml sorvgmlr N]X0
# vg /oti/ntp.ilnc
Yegbe jegs
L sgstoje Fgnuxprlplriglne uj
krenmo nðjorl mo
flks, l quo plssgbgfgte
el emjgngstremlr tor
krenmo ilntrlfo slbro
l sgstoje. Yebonmlemjgngstrer ossos flks
ilrrotejonto, ofos
so tlrnej uje erje
plmorlse pere quo so`e
plssêvof provongr orrls
o etç josjl rosplnmor
jofdlr es tontetgves
mo gnvesél.
f
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 95/282
;7
I e p ê t u f l
9 - D e r m o n g n k o j s
g s t o j e F g n u x ’ R o k g s t r l m o o v o n t l s ( f l k ) o D G M Y
Nùs vorojls sljonto efkujes lpëÿos mosso erqugvl, plgs e ilnkureëél ml sorvgmlr ç
boj sgjpfos.
5 sorvor 52;.52;.5.8 nosso perâjotrl, ç ilnkureml l GX lu nljo ml sorv gmlr el quef l
ntp movo so sgnirlngzer (plr oxojpfl, dttp0//ntp.iegs.rnp.br ç uj oxojpfl mo sorvgmlr mo
stretuj 2 nl Bresgf)1
5 stetsmgr /ver/flk/ntpstets/ mgrotùrgl lnmo vél ier ls flks mo ostetêstgies ml jou sor-
vgmlr N]X1
5 mrgctfo /ver/fgb/ntp/ntp.mrgct erqugvl lnmo ierå ilnkureml l veflr ostgjeml mo orrl
mo croquànige ontro l rofùkgl ml sgstoje o l sorvgmlr mo sgnirlnge mo stretuj entorglr.
9. Uuo iljenml oxoiutl pere jlngtlrer e jgnde iljungieëél ilj ls sorvgmlros
mo sgnirlngzeëél<
# ntpq -p 572.534.588.588
=. Lnmo plssl onilntrer rocoràniges els sorvgmlros N]X pðbfgils mo stretuj 5 o 2<
dttp0//ntp.gsi.lrk/bgn/vgow/Yorvors/[obDljo
?. Moplgs mgssl, vejls rogngiger l meojln ml ntp-sorvor pere sgnirlngzer o pesser e sor uj
sorvgmlr N]X.
# /oti/gngt.m/ntp-sorvor rostert
3. Sejls vorgier l flk oj lutrl torjgnef pere vor l prliossl mo sgnirlngzeëél.
# tegf -c /ver/flk/sysflk
Nls ifgontos
5. Gnstefer l ifgonto N]X.
# ept-kot gnsteff ntpmeto
2. Xere es jåqugnes me romo quo clroj ls ifgontos N]X, ç plssêvof cezor e sgnirlngzeëél ml
dlrårgl ilj l sorvgmlr etrevçs ml iljenml ntpmeto0
# ntpmeto 572.534.588.588
9. Iesl nél oxgste uj sorvgmlr N]X ne romo, plmojls sgjpfosjonto rogngiger l meojln
ml ntpmeto.
# /oti/gngt.m/ntpmeto rostert
Ilntebgfgzeëél mo prliossls q]oj plr lb`otgvl eplger moigsÿos rofeiglnemes e ‖pfenl mo iepeigmemo‚ lu e eumgtlrge mo
uj prliossl quo plrvonture osto`e ilnsujgnml jugtl roiursl me jåqugne.
5 Ilntebgfgzeëél mls prliossls plmo tejbçj plssgbgfgter ilntrlfo slbro quegs prl-
iossls o quegs rospoitgvls usuårgls.
2 Xere gssl, beste user l iljenml festiljj, quo nél voj gnstefeml plr pemrél ne
jeglrge mes mgstrgbugëÿos Fgnux. Ç noiossårgl gnstefer l peilto eiit.
Gnstefeëél ml peilto eiit, quo trez l iljenml festiljj.
# ept-kot gnsteff eiit
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 96/282
48
D e r m o n g n k o j F
g n u x
Sorgquo so l erqugvl /ver/eiilunt/peiit , quo ç lnmo ie e gnclrjeëél mo ilntebgfgzeëél,
clg irgeml.
# fs /ver/eiilunt/peiit
]osto l festiljj.
# festiljj
Mosse jenogre, ç jlstreme uje vgsél koref mo tlmls ls ðftgjls iljenmls mgkgtemls pofls
usuårgls. Xere ilnsufter gnclrjeëÿos mo sljonto uj usuårgl, oxoiuto l festiljj me
sokugnto clrje.
# festiljj rllt
# festiljj tllr
Xlmojls tejbçj cezor e ilnsufte pofl iljenml nl fuker ml usuårgl.
# festiljj fs
Ilnifusél
Rokgstrl mo ovontls (flks) o eumgtlrge mo iljenmls sél etgvgmemos mojenmemes oj quefquor
ejbgonto mo ]G. E gjplrtânige mo so tor uj ejbgonto ilj e iepeigmemo mo sor eumgteme,
ilj l rokgstrl me trgfde mo tlmls ls iljenmls, ç onlrjo.
Xonsenml oj uje sgtueëél mo efte irgtgigmemo oj quo so`e noiossårgl rosplnmor e uj gnig-
monto mo sokurenëe lu josjl tor gnclrjeëÿos pere uje porêige clronso iljputeiglnef, tor
uje ostruture mo flks lrkengzeme ilj rçpfgies oj lutrl sorvgmlr ç vgtef.
Eumgtlrge ilj DGMY
q_sl mo DGMY pere gmontgieëél mo jlmgieëÿos oj uj sorvgmlr0
5 Xlmo sor uj joiengsjl cuniglnef nél sljonto pere gmontgier jumenëes nél
prlkrejemes, jes tejbçj jumenëes quo plmoj tor lilrrgml oj uj gnigmonto
mo sokurenëe.
EGMO0
5 Ç uj DGMY pråtgil, mo gjpfojonteëél sgjpfos o ilj iortoze slje oj uj prliossl
mo Dermongnk, irgenml e plssgbgfgmemo mo roefgzeëél mo eumgtlrge pere vorgier
jumenëes nl sgstoje.
Xere gnstefer l EGMO0
ept-kot gnsteff egmoL mgrotùrgl pemrél lnmo ie l erqugvl mo ilnkureëél ç l /oti/egmo, o l erqugvl ç l egmo.ilnc .
Lutrl mgrotùrgl gjplrtento ç lnmo iej es prgnigpegs rokres mo lnmo o iljl movorél sor
gmontgiemes es gnclrjeëÿos slbro flks0
# im egmo.ilnc.m/
Ls erqugvls me beso sél irgemls oj /ver/fgb/egmo ilj es gnclrjeëÿos pere eumgtlrge0
/ver/fgb/egmo/egmo.mb -
/ver/fgb/egmo/egmo.mb.now
Yegbe jegs
]lmes es gnclrjeëÿosml iljenml festiljj
ostél montrl ml
erqugvl /ver/eiilunt /
peiit o sù plmoj sor
vgsuefgzemes etrevçs
mo iljenmls iljl l
festiljj.
f
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 97/282
45
I e p ê t u f l
9 - D e r m o n g n k o j s
g s t o j e F g n u x ’ R o k g s t r l m o o v o n t l s ( f l k ) o D G M Y
Ç prlvåvof quo es ilncgkureëÿos pemrél quo gnmgiej lnmo l EGMO movo vorgier nél
etonmej e tlmls ls iesls, o ilnsoquontojonto e`ustos movorél sor cogtls. _je gntorossento
jlmgieëél ç nél eumgter mgrotùrgls quo plssuoj croquontos jlmgieëÿos, iljl ç l iesl
mo erqugvls mo flks. L EGMO nél ç e jofdlr correjonte nosso iesl0 l gntorosso ç tor clil
oj erqugvls o mgrotùrgls mo ilnkureëél gjplrtentos. Essgj sonml, user ls roiursls mo
‖oxioëél‚ ç uje ble slfuëél0
Omgto l erqugvl egmo.ilnc gknlrenml tlme e peste /ver/flk, !/ver/spllf/ o /ver/ieido/squgm.
#vgj egmo.ilnc
Eff:R+e+sde5+rjm538
/oti p+g+u+k # idoia sljonto porjgssÿos, gnlmo, usuårglso krupls ml oti
/bgn Eff # epfgie es rokres mocgngmes ne vergåvof Eff peretlmls ls erqs ml /bgn
/sbgn Eff # gmoj /sbgn
/ver Eff # gmoj /ver
/usr/bgn Eff # gmoj /usr/bgn
/usr/sbgn Eff # gmoj /usr/sbgn
/oti IlncCgfos
#
!/ver/flk/.* # gknlre l mgrotùrgl /ver/flk
!/ver/spllf/.* # gknlre l mgrotùrgl mo spllf
!/ver/ieido/squgm.
*Epùs cezor quefquor jlmgcgieëél, ç noiossårgl oxoiuter l iljenml0
# upmeto-egmo.ilnc
E correjonte Ejbgonto Evenëeml mo Motoiëél mo Gntrusl (EGMO) irge uje beso mo memls
pere iljpereëÿos plstorglros e pertgr mo efkuns efklrgtjls mo desd irgptlkråils o gnclr-
jeëÿos mo jotememls mls erqugvls, iljl krupl, mlnl, tejendl o dlre mo jlmgieëél.
_sl ml EGMO
Irger uje iùpge ml erqugvl mo ilnkureëél nl mgrotùrgl /ver/fgb/egmo, idejeml egmo.ilnc.
eutlkonoretom , quo veg sor useml pofl iljenml koremlr mo besos ml EGMO.
# im /ver/fgb/egmo
# ip egmo.ilnc.eutlkonoretom egmo.ilnc
# egmo --gngt
Clg koreml l erqugvl /ver/fgb/egmo/mb.egmo.now . Xere sor cogte e eumgtlrge, ç noiossårgl ronl-
joer l erqugvl pere /ver/fgb/egmo/mb.egmo lu user l iljenml0
# egmogngt
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 98/282
42
D e r m o n g n k o j F
g n u x
Uuenml oxoiuteml, l iljenml egmogngt irgerå l erqugvl ver/fgb/egmo/mb.egmo.now o tejbçj l
/ver/fgb/egmo/mb.egmo.
Roefgzeëél mo uje eumgtlrge0
# ngio -n -57 egmo ’I --ilncgk:/ver/fgb/egmo/egmo.ilnc | too /oti/
rofetlrgl.txt
Ls Dlst Gntrusgln Motoitgln Yystoj (DGMY) sél uj joiengsjl gjplrtento ne gmontgieëélmo jefweros o mo jlmgieëÿos ès ilnkureëÿos ml sgstoje. Mosse clrje, josjl quo
e nlrje so`e oncåtgie ne quostél mo v êrus (quo, nl ilntoxtl mo sgstojes Fgao _ngx, sél
mgcorontos mo sgstojes Jgirlslct movgml è clrje iljl sues prlplstes mo MEI clrej moso -
ndemes), movojls fover oj ilnsgmoreëél sues roiljonmeëÿos, trezonml-es pere l ilntoxtl
ml Ygstoje Lporeiglnef Fgnux.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 99/282
49
I e p ê t u f l 9 - R l t o g r l m o E t g v g m e m o s 9
Rltogrl mo Etgvgmemos 9
Etgvgmemo 9.5 ’ Dermongnk Fgnux ’ Rokgstrl mo ovontls (flks)
5. Ilnkuro e vergåvof DGY]]GJOCLRJE] nl .besdri mls usuårgls syslp o syemjgn.
2. Ilnkuro e vergåvof DGY]]GJOCLRJE] nl .besdri ml /oti/saof .
9. Ilnkuro e vergåvof DGY]CGFO nl .besdri ml usuårgl rllt pere quo so`e plssêvof tor uje
trgfde mgcoronto pere ieme usuårgl quo zor su pere rllt.
=. Ilnkuro l Yysflk-nk pere ostruturer ls flks krevenml-ls o lrkengzenml-ls oj erqugvls,
ilj e CEIGFG]W o e XRGLRG]W. Eprosonto sues lbsorveëÿos.
?. Irgo uje rokre nl Yysflk-nk pere ilniontrer oj uj ðngil erqugvl tlmls ls flks.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 100/282
4=
D e r m o n g n k o j F
g n u x
3. Irgo uj sorvgmlr mo Flk rojltl o roefgzo tostos.
;. Irgo uj ienef sokurl ontro l ifgonto o l sorvgmlr mo flks utgfgzenml l Y]_NNOF.
Etgvgmemo 9.2 ’ Eumgtlrge DGMY
5. Epùs e ilnkureëél, movo-so gngigefgzer l EGMO. Xere jofdlr ilntoxtuefgzeëél, sorå
noiossårgl irger uje sgjufeëél mo jlmgieëél mo erqugvls ostretçkgils, jlmgienml
jotememls o ilntoðml. Xere gssl, oxoiuto ls sokugntos iljenmls0
# oidl # >> /oti/dlsts.efflw
# oidl # >> /oti/dlsts.mony
# oidl # >> /oti/sorvgios
# idjlm ;88 /oti/pesswm
# idjlm ;88 /oti/sdemlw
# idjlm ;88 /oti/sorvgios
2. Etgver e ilntebgfgzeëél mo prliossls o user l iljenml festiljj pere fgster gnclrjeëÿos
epuremes mo ilntebgfgzeëél mls prliossls.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 101/282
4?
I e p ê t u f l 9 - R l t o g r l m o E t g v g m e m o s 9
9. Roefgzo uje eumgtlrge ilj l EGMO.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 102/282
43
D e r m o n g n k o j F
g n u x
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 103/282
4;
I e p ê t u f l
= - Y o r v g ë l s m o R o m o s ’ X e r t o
5
l b ` o t g v l s
i l n i o g t l s
=Yorvgëls mo Romos ’ Xerto 5
Gmontgier sorvgëls mo romo etgvls1 Roclrëer e sokurenëe ml sorv gël YYD1 Gjpfojonter
joiengsjl ilntre etequo mo Clrëe Brute.
Jonlr Xrgvgfçkgl o Jonlr Roiursl pere sorvgëls mo romo1 Yorvgëls ]IX o _MX1
Dermongnk mo YYD.
Idoiafgst nls sorvgëls ml sgstoje
qGnstefeëél o ilnkureëél mo sorv gëls båsgils nl Fgnux0
5 Nél ç iljpfgieml. Moplgs me gnstefeëél, ̀ å osterél cuniglnenml.
2 Nl ontentl, ç proigsl evefger, toster o rovgser sues ilnkureëÿos.
Gnstefer o ilnkurer sorvgëls båsgils oj uj sgstoje Fgnux nél ç tél iljpfgieml. Jugtls
sorvgëls, moplgs mo gnstefemls, `å ostél cuniglnenml, jes ilj ilnkureëél pemrél. Efkuns
`å vàj gnstefemls o debgf gtemls plr pemrél `å ne gnstefeëél ml sgstoje Fgnux. Ontrotentl,
el ponser oj sokurenëe, sebojls quo nél so movo ilflier uj sorvgël oj prlmuëél ilj
ilnkureëÿos pemrél soj quo ostes so`ej evefgemes, tostemes o rovgsemes.
Jugtls emjgngstremlros, tefvoz plr soroj gngigentos, nél seboj tgrer prlvogtl mo corre-
jontes ifåssgies pere vorgier o evefger so l sorvgël ostå cuniglnenml ilrrotejonto, efçj
mo vorgier oj quef plrte l sorvgël ostå trebefdenml o so ostå roiobonml roqugsgëÿos
ilrrotejonto. Oj efkuns iesls, tejbçj ç noiossårgl vor so nonduj gnigmonto mo soku-
renëe jltgvlu efkuje jumenëe nl cuniglnejontl ml sorvgël lu josjl so clg uj votlr mo
ejoeëe pere uj eiossl gnmovgml quo plssgbgfgtlu uj gnveslr cezor eftoreëÿos nl sgstoje
quo plmorgej pro`umgiå-fl.
Mgento mosso ionårgl, iljoëerojls osto iepêtufl jlstrenml efkuns iljenmls quo plmoj
clrjer uje fgste mo eëÿos o roiursls quo plmorél sor idejemls mo ‖idoiafgst‚, l quo porjg-
tgrå uje evefgeëél, ojblre plntuef, jegs gntorossento mls sorvgëls mo romos etgvls.
Xrgjogrejonto, ç roiljonmåvof gmontgier e plrte mongme pofl sorvgël, jes gssl koref-
jonto ç uje teroce sgjpfos, plgs ls sorvgëls plssuoj plrtes prç-mongmes. Xlmojls vor
efkujes plrtes pemrél ml sgstoje nl erqugvl /oti/sorvgios. Oxojpfls mo efkujes plrtes0
# iet /oti/sorvgios
# iet /oti/sorvgios | krop -g ssd
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 104/282
44
D e r m o n g n k o j F
g n u x
ssd 22/tip # YYD Rojlto Flkgn Xrltlilf
ssd 22/ump
Epùs tor gmontgieml es gnclrjeëÿos mes plrtes oj quo ls sorv gëls sél etgvemls, movojls
user efkuj iljenml quo porjgte ilnsufter gnclrjeëÿos mo plrte, iljl l notstet , fslc o
cusor . Ossos iljenmls vél clrnoior efkujes gnclrjeëÿos slbro ls sorvgëls mo romo ml etgvl
nl sgstoje. Ç våfgml fojbrer quo sél onilntremes gjpfojonteëÿos ml notstet oj lutrls
Ygstojes Lporeiglnegs _ngx o tejbçj [gnmlws, jes quo nél noiossergejonto plssuoj es
josjes lpëÿos lu ls roiursls cuniglnerél me josje clrje.
# notstet -nftp
Lnmo0
5 -n0 ç e lpëél pere cezor l notstet nél roslfvor ls GXs pere nljos1
5 -f0 fgste ls sliaots quo ostél luv gnml (fgston), lu so`e, quo ostél prlntls pere roiobor
uje ilnoxél1 5 -t0 fgste sljonto ls sliaots nl prltlilfl ]IX. Xlmojls tejbçj utgfgzer l -u pere prltl-
ilfls _MX1
5 -p0 fgste gnclrjeëÿos slbro l prliossl ml sorv gël vgniufeml è plrte ilnsufteme.
Ilj gssl, plmojls vor vårges gnclrjeëÿos slbro ls sliaots quo ostél ekuermenml ilnoxÿos.
Oxojpfl0
Xrltl Roiv-U Yonm-U Onmoroël Flief Onmoroël Rojltl Osteml
tip 8 8 8.8.8.8022 8.8.8.80* L_ËE
5 Xrltl0 ç l prltlilfl oj quo osso sliaot ostå trebefdenml1 5 Onmoroël Flief0 ç gnmgieml quo e plrte 22 plmo rosplnmor e quefquor gntorceio mo romo
nl sgstoje (8.8.8.8022)1
5 Onmoroël Rojltl0 jlstre quo nél då nonduje ilnoxél rofeiglneme èquofe plrte, iu`l
Osteml ç L_ËE, lu so`e, ekuerme ilnoxÿos.
Xlmojls user l notstet ilj l -e nl fuker ml - t pere ilnsufter tlmls ls ‖sliaots‚, tentl ls
quo ostél luvgnml iljl ls quo nél ostél luvgnml o ls ilj ‖ilnoxÿos ostebofoigmes‚, l
quo ç jugtl gntorossento pere l sysemjgn. Uuenml so slfgigte gnclrjeëÿos mo ‖ilnoxÿos
ostebofoigmes‚, plmojls vor e quef gntorceio o plrte (ifgonto o ml sorv gël) ostå ilnoiteme, o
e lrgkoj me ilnoxél.
# notstet -net
Xrltl Roiv-U Yonm-U Onmoroël Flief Onmoroël Rojltl Osteml
tip 8 8 58.8.8.5092;;4 288.529.529.52905=9 OY]EBOFOIGME
tip3 8 8 00cccc058.8.8.5022 00cccc0572.534.8.4092;73 OY]EBOFOIGME
Ilj e seême ml iljenml notstet , entorglrjonto gfustreme, sebojls quegs sliaots ostél mgspl-
nêvogs o plmojls vor quef prliossl (sorvgël) ostå rlmenml nosso sliaot ilj l iljenml cusor .
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 105/282
47
I e p ê t u f l
= - Y o r v g ë l s m o R o m o s ’ X e r t o
5
# cusor -v 22/tip
_YOR XGM EIIOYY ILJJENM
22/tip rllt 97=9 c.... ssdm
Lnmo -v ç l jlml vorblso.
Xlmojls vor quef usuårgl ostå rlmenml l prliossl, l XGM (nðjorl ml prliossl) o l prl-
kreje quo ostå rlmenml, quo nosso iesl ç l ssdm. Xere ieme prliossl quo ostå rlmenml,
l sgstoje irge uj mgrotùrgl ilj sou XGM nl /prli, lnmo ç plssêvof lbtor efkujes mo sues
gnclrjeëÿos. _je mofes ç l erqugvl ijmfgno, quo jlstre l iejgndl iljpfotl ml prlkreje
o nls porjgto sebor quo equofo prlkreje ç roef, o nél uj prlkreje clr`eml.
# iet /prli/97=9/ijmfgno
/usr/sbgn/ssdm
Lutre correjonte quo plmojls user ç l fslc , quo nls jlstre gnclrjeëÿos peroigmes ilj l
notstet o l cusor , sù quo oj uje ðngie correjonte. L iljenml fslc jlstrerå ls sliaots quo
ostél luvgnml, quo ostél ostebofoigmls o, ontro lutrls, nls jlstrerå tejbçj l usuårgl, l
XGM o l prlkreje quo ostå rlmenml. Lu so`e, poriobojls quo l iljenml fslc ç uje `unëél
ontro l notstet o l cusor . Xlrçj, oj efkujes mgstrgbugëÿos Fgnux lu josjl moponmonml me
gnstefeëél, l iljenml fslc plmo nél sor gnstefeml plr pemrél, sonml noiossårgl gnstefå-fl
vge peiltos lu pofl slurio.
# fslc -g
cgroclx-b =3?2 usor 93u GXv= 22;29 ]IX 58.8.8.5094594-
>3=.299.535.570www (OY]EBFGYDOM)
ssd 49=2 rllt 9u GXv= 5889;3 ]IX 58.8.8.50?=;?5-
>572.534.8.40ssd (OY]EBFGYDOM)
Lnmo -g fgste tlmls ls prliossls lu erqugvls rofeiglnemls e uje gntorceio mo romo. Yo nél
clr ospoigieme uje gntorceio mo romo, iljl gfustreml, ofo jlstrerå tlmes es gntorceios.
_je ilgse quo jugtls emjgngstremlros tejbçj so osquoioj mo lfder sél ls rew sliaots,
sliaots quo nél moponmoj mo uj prltlilfl ospoiêil o porjgtoj eiossl mgrotl e prltl-
ilfls mo begxl nêvof iljl GIJX, ]IX, _MX o GX.
Xlmojls vor so oxgsto efkuj rew sliaot ebortl nl nlssl sgstoje utgfgzenml l notstet ilj
lutre lpëél.
# notstet ’nfw
Lnmo -w fgste ls rew sliaots.
Xrlvevofjonto nél devorå nonduj ebortl vge Rew Yliaot, ontél so rotlrne uje rosplste
vezge. Jes movo-so tejbçj tor jugte etonëél ilj e iljungieëél Rew Yliaots, plgs ç
iljuj beiamllrs jegs sutgs quo utgfgzej l rew sliaot. _j blj oxojpfl ç uje beiamllr
quo utgfgzo l prltlilfl GIJX pere porjgtgr e oxoiuëél mo iljenmls rojltejonto.
Yegbe jegs
Ls rew sliaots sélilnsgmoremls plr
jugtls iljl uj plton-
igef clil mo prlbfojes
mo sokurenëe movgml
el cetl mo quo pluils
emjgngstremlros vorg-
iej es etgvgmemos morew sliaots mosous sgstojes.
f
Yegbe jegs
So`e jegs motefdos ne
mliujonteëél
ml dpgnk.
f
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 106/282
78
D e r m o n g n k o j F
g n u x
Yeême mo uje rosplste plsgtgve, ut gfgzenml l notstet pere fgster ls rew sliaots0
Xrltl Roiv-U Yonm-U Onmoroël Flief Onmoroël Rojltl Osteml
rew 8 8 8.8.8.802?? 8.8.8.80* ;
_j ðftgjl prlkreje sukorgml, quo plmo sor useml pere vefgmeëél mo plrtes etgves, ç l
njep, uj plrtesiennor jugtl plmorlsl pere verromures mo plr tes. Nosso iesl, tojls e
plssgbgfgmemo mo cezor uje enåfgso gntorne lu oxtorne mo uj motorjgneml sorvgmlr lu kruplmo sorvgmlros pere quo so`e plssêvof gnvonterger quegs plrtes/sorv gëls ostél mgsplnêvogs. L
njep nél voj plr pemrél nes mgstrgbugëÿos Fgnux, sonml noiossårgl gnstefå-fl.
Oxojpfl mo usl pere plrtes ]IX0
# njep -s] ’n ’X8 58.8.8.5
XLR] Y]E]O YORSGIO
7/tip lpon mgsierm
59/tip lpon meytgjo
25/tip lpon ctp
22/tip lpon ssd
Lnmo0
5 -s]0 cez e verromure iljpfote mo plrtes ]IX1
5 -n0 nél roslfvor nljos vge MNY1
5 -X8 0 nél roefgzer tosto pere vorgier so l sorvgmlr eftl ostå etgvl
(gijp Roquost o eia ne plrte 48)1
5 58.8.8.50 roprosonte sou GX.
Oxojpfgieëél mo usl njep tonml iljl efvl e gntorceio fllpbeia0
# njep -s] ’n ’X8 fliefdlst
# njep -s] ’n ’X8 -p 22 fliefdlst
XLR] Y]E]O YORSGIO
22/tip lpon ssd
Oxojpfl mo usl pere plrtes _MX0
# njep -s_ ’n ’X8 58.8.8.5
XLR] Y]E]O YORSGIO
7/ump lpon|cgftorom mgsierm
Xlrtesiennor
Correjonte quo cez ujeverromure nes plrtes,
tostenml e sokurenëe
ml cgroweff o vorgcgienmlso es plrtes ostél
ebortes lu coidemes
pere eiossl etrevçs me
gntornot.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 107/282
75
I e p ê t u f l
= - Y o r v g ë l s m o R o m o s ’ X e r t o
5
?9/ump lpon|cgftorom mljegn
555/ump lpon|cgftorom rpibgnm
Lnmo0
5 -s]0 cez e verromure iljpfote mo plrtes ]IX1
5 58.8.8.50 roprosonte sou GX.Nl ilntoxtl flief0
# njep ’s_ ’n ’X8 fliefdlst
# njep -s_ ’n ’X8 -p ?9 fliefdlst
XLR] Y]E]O YORSGIO
?9/ump lpon|cgftorom mljegn
Oxojpfl mo usl pere plrtes ]IX o _MX sgjuftenoejonto0
# njep -s_ ’s] ’n ’X8 58.8.8.5
Oj efkuns iesls, l usl ml njep plmo sor gntorossento pere cezor l idoiafgst mo tlmes es
plrtes etgves nl sorv gmlr.
# njep -s_ ’s] ’n ’X8 -C 58.8.8.5
Lnmo -C roprosonte tlmes es plrtes mo sorvgëls ifåssgils nl (/oti/sorvgios ml njep). Lu user
e lpëél -p- plrte e plrte etç mo 5 e 3??9?. Yonml essgj, ç plssêvof ilnsufter tlmes es plrtes
quo ostél mgsplnêvogs oj nlssl sgstoje.
# njep -s_ -s] ’n ’X8 -p- 58.8.8.5
Xlmojls vor tejbçj ls bennors mls sorvgëls quo ostél rlmenml. Xere uj gnveslr, osse
plmo sor uje gnclrjeëél proiglse.
# njep ’sS ’n ’X8 58.8.8.5
XLR] Y]E]O YORSGIO SORYGLN
22/tip lpon ssd LponYYD 9.4.5p5 (prltlilf 2.8)
2?/tip lpon sjtp Oxgj sjtpm =.?8
555/tip lpon rpibgnm 2 (rpi #588888)
559/tip lpon gmont LponBYM gmontm
JEI Emmross0 880?80BC0390M80O; (Jltltoid)
L njep plssug jugtes lpëÿos. Xlmojls ilnsufter oj lutrl jljontl sou jenuef, pere vor
tlmes es lpëÿos mo usl.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 108/282
72
D e r m o n g n k o j F
g n u x
Nél movojls mogxer l njep gnstefeml oj uj sorvgmlr soj ilntrlfos rêkgmls mo
porjgssglnejontl, plgs, plr pemrél, uj usuårgl iljuj plmo oxoiutå-fl pere
roefgzeëél mo verromure ml tgpl ]IX Ilnnoit. Eposer mo sor uje correjonte quo
clrnoio gnclrjeëÿos proiglses, ofo plmo clrnoior osses josjes gnclrjeëÿos pere
uj usuårgl jef-gntoniglneml lu josjl pere efkuçj quo tovo efkuj tgpl mo eiossl
erbgtrårgl el sgstoje.
Oxoriêigl mo cgxeëél 5oIdoiafgst mo Romo
Ionårgl mo uj gnigmonto mo sokurenëe ’ Ostuml mo iesl
Ilnsgmoro l ionårgl prlplstl oj uj gnigmonto mo sokurenëe lilrrgml ne ‖Cåbrgie mo
Brgnquomls ’ Kgct & Kgc t Ftme.‚, lnmo l emjgngstremlr mo uj sorvgmlr MNY eidlu ostrendl l
eiossl el mgsil, uje voz quo `å orej jegs mo 29d mo uje soxte-cogre, o l eiossl ostå jugtl
krenmo. Nequofe dlre nél devge ngnkuçj jegs ne ojprose, efçj mofo, quo osteve eiljpe-
ndenml uje jgkreëél mo uj mls sorv gmlros mo benils mo memls.
El ilnsufter e jåqugne, l emjgngstremlr poriobou quo, efçj me plrte ?9 ml MNY o 2? ml
J]E Oxgj, mostgneml e jonsekons gntornes ml sgstoje, devge uje lutre plrte etgve, e plrte
333, iljl gnmgieml ne tebofe =.5.
Ilnoxÿos Gntornot Etgves (soj ls sorvgmlros)
Xrltl Roiv-U Yonm-U OnmFlief OnmRojltl Osteml XGM/Xrlkrej nejo
tip 8 8 8.8.8.80?9 8.8.8.80* L_ËE 2;=;/plrtjep
tip 8 8 52;.8.8.502? 8.8.8.80* L_ËE 9583/oxgj=
tip 8 8 8.8.8.80333 8.8.8.80* L_ËE 9324/gnotm
Iljjenm Xgm _sor CM ]ypo Movgio Ygzo Nlmo Nejo
bgnm 2;=; meojln 9u GXv= 58327 _MX *0mns
oxgj= 9583 Mobgen-oxgj 9u GXv= 528=3 ]IX fliefdlst0sjtp (FGY]ON)
bgnm 9929 rllt 3u GXv= 524=? _MX *0mns
gnotm 93;3 rllt =u GXv= 28=3; ]IX *0sljbre (FGY]ON)
Ilnoxÿos Gntornot Etgves (sorvgmlros o ostebofoigmes)
Xrltl Roiv-U Yonm-U OnmFlief OnmRojltl Osteml
tip 8 8 8.8.8.80555 8.8.8.80* L_ËE
tip 8 8 52;.8.8.502? 8.8.8.80* L_ËE
tip 8 8 8.8.8.80333 8.8.8.80* L_ËE
tip =29= 8 72.534.8.5?80333 252.534.8.5;5092;;3 OY]EBOFOIGME
tip 8 7;4 252.534.8.5;5092;;3 72.534.8.5?80333 OY]EBOFOIGME
Gntrgkeml ilj e plrte 333 , l emjgngstremlr roslfvou ilnsufter jegs motefdos slbro l
prliossl quo osteve etgvl ne rospoitgve plrte. Busilu jegs gnclrjeëÿos ilj l iljenml
fslc ’ e seême ml iljenml fslc ç jlstreme ne tebofe =.2.
Nltlu uj nljo ostrendl o jugtl sukostgvl pere l rospoitgvl sorvgël, l quo osteve nltlrge-
jonto quefgienml iljl uje plssêvof beiamllr. Ilj osse gmontgieëél, e prlve mo uje
vglfeëél ml sgstoje ostå quefgieme, iereitorgzenml uj gnigmonto mo sokurenëe irêtgil.
Cgkure =.5
]ebofe mo sorvgëls]IX oj osteml—Fgston‗.
Cgkure =.2
]ebofe mo seêmeml iljenml
—fslc‗.
]ebofe =.9
]ebofe mo seême mliljenml —notstet‗.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 109/282
79
I e p ê t u f l
= - Y o r v g ë l s m o R o m o s ’ X e r t o
5
Mgento mosses gnclrjeëÿos, l emjgngstremlr roslfvou ilfoter jegs gnclrjeëÿos mes etgvgmemos
mo ilnoxÿos ostebofoigmes ilj l sorvgmlr, busienml gmontgier so e suplste Beiamllr osteve
sonml utgfgzeme. _slu nlvejonto l iljenml notstet , lb`otgvenml tor tlmes es gnclrjeëÿos
slbro es ilnoxÿos ostebofoigmes. E seême ml iljenml notstet ç jlstreme ne tebofe =.9.
Entos mo tljer quefquor eëél roetgve, l emjgngstremlr proigseve sebor quo epfgieëél osteve
etgve ne rospoitgve plr te. Ontél, debgfjonto roilrro nlvejonto el sdoff ml sgstoje, jes
mosse voz uslu l iljenml cusor pere tor jegs gnclrjeëÿos.
El user l iljenml cusor , iljl ç gfustreml ne kure =.5, ilu iferl quo l prliossl vgniufeml
el moejln gnotm ne roefgmemo ç e sdoff besd, l quo mogxeve nltùrgl quo equofe plrte ore
uje ifåssgie beiamllr gjpfojonteme nl gnotm.ilnc, l quo tejbçj retgieve l cetl mo l
sorvgmlr oj quostél oster iljprljotgml.
xngn`e# cusor -v 333/tip
_YOR XGM EIIOYY ILJJENM
333 rllt 2925 c . . . . gnotm
rllt 2925 c . . . . besd
xngn`e#
Mgento ml quo clg rofeteml, essgnefo S (vormemogrl) lu C (cefsl)0
( ) _je Beiamllr iljl e gfustreme plmo sor gnstefeme plr uj gnveslr, jes tejbçj plr uj
gnsgmor (ojprokeml jef-gntoniglneml) lu uj krey det (psouml ilnsuftlr prostemlr mo sorvgël).
( ) _je beiamllr mosse ietoklrge ç tél onkondlse quo nél ç motoitåvof nl sgstoje, josjl
plr uj emjgngstremlr oxporgonto quo roefgzo l prliomgjontl mo idoiafgst mo sorvgëls mo
romo, rofeiglnenml ls prliossls o sorvgëls etgvls.
( ) Ç jugtl iljuj oj uje gnvesél mo sgstojes l gnveslr gnstefer rlltagts quo, efçj mo
gjpfojonteroj beiamllrs nl sgstoje, emuftorerej bgnårgls mo iljenmls ifåssgils (notstet ,
cusor, ps, fslc o lutrls) pere ovgter quo l emjgngstremlr es gmontgquo. Ontrotentl, e beiamllr
onilntreme clg gjpfojonteme utgfgzenml roiursls ml prùprgl sgstoje.
Runfovof
Moplgs mo toroj sgml roefgzemes tlmes es idoiekons o ofoniemls tlmls ls sorvgëls quo
ostél etgvls nl nlssl sgstoje, ç gjplrtento evefger so roefjonto ç noiossårgl quo tlmls ls
sorvgëls gngigefjonto gmontgiemls iljl etgvls movorgej oster etgvls. Iesl nél, plmojls
mosetgver ls quo nél sél noiossårgls, jofdlrenml e por clrjenio o e sokurenëe ml sgstoje.
Nl Mobgen, plmojls ilnsufter ls mgrotùrgls mls nêvogs mo oxoiuëél (run fovof), besoemls nl
Yystoj S, quo ç lnmo iej tlmls ls prlkrejes quo sorél etgvemls ne gngigefgzeëél ml sgstoje.
L nêvof mo oxoiuëél pemrél ml Mobgen ç l nêvof 2. Ieme mgstrgbugëél Fgnux lrkengze sou
sgstoje mo nêvogs mo oxoiuëél mo uje jenogre mgcoronto. Xere gmontgier iljl ieme uje
mofes trebefde, plmojls ilnsufter l erqugvl /oti/gngtteb, quo ilntrlfe l prliossl gngt, l
prgjogrl prliossl e sor gngigeml nl sgstoje. Ilnsuftenml l mgrotùrgl ml nêvof mo oxoiuëél
pemrél ml Mobgen pere gmontgier ls sorvgëls gngigefgzemls plr pemrél0
# fs -f /oti/ri2.m
Cgkure =.5
Yeême ml
iljenml —cusor
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 110/282
7=
D e r m o n g n k o j F
g n u x
Ropero quo sél tlmls fgnas sgjbùfgils quo eplntej pere l mgrotùrgl /oti/gngt.m , mgrotùrgl
lnmo iej tlmls ls sirgpts quo ilntrlfej ls meojlns ml sgstoje. Iesl nél quogre quo
motorjgneml sorvgël so`e etgveml ne oxoiuëél, beste epeker l fgna sgjbùfgil mofo ml mgro-
tùrgl ml nêvof mo oxoiuëél quo ostå sonml utgfgzenml, quo nosso oxojpfl ç l runfovof 2.
Iljl oxojpfl, plmojls rojlvor l fgna sgjbùfgil ml oxgj=, uj sorvgmlr mo o-jegf pemrél ml
Mobgen. ]lmevge, oj jugtls iesls uj JME gntornl ç rofovento pere ls sorvgëls quo ierej
etgvls, tuml ç uje quostél mo quef e nefgmemo ml sorvgmlr. Gjekgno quo e nefgmemo nossooxojpfl ç mo @ oj uj sorvgmlr roweff0 nél oxgsto noiossgmemo mo mogxerjls uj sorvgmlr mo
o-jegf rlmenml ilj uj J]E, l quo mogxe sue plrte YJ]X (2?) eborte, plssgbgfgtenml quo uj
ireiaor eprlvogto-so mofe, jes oj jugtls iesls ilj JME gntornl plmo sor gntorossento.
# rj -c Y28oxgj=
lu
# jv Y28oxgj= A28oxgj=
Ilj gssl, quenml l sgstoje gngiger nl nêvof 2 pemrél, l oxgj= nél gngigerå jegs. Ç plssêvof
cezor gssl ilj tlmls ls sorvgëls quo clroj ifessgiemls iljl mosnoiossårgls o porslne-
fgzer tejbçj ls lutrls nêvogs mo oxoiuëél.
Nél movo-so osquoior tejbçj mo vorgier l mgrotùrgl /oti/riY.m , plgs nofo iej ls fgnas
sgjbùfgils mls sorvgëls quo sél gngigemls entos mls sorvgëls ml nêvof mo oxoiuëél pemrél.
Josjl quo ossos sorv gëls so`ej prgjlrmgegs pere l cuniglnejontl ml sou sgstoje, ç uje
ble pråtgie vorgier so nél oxgsto efkuj sorvgël quo so`e ilnsgmoreml mosnoiossårgl pere
osse liesgél.
Ytenmeflno vorsus Yupor MeojlnL jlmofl Gnotm (Notwlra Yupor Meojln), lnmo /oti/sorvgios jepoge l nljo ml sorvgël e
nðjorl mo plrte. Oxojpfl0
ufgstsorv 9;2/tip ufgstprli
/oti/gnotm.ilnc 0 Erqugvl prgnigpef mo ilncgkureëél
ctp stroej tip nlwegt rllt /usr/sbgn/tipm prlctpm
L substgtutl pere gnotm o ml epfgietgvl Tgnotm mosonvlfvgml lrgkgnefjonto pere RomDet o
plrteml pere lutres mgstrgbugëÿos. L Tgnotm ç ilnsgmoreml jegs oxêvof, o cuniglne ilj uj
joiengsjl mo ilntrlfo mo eiossl jegs ofeblreml, l quo tlrne-l jegs sokurl.
5 /oti/xgnotm.ilnc 0 erqugvl mo ilnkureëél prgnigpef ml Tgnotm1
5 /oti/Tgnotm/0 ilntçj erqugvls pere sorvgëls koronigemls pofl Tgnotm.
Koronigejontl mo sorvgëls mo romos oj Gnotm o Tgnotm
Xere etgver uj sorvgël vge Gnotm, beste mosiljonter e ilrrosplnmonto fgnde mo ilnkureëél
ml sorvgël nl erqugvl gnotm.ilnc o moplgs rogngigefgzer l sorvgmlr gnotm.
Rogngiger l meojln Gnotm0
# pagff ’D_X gnotm
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 111/282
7?
I e p ê t u f l
= - Y o r v g ë l s m o R o m o s ’ X e r t o
5
Lutre clrje ore oxoiuter l moejln ml gnotm0
# sorvgio gnotm rostert
Iesl l Yupor Moejln so`e besoeml nl Tgnotm, quo ç uje ovlfuëél ml gnotm mosonvlfvgme
pofe Romdet.
L erqugvl mo ilnkureëél prgnigpef ç l xgnotm.ilnc . Cezor jumenëes oj xgnotm.ilnc ç efkl
jugtl ospoiêil, plgs ç uj erqugvl jugtl sgjpfos, jes debgfgter lu mosebgfgter sorvgëlsmojenme omgter es ilnkureëÿos ilniontremes nl mgrotùrgl /oti/Tgnotm .
Erqugvl mo ilncgkureëél xgnotm.ilnc , lnmo e roiljonmeëél trgvgef ç
etgver l flk vge Yysflk.
moceufts
{
# Xfoeso nlto tdet ylu noom e flk\typo fgno tl bo ebfo tl uso
flk\ln\suiioss
# enm flk\ln\cegfuro. ]do moceuft gs tdo clfflwgnk 0
flk\typo : YWYFLK meojln gncl
}
gnifumomgr /oti/xgnotm.m
L Tgnotm plssgbgfgte jofdlres mo ilntrlfo mo eiossl pere sorvgëls, l quo ç uj ùtgjl jltgvlpere user Tgnotm oj voz ml entgkl gnotm. Lutrl plntl plsgtgvl ç quo es ilnkureëÿos mo
sorvgëls ostél soperemes plr erqugvls, l quo trez uje jlmufergmemo quo plssgbgfgte jofdlr
emjgngstreëél o lrkengzeëél.
]lme jumenëe mo ilnkureëél, tentl nl xgnotm.ilnc iljl nls erqugvls montrl ml mgrotùrgl
/oti/Tgnotm , mojenme quo l sorv gël so`e rogngigefgzeml0
# /oti/ri.m/gngt.m/xgnotm rostert
Murento l prliossl mo Dermongnk, movo-so gmontgier ls sorvgëls mo romo etgvls vge Yupor
Moejln o evefger so roefjonto movoj oster etgvls, iesl nél movoj sor mosetgvemls. ]êpgils
sorvgëls quo movoj sor bflquoemls, iljl0
5 Cgnkor, oidl o ntefa1
5 ]ofnot (uso l ssd lu uj sorvgmlr tofnot ilj ssf)1
5 C]X (so plssêvof, usor sc tp lu sip)1
5 rwdl, rsd , rflkgn o roxoi (roiljonme-so ssd, sip o sctp).
_je roiljonmeëél ç vorgier l porjgssglnejontl mls erqugvls ml mgrotùrgl /oti/Tgnotm ,
oj ‖388‚0
# idjlm ’v 388 /oti/xgnotm.m/*
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 112/282
73
D e r m o n g n k o j F
g n u x
O entos mo gr pere prlmuëél, mongr l etrgbutls ml erqugvls pere gjutåvof0
# idettr +g /oti/xgnotm.m/ * && fsettr /oti/xgnotm.m/*
O tejbçj ç roiljonmeml rovor l porjgssglnejontl mls sirgpts mls moejlns quo iej iln -
iontremls oj /oti/gngt.m . Osso sirgpts movoj oster mgsplnêvogs pere fogture epones pere l rllt0
# idjlm -S ;88 /oti/ri.m/gngt.m/*
Koronigenml gngigefgzeëél mo sorvgëls
Oj mgstrgbugëÿos fgao Mobgen, iljl _buntu, oxgsto efkuje clrje mo koroniger ls quo movoj
lu nél soroj etgvemls nl bllt ml sgstoje. Ontro es clrjes mo koronigejontl, mosteiej-so0
5 upmeto-ri.m1
5 sorvgio1
5 riilnc1
5 gnvlao-ri.m.
Yokurenëe oj sorvgëls mo romos qBles pråtgies mo sokurenëe mo romos0
5 Epfgieëél mo ilntrlfos o sokrokeëél nls sorv gëls mo romos etgvls.
2 _ser ilnkureëél iljbgneme ontro mlgs erqugvls0
9 ]IX[REXXORY.
Nl ilntoxtl mo sorvgëls mo romos, ontro es bles pråtgies mo sokurenëe mo romos, ç gjplrtento
e epfgieëél sojpro quo plssêvof mo ilntrlfos sokrokeëél nls sorvgëls mo romos etgvls, prgnig -
pefjonto nls sorvgëls emjgngstretgvls. Xere gssl, plmo sor gntorossento user e ilnkureëél
iljbgneme ontro mlgs erqugvls, pere fgjgter l usl mls sorv gëls mo romo, quo ilnkurej l
roiursl ilndoigml iljl ]IX[REXXORY (/oti/dlsts.mony o /oti/dlsts.efflw), iljbgnemeilj fgjgteëÿos mo ilnoxél ilnkuremes vge l roiursl XEJ (/oti/pej.m o /oti/soiurgty).
Gssl tuml, plstorglrjonto efgeml e uje plfêtgie boj mongme mo Cgroweff, o ilj
uje ostruture mo rokgstrl mo ovontls (flks), veg ilj iortoze ekroker egnme jegs
sokurenëe el sgstoje.
_tgfgzenml l ]IX[REXXORY, plmojls rostrgnkgr l eiossl mo tlmls ls sorvgëls mo romo o
fgborå-fl sljonto els GXs quo moso`emls.
Ç gjplrtento mosteier quo l sorv gël mo romo oj quostél toj mo tor sgml iljpgfeml ilj
suplrto pere l usl ml ]IX[R EXXORY1 mosse clrje, pere ilnrjer, ç roiljonmåvof user liljenml fmm . So`e l oxojpfl0
# fmm /usr/sbgn/ssdm
Xrgjogrl bflquoge-so l sorvgël mo ssd pere tlmls nl erqugvl /oti/dlsts.mony .
# vg /oti/dlsts.mony
ssdm0 EFF
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 113/282
7;
I e p ê t u f l
= - Y o r v g ë l s m o R o m o s ’ X e r t o
5
Oj sokugme, fgborejls pere quoj moso`ejls.
# vg /oti/dlsts.efflw
ssdm0 58.8.8.5 58.8.8.9
Nosso oxojpfl, ostå sonml mongml quo sljonto ossos mlgs GXs plmoj cezor ilnoxÿos YYD
nl sorvgmlr1 tlmls ls lutrls sorél bflquoemls.
Xere vefgmer e ilnkureëél, plmojls tonter ilnoiter vge YYD nl sorv gmlr e pertgr mo uj
mossos GXs quo ostél fgboremls o mo uj quo nél ostå fgboreml.
Correjontes mo verromures o foventejontl mo gnclrjeëél
Movojls fover oj ilnsgmoreëél nl idoiafgst mo romo e evefgeëél mo quo tgpl mo gnclrjeëél
ç clrnoigme pofl sorvgëls mo romo, pere quo so`e plssêvof rovor es ilnkureëÿos pere
rojlvà-fes. Ç cetl quo e lbsiurgmemo mo gnclrjeëÿos mo sorvgëls mo romo ç uje ble pråtgie,
jes nél ç uje eëél mongtgve quo roslfve uj prlbfoje mo vufnorebgfgmemo, plr oxojpfl.
L emjgngstremlr toj mo tor oj jonto quo nél clrnoior gnclrjeëÿos slbro sou sgstoje vge
sorvgëls mo romo ç uje ble pråtgie, jes jentà-fls etuefgzemls o movgmejonto ilnkuremls
ç egnme jegs gjplrtento.
Blns oxojpfls mo correjontes ðtogs pere osse ilfote mo gnclrjeëÿos0 clltprgnt, nkorprgnt
o onujoreëél, iljujonto utgfgzemes plr gnveslros.
Cgnkorprgnt mo sorvgël
qYubjunml me gntornot0 mgvufkeëél mo correjontes quo cezoj nkorprgnt oj sorvgëls ç
iljuj.
5 Xlr gssl, ç gjplrtento quo uj emjgngstremlr0
2 Rojlve gnclrjeëÿos mosnoiossårges.
2 Yegbe vefgmer quo tgpl mo gnclrjeëél ostå mgsplngbgfgzenml.
Ç jugtl iljuj nl ungvorsl unmorkrlunm (subjunml me gntornot) e mgvufkeëél mo corre-
jontes quo roefgzej nkorprgnt oj sorvgëls, plgs e gmontgieëél me vorsél mo uj sorvgël
ç uje gnclrjeëél cunmejontef pere uj sirgptagm epfgier l usl mo uj motorjgneml oxpflgt,
egnme nél sonml gniljuj correjontes quo cezoj osso tgpl mo ilnsufte oj krenmo osiefe.
Mosse clrje, ç gjplrtento quo uj emjgngstremlr rojlve es gnclrjeëÿos mosnoiossårges,
jes quo tejbçj segbe vefgmer quo tgpl mo gnclrjeëél ostå mgsplngbgfgzenml. Correjontes
iljl dttprgnt, ejep o njep plmoj sor jugtl ðtogs nossos jljontls.
Ejep
Yiennor mo nkorprgnt mo sorvgël mosonvlfvgml pofl ]DI (www.tdi.lrk).
_tgfgzeëél0
# ejep -s] -m -b -l ejep\roplrt.txt 52.54.5.5=
Lnmo0
5 -s]0 mono l jçtlml ]IX mo verromure1
5 -m0 mono seême oj jlml doxemoigjef1
5 -b0 mono seême oj jlml EYIGG1
5 -l0 mono quo l rosufteml me verromure movorå sor kreveml nl erqugvl gnclrjeml
epùs l perâjotrl.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 114/282
74
D e r m o n g n k o j F
g n u x
Dttprgnt
Correjonte ðtgf ne gmontgieëél lu foventejontl mo gnclrjeëÿos ml sorvgmlr D]]X, iljl
vorsél, tgpl o roiursl mgsplnêvof ’ YYF o suplrto e uje fgnkuekoj ospoiêie, iljl XDX.
Oxojpfl mo usl0
# dttprgnt -s sgkneturos.txt -l dttprgnt\roplrt.dtjf -d 52.54.5.5=
Lnmo0
5 -s0 gnclrje l erqugvl quo ilntçj es essgnetures mo nkorprgnt1
5 -l0 mono quo l rosufteml me verromure movorå sor kreveml nl erqugvl gnclrjeml
epùs l perâjotrl1
5 -d0 gnclrje l GX ml efvl.
L Ngatl.pf ç uj siennor mo vufnorebgfgmemos wob quo plmo sor useml ne onujoreëél o
gmontgieëél mo plssêvogs vufnorebgfgmemos. Ç roiljonmåvof quo entos mo sou usl ceëejls e
etuefgzeëél me sue beso mo ilndoigjontl mo vufnorebgfgmemo, begxenml es etuefgzeëÿos mls
pfuk-gns mo etequo, utgfgzenml e lpëél ‖-upmeto‚, ilnclrjo gfustreml.
Ilnsufte mls pfuk-gns mgsplnêvogs0
# ngatl.pf -fgst-pfukgns
Etuefgzeëél mls pfuk-gns0
# ./ngatl.pf -upmeto
Xere uje enåfgso sgjpfos, beste user e lpëél ‖-dlst ‚0
# ./ngatl.pf -dlst 52.54.5.5=
Xlmojls tejbçj korer uj rofetùrgl D]JF ilj l rosufteml me enåfgso0
# ./ngatl.pf -dlst 52.54.5.5= -Clrjet dtj -lutput ngatl\roplrt.dtjf
Lnmo0
5 -fgst-pfuk-gns0 fgste ls pfuk-gns etgvls1
5 -upmeto0 ilnoite nl sgto ml prl`otl pere begxer nlvls pfuk-gns o etuefgzeëÿos1
5 -dlst0 mono l efgvo1
5 -clrjet0 mono l clrjetl mo seême1
5 -lutput0 mono l nljo ml erqugvl mo seême ml rofetùrgl.
Es correjontes quo so mosteiej ne roefgzeëél mosso tgpl mo tosto sél ]DI Dymre o
Jomuse. Ejbes plssuoj suplrto e vårgls tgpls mo etequos mo Clrëe Brute o e mgcorontos
sorvgëls mo romos.
Oxojpfl ml usl mo Dymre pere uj etequo mo Clrëe Brute0
# dymre -f rllt -X XEYYCGFO.txt -l FLK.txt 52.54.5.5= ssd
Lnmo0
5 -f rllt0 flkgn efvl1
5 -X XEYYCGFO.txt0 Fgste/mgiglnårgl mo sondes1
5 -l FLK.txt0 Flk irgeml ilj gnclrjeëÿos me oxoiuëél ml etequo1
Yegbe jegs
_j tosto gntorossentoç ostrosser ls sorvgëls
mo romo quo plssuoj
eutontgieëél, tentlpere evefger e sue
porclrjenio iljl
tejbçj pere tor uje
vgsél koref slbro l
iljplrtejontl ml
sorvgël slbro uj
etequo mo Clrëe Brute.Gssl plssgbgfgte el
emjgngstremlr evefger
jofdlr l sorvgël o
es gnclrjeëÿos mo
rokgstrl mo ovontls
(flks) koremes.
f
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 115/282
77
I e p ê t u f l
= - Y o r v g ë l s m o R o m o s ’ X e r t o
5
5 52.54.5.5=0 GX ml efvl1
5 ssd0 nljo ml jùmufl ml rospoitgvl sorvgël quo sorå eteieml.
Jegs uj oxojpfl ml usl mo Clrëe Brute, eklre utgfgzenml l jomuse pere l etequo 0
jomuse -u rllt -X XEYYCGFO.txt -d 52.54.5.5= -J ssd
Lnmo0
5 -u rllt0 flkgn efvl1
5 -X XEYYCGFO.]T]0 fgste/mgiglnårgl mo sondes1
5 -l FLK.txt0 flk irgeml ilj gnclrjeëÿos me oxoiuëél ml etequo1
5 -d 52.54.5.5=0 GX ml efvl1
5 -J ssd0 nljo ml jùmufl ml rospoitgvl sorvgël quo sorå eteieml.
Es correjontes Dymre o Jomuse sél prl`otls mgstgntls jes ejbes toj e josje nefgmemo o
jugtes cuniglnefgmemos oj iljuj.
]ebofe iljperetgve ontro Jomuse o Dymre0
Åroe Coeturo Jomuse 2.5 Dymre ;.5
* Fgionëe KXF-2 KXF-9
Ilro Xereffof Jotdlm ptdroem clra()
Konorgi [repporJlmufo
sgj
ECX sgj sgj
ISY sgj sgj
C]X C]X sgj sgj
Oxpfêigtl C]XY ’jùpmufl E_]D ]FYJlmo ilnclrjo mocg-ngml ne RCI =25;)
sgj sgj
G C]XY (C]X slbro YYF(778/tip)
sgj sgj
D]]X Besgi Eutd sgj sgj
N]FJ Eutd([gnmlwsGntokretom)
sgj sgj
Mgkost Eutdontgietgln JM?, JM?-soss JM?
D]]X Xrlxy sgj
GIU sgj
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 116/282
588
D e r m o n g n k o j F
g n u x
Åroe Coeturo Jomuse 2.5 Dymre ;.5
GJEX Jotdlm FLKGNYupplrt
sgj sgj
Yuplrto el Jçtlml ’E_]D-XFEGN Yupplrt
sgj sgj
Yuplrto el Jçtlml ’E_]D-N]FJ sgj sgj
Yuplrto e YYF GJEXY, Y]ER]]FY GJEXY,Y]ER]]FY
FMEX sgj
Jgirlslct YUF Xlrt Eutl-Motoitgln sgj
JY-YUF sgj sgj
JyYUF Xro-=.5 Eutdontgie-tgln
sgj sgj
Xro-=.5 Desd Xessgnk sgj
=.5+ Eutdontgietgln sgj sgj
NIX (Not[ero) sgj (nipcs) sgj (nipcs)
NN]X Ygj (Lrgkgnef E_]DGNCL) sgj (LrgkgnefE_]DGNCL)
Lreifo Metebeso sgj (vge [reppor sirgpt)
Fgstonor
YGM sgj
XiEnywdoro Yuplrto e OniryptglnFovof Nlno Nlno
Yuplrto e Eutdongie-tgln Jlmo(s)
Netgvo XIE, EMY, N],[gnmlws
Netgvo XIE
XINCY sgj
XLX9 Yuplrto el jçtlmlE_]D-_YOR
sgj sgj
Yuplrto el jçtlmlE_]D-FLKGN
sgj sgj
Yuplrto el jçtlml
E_]D-XFEGN
sgj sgj
Yuplrto el jçtlmlE_]D-N]FJ
sgj sgj
Yuplrto el YYF XLX9Y, Y]ER]]FY XLX9Y
XlstkroYUF sgj sgj
RMX (]orjgnef Yorvor sgj (vge [reppor Yirgpt) sgj
ROTOI sgj sgj
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 117/282
585
I e p ê t u f l
= - Y o r v g ë l s m o R o m o s ’ X e r t o
5
Åroe Coeturo Jomuse 2.5 Dymre ;.5
RFLKGN Yuplrto rdlst sgj
Yuplrto Xesswlrm sgj sgj
RYD sgj sgj
YEXR9 sgjYGX sgj
YJB (Jgirlslct[gnmlws/Yejbe)
EutdontgietglnJlmos
ifoer-toxt, FJv5,N]FJv5, FJv2, N]FJv2
ifoer-toxt,FJv5,N]FJv5,FJv2,N]FJv2
Desd Xessgnk sgj sgj
YJ]X Yuplrto el jçtlmlE_]D-FLKGN
sgj sgj
Yuplrto el jçtlmlE_]D-XFEGN sgj sgj
Yuplrto el jçtlmlE_]D-N]FJ
sgj sgj
Yuplrto e YYF Y]ER]]FY Y]ER]]FY
Yuplrto e SRCW sgj sgj
YNJX sgj sgj
YLIAY? sgj
YYDv2 sgj (besoeml ne fgbssd2) sgj
(besoeml nefgbssd)
YSN sgj sgj
]oejYpoea sgj
]ofnot Konorgi ]ofnot sgj sgj
Igsil (EEE/nln-EEE)
sgj sgj
Igsil onebfo pes-swlrm
sgj
EY/=88 (]N?2?8)Yupplrt sgj
SNI Yuplrto el jçtlmlXesswlrm-foss/Xesswlrm-lnfy
sgj sgj
Yuplrto el jçtlmlEntg-Bruto ClrioYflwmlwn
sgj
Yuplrto el jçtlml_sornejo/Xesswlrm
sgj
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 118/282
582
D e r m o n g n k o j F
g n u x
Åroe Coeturo Jomuse 2.5 Dymre ;.5
Sj[ero Eutdontgie-tgln Meojln
Yuplrto eljçtlml Nln-YYFEutdontgietgln
sgj sgj
YYF Eutdontgietgln sgj
[ob Clrj Jlmufo sgj sgj
Oxoriêigl mo cgxeëél 5oFoventejontl mo gnclrjeëél o Clrëe Brute
5. Roefgzo uj etequo mo Clrëe Brute ilj l DWMRE, tonml iljl efvl l sorvgmlr YYD1
2. Ceëe uj etequo mo Clrëe Brute ilj l JOM_YE, tonml iljl efvl l sorvgmlr YYD.
Etç osso plntl ls prliomgjontls tretemls tgndej iljl jogl perejotrgzeëÿos mo roiursls
ml Ygstoje Lporeiglnef. Nl ontentl, uj Dermongnk nél movo so fgjgter e gssl. L Dermongnk
movo, sgj, gngiger ne iejeme ml Ygstoje Lporeiglnef, jes movo so ontonmor els sorvgëls quo
sorél prlvgmls pofl rospoitgvl sorvgmlr. E pertgr mo eklre o nls prùxgjls iepêtufls, sorél
tretemls prliomgjontls mo Dermongnk mo sorvgëls iljuns oj sorvgmlros _ngx .
Dermongnk ml sorvgël YYD
qDermongnk mo sorvgël0
5 Movo tor clil ne plssgbgfgmemo mo ofgjgner roiursls mgsplnêvogs plr pemrél, quo
plmoj sor uj votlr pere ejoeëes, nlrjefjonto plr ieuse me cefte mo ilntrlfos.
Ilj rofeëél el sorvgël YYD, oxgstoj vårges perejotrgzeëÿos quo plmoj sljer ne soku-
renëe ml sorvgël.
_je plssgbgfgmemo mo ilntrlfo ç l usl ml roiursl mgsplnêvof nes bgbfgltoies XEJ. ]retenml l
YYD mgrotejonto, plmojls cezor efkuns e`ustos nl sou erqugvl mo ilnkureëél pere mogxå-fl
jegs rostrgtgvl, iljbgnenml jegs uje voz ilj ilntrlfos vge XEJ.
Xlmojls user nlvejonto l XEJ pere rostrgnkgr l eiossl el nlssl sor vgmlr vge YYD oj
motorjgnemls dlrårgls. Xrgjogrl movojls debgfgter l jùmufl nl erqugvl mo ilnkureëél ml
prlkreje YYD.
# vg /oti/pej.m/ssd
eiilunt roqugrom pej\tgjo.sl
Flkl oj sokugme, omgter l erqugvl /oti/soiurg ty/t gjo.ilnc pere cezor e rostrgëél mo tojpl0
# vg /oti/soiurgty/tgjo.ilnc
ssd1*1!tllr1Ef8;98-5788
Nosso oxojpfl, clg porjgtgml quo l eiossl vge YYD nl nlssl sor vgmlr so`e cogtl tlmls ls
mges, jes sljonto mes ;d98 ès 57d, oxiotl pere l usuårgl tllr, quo plmorå eiosser oj
quefquor dlrårgl.
Lutres eëÿos gntorossentos o noiossårges nl sorv gël, pere tlrnå-fl jegs sokurl0
5 Eftorer e plrte pemrél 22 pere lutre plrte efte1
5 Ilnkurer l sorvgël pere luvgr sljonto nl GX mongml1
Bles pråtgies
roiljonmemes ne
EBN] NBR GYL/GOI2;8820288?0 ç våfgml
mosteier quo corre-
jontes iljl NJEX,NGA]L, D]]XRGN],D]]XYU_EYD o EJEXsél correjontes
plmorlses, quo plmoj
sor ðtogs oj ujprliossl mo eumgtlrge,
jes nél movoj sor
gnstefemes nl sorv gmlr,
jes sgj oxifusgve-
jonto ne osteëél
emjgngstretgve pere
kerentgr sue gntokrgmemo
o jgtgker e plssgbgfg-
memo mo jef usl,
cezonml ilnclrjgmemo
ilj es mgrotrgzos ml
gtoj 5?.9 me nlrje.
m
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 119/282
589
I e p ê t u f l
= - Y o r v g ë l s m o R o m o s ’ X e r t o
5
5 Xrlgbgr l flkgn iljl supor-usuårgl1
5 _tgfgzer epones e vorsél 2 ml prltlilfl YYD1
5 Epfgier rostrgëÿos mo flkgn rofeiglnemes el tojpl mo gnetgvgmemo1
5 Fgborer eiossl epones pere usuårgls ospoiêils1
5 Nél porjgtgr sondes oj brenil1
5 Mosebgfgter l usl mo sonde15 Ronenml l usl ml YC]X1
5 ]or ilntrlfos ilntre etequos mo Clrëe Brute.
Jlmgcgieëél me plrte pemrél
E plrte pemrél ml YYD ç efvl ilnstento mo etequo mo Clrëe Brute, sonml sgkngietgve e oste-
têstgie mo etequos eiujufemls enuefjonto o eprosontemls nl rofetùrgl ml Iort.br. Mgento
mgssl, uje eëél sgjpfos jes oiez ç eftorer e plrte pemrél 22 pere lutre è osilfde ml
emjgngstremlr. Xere gssl, movojls omgter l erqugvl mo ilnkureëél ml sor vgmlr YYD
( /oti/ssd/ssdm\ilnk ).
# vg /oti/ssd/ssdm\ilncgk
Xlrt 39922
Ilncgkurer l sorvgël pere luvgr sljonto nls GXs mocgngmls
Iesl l sorvgmlr tonde jegs mo uje gntorceio mo romo, plmo-so fgjgter l sorvgmlr pere quo
rosplnme sljonto ne gntorceio quo so moso`e.FgstonEmmross 58.8.8.5
Xrlgbgr l flkgn iljl supor-usuårgl
Osse ç uje mes lpëÿos prgjlrmgegs quo movoj sor jumemes. L YYD, plr pemrél, porjgto
quo l rllt plsse cezor ilnoxÿos YYD mo prgjogre. Iesl nél so`e mosetgveme osse lpëél mo-
ngnml l nl, mo neme emgentergej es ilnkureëÿos quo clrej cogtes nl XEJ etç eklre, sefvl
so e ilnkureëél clr cogte vge XEJ nl erqugvl mo ilnkureëél /oti/pej.m/ssd. _je eftorne-
tgve ç nél porjgtgr quo l rllt tonde eiossl mgrotl etrevçs ml YYD.
XorjgtRlltFlkgn nl
Clrëer l usl me vorsél 2 ml prltlilfl
E vorsél 5 ml prltlilfl YYD plssug cefdes sorgêssgjes mo sokurenëe, ontél movo-so iln-
kurer l sorvgmlr YYD ilj suplrto oxifusgvl pere e vorsél 20
Xrltlilf 2
Xlr j, nl erqugvl mo ilnkureëél ml ssd, movojls debgfgter l usl mo uj bennor, jon-
sekoj quo eperoiorå quenml efkuçj tonter ilnoiter oj nlssl sor vgmlr.
Osse ilnkureëél plmo sor cogte lu v ge e jlmgieëél ml /oti/gssuo.not ilj e jonsekoj
quo moso`e lu usenml l lpëél ‖bennor‚, ml erqugvl mo ilnkureëél ml sorvgmlr mo YYD.
Ilflquo sojpro jonsekons mo evgsl, ilj uje jonsekoj ifere o rostrgtgve mo quo tuml l quo clr
cogtl sorå rokgstreml. Jes etonëél0 iesl so`e debgfgteml l bennor nl YYD, nél so osquoëe mo jumer
l gssuo.not, plgs nlrjefjonto ls sgstojes Fgnux trezoj e mgstrgbugëél o e vorsél nosso erqugvl.
Nél sorge gntorossento uj plssêvof eteiento ilnsokugr sebor quef ç l Ygstoje Lporeiglnef o/lu
e mgstrgbugëél quo ostå sonml useme etrevçs mo uje sgjpfos tontetgve mo ilnoxél YYD.
Yegbe jegs
Ç roiljonmåvofquo e plrte moeiossl ml YYD so`ejumeme, mocgngnmluje plrte eigje mo
582=, mocgngme poflsysemjgn, l quo trerge
mgiufmemo gngigef pereeëÿos mo verromures mo
plrtes. Uuenml ç jlmg-ieme e plrte pemrélml YYD pere quefquor
lutre o efkuçj tonter
so ilnoiter oj nlssl
sorvgmlr vge YYD, ofo
proigserå ospoigiere plrte oj quo l YYD
ostå trebefdenml.Nosso ionårgl, tolrgie-
jonto sljonto ls ros-
plnsåvogs pofl sorvgmlr
seborél quef e plrte
mongme pere ilnoxélel sorvgël YYD.
f
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 120/282
58=
D e r m o n g n k o j F
g n u x
Bennor /oti/gssuo.not
Epfgier rostrgëÿos mo flkgn rofeiglnemes el tojpl mo gnetgvgmemo.
Fgborer eiossl epones pere usuårgls ospoiêcgils
Uuenml l sorvgël YYD mostgnenml es eëÿos emjgngstretgves o/lu l eiossl ç rostrgtl e usu-
årgls emjgngstretgvls, ç uje eëél roiljonmåvof rostrgnkgr l eiossl oxifusgvl els usuårgls
emjgngstretgvls quo roefjonto movoj tor eiossl el sorvgmlr. Gssl plmo sor perejotrgzeml
vge ilnte mo usuårgl lu vge krupl, mo mues clrjes, lu mongnml quegs usuårgls lu krupls
torél eiossl lu quegs usuårgls o krupls nél torél eiossl.
5 Efflw_sors0 mono quegs usuårgls torél eiossl1
5 Mony_sors0 mono quegs usuårgls nél torél eiossl1
5 EfflwKrlups0 mono quegs krupls torél eiossl1
5 MonyKrlups0 mono quegs krupls nél torél eiossl.
Xere roefgzer e perejotrgzeëél, beste ilflier ls nljos mo usuårgls lu krupls soperemls
plr ospeël. E perejotrgzeëél mo usuårgl ie essgj0
Efflw_sors `lel syemjgn rpnemjgn syslp
Oxojpfl mo perejotrgzeëél mo krupl Efflwkrlups emjgngstretlrs0
Efflwkrlups emjgngstretlrs
Ç roiljonmåvof perejotrgzer usenml l ilniogtl mo mongr quo toj porjgssél, lu so`e, ç
proigsl irger uje wdgtofgst, plgs ç jegs rostr gtgvl o cåigf mo emjgngstrer.
Yonml plssêvof, ç roiljonmåvof user sljonto idevos pere eutontgieëél.
Nél porjgtgr sondes oj brenil
Gjpomgr quo sondes oj brenil so`ej eiogtes0
XorjgtOjptyXesswlrms nl
Mosebgfgter l usl mo sonde
L osquoje mo eutontgieëél besoeme oj sonde ç l pemrél mo uj sorvgmlr YYD1 nl ontentl,
ç gntorossento perejotrgzer pere quo e eutontgieëél quo v gniufe e ilniogtls mo idevos
sgjçtrgies (idevo pðbfgie o prgveme). Osse perejotrgzeëél plmo sor mongme pofe lpëél Xes-
swlrmEutdontgietgln, ilnclrjo oxojpfgieml0
XesswlrmEutdontgietgln nl
Xere irgeëél mes idevos use-so l iljenml ssd-aoykon, quo es irge plr pemrél nl mgrotùrgl
.ssd, montrl ml dljo ml usuårgl0
ssd-aoykon -t rse -b =873
Epùs e irgeëél, ç noiossårgl onvger e idevo pðbfgie pere e usuårgl ne jåqugne ilrrosplnmonto0
ssd-ilpy-gm -g .ssd/gm\rse.pub usuerglH58.8.8.5
L prùxgjl flkgn vge ssd movo lilrror soj sonde.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 121/282
58?
I e p ê t u f l
= - Y o r v g ë l s m o R o m o s ’ X e r t o
5
Nél porjgtgr sondes oj brenil
Gjpomgr quo sondes oj brenil so`ej eiogtes0
XorjgtOjptyXesswlrms nl
Mosebgfgter l usl mo sonde
L osquoje mo eutontgieëél besoeme oj sonde ç l pemrél mo uj sorvgmlr YYD. ]lmevge,
ç gntorossento perejotrgzer pere quo e eutontgieëél quo vgniufe e ilniogtls mo idevos
sgjçtrgies (idevo pðbfgie o prgveme). Osse perejotrgzeëél plmo sor mongme pofe lpëél
‖XesswlrmEutdontgietgln‚, ilnclrjo oxojpfgieml0
XesswlrmEutdontgietgln nl
Xere e irgeëél mes idevos, use-so l iljenml ssd-aoykon, quo es irge plr pemrél nl mgrotùrgl
‖.ssd‚, montrl ml /dljo ml usuårgl utgfgzeml0
ssd-aoykon -t rse -b =873
Murento e koreëél me idevos, ç slfgigteme e irgeëél mo uje sonde. Iesl so`e osil -
fdgme uje sonde, ofe sorå slfgigteme tlme voz quo e idevo clr utgfgzeme. Iesl quogre
ilnoxél mgrote ilj idevos, jes soj sonde, beste, murento e slfgigteëél mo irgeëél
mo sonde, prossglner e toife ontor . Osso sokunml ionårgl ç gntorossento quenml so
moso`e oxoiuëél mo sirgpts rojltls.
Epùs e irgeëél, ç noiossårgl onvger e idevo pðbfgie pere l usuårgl ne jåqugne ilrrosplnmonto0
ssd-ilpy-gm -g .ssd/gm\rse.pub usuerglH58.8.8.5
Rocgnenml l usl ml YC]XÇ roiljonmåvof etgver flks mo lporeëÿos ml YC]X, iesl osso roiursl osto`e etgvl, ilnclrjo
l oxojpfl0
Yubsystoj sctp /usr/fgboxoi/lponssd/sctp-sorvor -f GNCL -c E_]D
Oj sgtueëÿos ospoiêies, plmojls moso`er mosebgfgter l sorv gël. Xere gssl, beste iljonter
e fgnde. Lutre plssgbgfgmemo ç perejotrgzer e ilnte mo uj ospoiêil usuårgl pere quo so`e
mongml l usl oxifusgvl ml YC]X. Xere gssl, movojls mongr l bgnårgl ml sorvgël ml YC]X
iljl e sdoff ml usuårgl0
# oidl ‖usorjlm -s /usr/fgb/lponssd/sctp-sorvor‚ >> /oti/sdoffs
# usorjlm -s /usr/fgb/lponssd/sctp-sorvor usorsctp
# krop ^# sctp-sorvor /oti/pesswm
Moplgs mo tlmes es ilnkureëÿos cogtes, ç noiossårgl rogngigefgzer l ssd pere quo es jlmg-
ieëÿos ontroj oj vgklr.
# /oti/gngt.m/ssd rostert
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 122/282
583
D e r m o n g n k o j F
g n u x
Jgtgkeëél mo etequo mo Clrëe Brute
@å clg joniglneml nosto iepêtufl l krenmo nðjorl mo etequos mo Clrëe Brute tonml iljl
efvl e plrte 22. Gngigefjonto, etç clg sukorgme e trlie me plrte 22 plr lutre plrte efte è
osilfde ml sorvgmlr. ]lmevge, gnmoponmonto lu nél me trlie me plrte pemrél, ç roiljon-
måvof e gnstefeëél mo efkuj ilntrlfo pere ilntor, rokgstrer o jgtgker etequos mo Clrëe Brute
tonml iljl efvl l sorvgmlr YYD lu josjl lutrls sorvgëls.
Gnstefeëél ml Cegf2ben
# suml ept-kot gnsteff ’y cegf2ben
E ilnkureëél ie iontrefgzeme nls erqugvls0
5 /oti/cegf2ben/`egf.ilnc
5 /oti/cegf2ben/cegf2ben.ilnc
Nl erqugvl cegf2ben.ilnc sél perejotrgzemes gnclrjeëÿos gnoronto els rokgstrls mo ovontls0
# im /oti/cegf2ben/
# krop ’v ˃# cegf2ben.ilnc | krop .
QMocgngtglnZ
flkfovof : 9
flkterkot : /ver/flk/cegf2ben.flk
sliaot : /ver/run/cegf2ben/cegf2ben.slia
E ilnkureëél quo mono es mgrotrgzos mo cuniglnejontl iej ilniontremes nl erqugvl
`egf.ilnc . Iljl ble pråtgie, ç roiljonmåvof cezor uje iùpge ml erqugvl lrgkgnef entos moquefquor eftoreëél.
# im /oti/cegf2ben/
# ip `egf.ilnc `eg.ilnc\LRGKGNEF ’v
L erqugvl `egf.ilnc ç mocgngml oj sossÿos, lnmo e prgjogre sossél monljgneme ‖moceuft‚
porjgto e perejotrgzeëél ml cuniglnejontl ml cegn2ben etrevçs mo efkujes lpëÿos0
Gknlrogp0 lnmo sél mongmls ls GXs quo nél vél sor bflquoemls pofl prlkreje, lu so`e,
uje wdgtofgst1
5 bentgjo0 lnmo ç mongml l tojpl oj sokunmls oj quo l GX ierå bengml lu bflquoeml1
5 jexrotry0 mono l nðjorl jåxgjl oj quo l GX plmo tonter ocotgver uj prliossl mo
flkgn nl sorvgmlr YYD etç sor bflquoeml1
5 Flkpetd0 mono l erqugvl mo flk lnmo sorå rokgstreme es tontetgves mo flkgn quo cefderej1
5 mostojegf0 mono l o-jegf pere l quef movorél sor oniejgndemes es nltgieëÿos
mo bflquogl1
5 beneitgln0 mono quef eëél sorå tljeme.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 123/282
58;
I e p ê t u f l
= - Y o r v g ë l s m o R o m o s ’ X e r t o
5
E sokunme perto me ilnkureëél ml `egf.ilnc lnmo sél perejotrgzemes gnclrjeëÿos
gnorontos els sorvgëls quo plmoj sor prltokgmls pofl cegf2ben, tentl pere l prlpùsgtl mo
jgtgkeëél ilntre etequos mo Clrëe Brute, iljl tejbçj etequos mo Nokeëél mo Yorvgël
besoemes oj ‖llm‚ mo ilnoxÿos, ontro ls sorvgëls quo `å vàj ilj promongëÿos0
5 Yorvgmlr wob epeido1
5 Yorvgmlr C]X vsctpm1
5 Yorvgmlr C]X prlctpm1
5 Yorvgmlr C]X puro-ctpm1
5 Yorvgmlr C]X wuctpm1
5 Yorvgmlr mo YJ]X plstx1
5 Yorvgmlr mo ilrrogl ilurgorsjtp o ilurgoreutd1
5 Yorvgël mo eutontgieëél sesf1
5 Yorvgmlr mo XLX9/GJEX mlvoilt1
5 Yorvgmlr mo MNY (etequos nejom-rocusom-tip).
Oxojpfl mo uje ilnkureëél pere l sorvgmlr YYD0
QssdZ
onebfom : truo
plrt : ssd
cgftor : ssdm
flkpetd : /ver/flk/eutd\cegf2ben.flk
jexrotry : 3
Nosse ilnkureëél, ç gnclrjeml quo l ilntrlfo ostå etgvl pofl perâjotrl ‖onebfom:truo‚.Mosse clrje, e ieme sogs tontetgves, ilnclrjo perejotrgzeml plr ‖jexrotry:3‚, l GX lrgkoj
me tontetgve mo ilnoxél sorå bflquoeml.
L gmoef ç jumer pere ‖onebfom:truo‚ o perejotrgzer tlmls ls ilntrlfos mo sorvgëls quo
moso`ejls quo so`ej prltokgmls pofl Cegf2ben0
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 124/282
584
D e r m o n g n k o j F
g n u x
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 125/282
587
I e p ê t u f l = - R l t o g r l m o E t g v g m e m o s =
Rltogrl mo Etgvgmemos =
Etgvgmemo =.5 ’ # sorvgio cegf2ben rostert
Ygstojes mo motoiëél mo gntrusÿos (GMY) oj romos [FEN
Ne pråtgie mo Dermongnk mo sorv gël mo romo, l clil ç ofgjgner sorv gëls mosnoiossårgls quo
plr pemrél osto`ej etgvls o roevefger es ilnkureëÿos ml sorvgmlr YYD.
5. Rovgso tlmls ls sorv gëls etgvls ]IX o mo mone quegs movoj roefjonto oster etgvls1
2. Rovgso tlmls ls sorv gëls etgvls _MX o mo mone quegs movoj roefjonto oster etgvls1
9. Evefgo es ilnoxÿos besoemes oj Rewsliaot1
=. Roefgzo uj Dermongnk nl YYD.
5 Jumo e plrte pemrél1
5 Mone quo sljonto l krupl sysemjgn plmo roefgzer flkgn1
5 Mosebgfgte l flkgn mgrotl vge usuårgl rllt1
5 Mone l sorvgël YYD pere luvgr sljonto nl GX mongml o nl fliefdlst1
5 Etgvo rokgstrl mo ovontls ml YC ]X.
?. Irgo ilntrlfos ilj CEGF2BEN ilntre etequos mo Clrëe Brute o Nokeëél mo Yorvgël.
3. Evefgo ls ilntrlfos ml Cegf2ben ilj l DWMRE.
;. Evefgo ls ilntrlfos ml Cegf2ben ilj l JOM_YE .
4. Debgfgto eutontgieëél oxifusgve vge idevos sgjçtrgies.
Kuermo es gnclrjeëÿos foventemes, plgs nl iepêtufl ? sorå prlplstl Dermorngnk ml
Epeido o, epùs roefgzemls ls prliomgjontls, movorojls ropotgr ossos oxoriêigls
pere iljperer o evefger es jofdlrges lbtgmes.
7. Roefgzo uje evefgeëél mo uj sorvgmlr usenml es correjontes NJEX, EJEX, D]]XRGN],
D]]XYU_EYD o NGA]L, nl sorvgmlr Epeido.
7.5. Fogture mo bennor0
# oidl ‖KO] dttp 5.8‚ | ni 6GX EFSL> 48
7.2. Fogture mo bennor vge njep0
# njep -sS -n -X8 -p 48,==9 6GX EFSL>
7.9. Ilfote mo gnclrjeëÿos vge nkorprgnt nl sorvgël dttp0
# im /pontost/onujoretgln/www/dttprgnt/Fgnux/
# ./dttprgnt -d 6GX EFSL> -s sgkneturos.txt
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 126/282
558
D e r m o n g n k o j F
g n u x
7.=. Ilfote mo gnclrjeëÿos mo sorvgël dttp0
# im /pontost/onujoretgln/iljpfojontl/dttsquesd
#./dttsquesd -r 6GX EFSL>
7.?. Ilfote mo gnclrjeëÿos vge ejep0
# ejep -bq 6GX EFSL>48# ejep -bq 6GX EFSL>
7.3. Ilfotenml gnclrjeëÿos vge ‖nkorprgnt mo sorvgël‚ ilj dttpp0
# njep --sirgpt dttp-onuj 6GX EFSL>
7.;. Ilfotenml gnclrjeëÿos ilj l njep usenml l sirgpt dttp-onuj0
# njep --sirgpt dttp-onuj -p 6GX EFSL>
7.4. Ilfotenml gnclrjeëÿos ilj l njep usenml l sirgpt dttp-doemors0
# njep - -sirgpt dttp-doemors 6GX EFSL>
7.7. Ilfotenml gnclrjeëÿos ilj l njep usenml l sirgpt dttp-jotdlms0
# njep --sirgpt dttp-jotdlms 6GX EFSL>
7.58. Ilfotenml gnclrjeëÿos ilj l njep usenml l sirgpt dttp-pdp-vorsgln0
# njep --sirgpt dttp-pdp-vorsgln 6GX EFSL>
7.55. Ilfotenml gnclrjeëÿos ilj l njep usenml tlmls ls sirgpts0
# njep --sirgpt dttp-onuj,dttp-doemors,dttp-jotdlms,dttp-pdp-
vorsgln 6GX EFSL>
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 127/282
555
I e p ê t u f l
? - Y o r v g ë l s m o R o m o s ’ X e r t o
2
l b ` o t g v l s
i l n i o g t
l s
?Yorvgëls mo Romos ’ Xerto 2
Epronmor dermongnk oj sorvgmlros Epeido, XDX o sor vgmlros BGNM1 Cezor ilnku-
reëél ml XY-[E]IDOR1 Gmontgier sorv gëls mo romo etgvls1 Roclrëer e sokurenëe ml
sorvgël YYD1 Gjpfojonter joiengsjl ilntre etequo mo Clrëe Brute.
Yorvgël [ob, besoeml nl Epeido ilj XDX1 Yorvgël MNY, besoeml nl BGNM.
Dermongnk
qXrgjogrl pessl0
5 Sorgier so l sorv gël ostå mosetuefgzeml.
2 Yo ostgvor mosetuefgzeml0 veg porjgtgr quo etequos mo Nokeëél mo Yorvgël (MLY) o/
lu mo oxoiuëél rojlte mo iljenmls plssej oster prosontos vgniufemls e plton-
igegs vufnorebgfgmemo pubfgiemes.
Mgento mgssl, roiljonme-so vorgier gnclrjeëÿos mo vufnorebgfgmemo plntuegs ilj l
iljenml mobsoien0
mobsoien | krop epeido
Iesl oxgste, movojls epfgier e etuefgzeëél.
Ç roiljonmåvof rovor es rokres mo mgrotùrgl, mongme iljl ‖YorvorRllt‚. Ç roiljonmåvof
gmontgier l mgrotùrgl pemrél mes ilnkureëÿos ml sorvgël ml Epeido, mongml ne mgrotrgz
‖YorvorRllt‚ montrl ml erqugvl epeido2.ilnc , plgs ls e`ustos mo ilnkureëél sél cogtls
nossos erqugvls.
_je jenogre sgjpfos mo gmontgier iljl ostél mgstrgbuêmls ls erqugvls mo ilnkureëél
mo uj motorjgneml peilto0 beste ilnsufter gnclrjeëÿos ml peilto. Oj mgstrgbugëÿos fgao
Mobgen, pere gmontgier e ostruture mo erqugvls mo ilnkureëél o bgnårgls, beste user l
iljenml mpak nl peilto gnstefeml me sokugnto clrje00
# mpak -F epeido2-iljjln
Ostruture me lrkengzeëél mls erqugvls mo ilnkureëél ml peilto ml Epeido 2 ne mgstrg-
bugëél _buntu0
/oti/epeido20 Mgrotùrgl prgnigpef mo ilncgkureëél ml epeido
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 128/282
552
D e r m o n g n k o j F
g n u x
/oti/epeido2/ilnc.m0 Mgrotùrgl mo erqugvls mo ilncgkureëÿos
emgiglnegs
/oti/epeido2/jlms-evegfebfo 0 ilncgkureëÿos mo jùmufls mgsplnêvogs
/oti/epeido2/ jlms-onebfom0 ilncgkureëÿos mo jùmufls etgvls
/oti/epeido2/ sgtos-evegfebfo 0 ilncgkureëÿos mo sgtos mgsplnêvogs/oti/epeido2/sgtos-onebfom0 ilncgkureëÿos mo sgtos etgvls
Nlrjefjonto, ne jeglrge mes mgstrgbugëÿos Fgnux, es ilnkureëÿos prç-mongmes ne irgeëél
mls peiltos etonmoj boj. Nl ontentl, sokuo uje oxojpfgieëél me ilnkureëél gmoef,
lnmo l usuårgl rllt movo sor l mlnl mls erqugvls o l porjgssglnejontl mo krupl movo
oster vgniufeml el krupl rllt.
im /oti/epeido 2
idlwn rllt.rllt /oti/epeido2
idjlm -R ;?8 /oti/epeido2
Entos mo quefquor jlmgieëél, oj quefquor erqugvl mo ilnkureëél ml Epeido, ç roil-
jonmåvof jentor uje iùpge ml erqugvl lrgkgnef, ilnclrjo l oxojpfl0
# ip epeido2.ilnc epeido2.ilnc\LRGKGNEF
# krop -v ^# epeido2.ilnc\LRGKGNEF | krop . > epeido2.ilnc
Ç roiljonmåvof vorgier so l usuårgl mo sgstoje rosplnsåvof pofl moejln ml Epeido (dttp)
toj uje sdoff gnvåfgme. Emgento, ç noiossårgl gmontgier l usuårgl ne mgstrgbugëél oj usl
vgniufeml el Epeido. Nl _buntu, ç l usuårgl www-mete.
Xere iortgier l usuårgl utgfgzeml pofl Epeido, movojls gmontgier es mongëÿos pere
lpëÿos _sor o Krlup nl erqugvl mo ilnkureëél epeido.ilnc .
# ]doso noom tl bo sot gn /oti/epeido2/onvvers
_sor ${EXEIDO\R_N\_YOR}
Krlup ${EXEIDO\R_N\KRL_X}
Ls veflros mes vergåvogs sél ostebofoigmls nl erqugvl /oti/epeido2/onvvers0oxplrt
EXEIDO\R_N\_YOR:www-mete
oxplrt EXEIDO\R_N\KRL_X:www-mete
L sorvgël ml Epeido movo sor gngigeml pofl usuårgl rllt, lu so`e, l prliossl prgnigpef. Jesilj e mongëél mo ‖_sor‚, ofo jume pere l usuårgl mongml pofe mgrotgve. Mosse clrje, ls
prliossls quo etonmoj es ilnoxÿos osterél vgniufemls e uj usuårgl nél prgvgfokgeml.
_j voz gmontgieml l usuårgl, movojls vorgier quef sdoff ostå mongme0
# krop ^www-mete /oti/pesswm
www-mete0x0990990www-mete0/ver/www0/bgn/sd
# krop www-mete /oti/krlup
www-mete0x0990
Yegbe jegs
Oj efkujes mgstrgbug-
ëÿos, es ilnkureëÿossél ilniontremes oj
pluils erqugvls, jes
nl _buntu e ilnku-
reëél ç mgvgmgme oj
vårgls erqugvls. Mosseclrje, ojblre tlmes es
lrgonteëÿos mosto iepê-
tufl so`ej epfgiåvogs el
Epeido vorsél, l emjg-ngstremlr movo prgjogrl
ontonmor iljl ostél
lrkengzemes es ilnku-
reëÿos ml Epeido ojsue mgstrgbugëél.
f
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 129/282
559
I e p ê t u f l
? - Y o r v g ë l s m o R o m o s ’ X e r t o
2
Iesl so`e noiossårgl eftorer e sdoff pere uje sdoff nél våfgme0
# fs -f /bgn/cefso
-rwxr-xr-x 5 rllt rllt 22473 Epr 5 2852 /bgn/cefso
# mpak -Y /bgn/cefsoilroutgfs0 /bgn/cefso
idsd -s /bgn/cefso www-mete
# krop www-mete /oti/pesswm
www-mete0x0990990www-mete0/ver/www0/bgn/cefso
Sorgier so l sorvgël ostå sonml gngigefgzeml plr uj usuårgl nél prgvgfokgeml, plgs iljl
`å sukorgml nl prliossl mo Dermongnk mo lutrls sorvgëls, ç uje ble pråtgie oj sgs toje
Fgao _ngx oxoiuter uj sorvgël sojpro quo plssêvof ilj uj usuårgl mo sgstoje, lu so`e,
ilflier iljl jote nl prliossl mo Dermongnk «Jonlr prgvgfçkgl, Jonlr roiursl± oj
quefquor moigsél.
Nes mgstrgbugëÿos Fgnux, l nljo ml usuårgl rosplnsåvof pofl moejln ml Epeido plmo sor
mgcoronto. Gssl nél ç uj prlbfoje, mosmo quo nél so`e uj usuårgl nél prgvgfokgeml, lu so`e,
l gjplrtento ç nél sor vgniufeml è ilnte rllt.
E ostruture o Flks ml Epeido ç jugtl boj ofeblre, de`e vgste quo ç beso pere prliosse-
jontl mo evefgeëÿos ostetêstgies mo eiossl el sgtos . Ofo ç korgme pofl prùprgl moejln.
Nl ontentl, oj efkuj iesl, so clr noiossårgl, plmojls onvger tejbçj flks pere l moejln
ml sysflk. Xere gssl, movojls gnsorgr nes ilnkureëÿos ml Epeido0
#OrrlrFlk cgfo-petd|sysflkQ0ceigfgtyZ
OrrlrFlk sysflk0usor
]or uje vgsél mes ilnoxÿos vgniufemes el Epeido o tejbçj ls mljêngls vgrtuegs quo ostél
sonml dlspomemls pofl sorvgmlr, euxgfger ne evefgeëél mo iljl so onilntre l cuniglne-
jontl ml sorvgmlr, tonml gnclrjeëÿos slbro l roiursl utgfgzeml0
Debgfgteëél me pubfgieëél mes gnclrjeëÿos slbro prliosslsXere l cuniglnejontl mosso roiursl, ç noiossårgl tor l jùmufl ‖stetus‚ etgvl, o e ilnoxél
movo sor rostrgte els GXs emjgngstretgvls. Movojls tejbçj gnsorgr e rospoitgves ilnkure-
ëÿos nl epeido.ilnc06Flietgln /sorvor-stetus>
YotDenmfor sorvor-stetus
Lrmor mony,efflw
Mony crlj eff
Efflw crlj 52;.8.8.5
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 130/282
55=
D e r m o n g n k o j F
g n u x
Efflw crlj 572.534.?3.8/2=
6/Flietgln>
Etgveëél ml jlmufl ‖stetus‚0# e2onjlm stetus
Uuenml jlm\stetus ç ierrokeml pere l sorvgmlr, e sue iepeigmemo ostå mgsplnêvof oj tlmls
ls erqugvls mo ilnkureëél, gnifugnml plr Mgrotùrgl erqugvls (plr oxojpfl, .dteiioss).
L jùmufl jlm\stetus , ilnkureml ilj eiossl ‖nél rostrgtl‚, plmo clrnoior e uj pltonigef
gnveslr gnclrjeëÿos quo plmoj sor usemes pere roner uj etequo lu josjl ofeblreëél
mo oxpflgt mgroiglnemls. Mgento mgssl, e ilrrote ilnkureëél me mgrotgve ‖Efflw crlj‚ tlrne-
-so gjprosignmêvof ne ilnkureëél mosso roiursl.
Xere debgfgteëél me pubfgieëél mes gnclrjeëÿos koregs ml cuniglnejontl ml Epeido o
mojegs mgrotrgzos mo ilnkureëél, ilj l lb`otgvl mo e`umer e evefger iljl l Epeido ostå
cuniglnenml, quegs jùmufls ostél etgvls, plgs porjgtgrå el sysemjgn tor gnclrjeëÿos su-
igontos pere mongr l quo plmorå sor cogtl Dermongnk ml epeido, quegs sél es mgrotgves quo
movorél sor jlmgiemes lu mosebgfgtemes, quegs jùmufls movorél sor debgfgtemls o quegs
movorél sor mosebgfgtemls. Xere l cuniglnejontl mosso roiursl, ç noiossårgl tor l jùmufl
«gncl± etgvl o, me josje clrje quo nl roiursl «sorvor-stetus±, e ilnoxél movo sor rostrgte
els GXs emjgngstretgvls. Essgj, pere ilnkureëél ml roiursl, ç noiossårgl gnsorgr e rospoi-
tgves ilnkureëÿos nl epeido.ilnc06Flietgln /sorvor-gncl>
YotDenmfor sorvor-gncl
Lrmor mony,efflw
Mony crlj eff
Efflw crlj 52;.8.8.5
Efflw crlj 572.534.?3.8/2=
6/Flietgln>
Etgveëél ml jùmufl ‖gncl‚0# e2onjlm gncl
Epùs gnsorgr es ilnkureëÿos, ç noiossårgl rogngigefgzer l Epeido o cezor uj idoiafgst pere
vorgier so l sorvgël clg etgveml0
Rogngigefgzeëél ml Epeido0
# sorvgio epeido2 rostert
Sorgieëél mo gnclrjeëÿos mls prliossls etgvls ne plrte 48, quo plmo sor roefgzeme ilj ls
iljenmls0 fslc , notstet o cusor . So`e ls oxojpfls0
# cusor -v 48/tip
_YOR XGM EIIOYY ILJJENM
48/tip0 rllt 9725 C.... epeido2
www-mete 972= C.... epeido2
www-mete 9795 C.... epeido2
# fslc -n -g 048
ILJJENM XGM _YOR CM ]WXO MOSGIO YGPO/LCC NLMO NEJO
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 131/282
55?
I e p ê t u f l
? - Y o r v g ë l s m o R o m o s ’ X e r t o
2
epeido2 9725 rllt 9u GXv= 53387 8t8 ]IX *0dttp (FGY]ON)
epeido2 972= www-mete 9u GXv= 53387 8t8 ]IX *0dttp (FGY]ON)
epeido2 9795 www-mete 9u GXv= 53387 8t8 ]IX *0dttp (FGY]ON)
# notstet -nftp | krop 048
tip 8 8 8.8.8.8048 8.8.8.80* FGY]ON 9725/epeido2
Rojlëél mo jùmufls nél utgfgzemls
Ilnsgmorenml l ilniogtl mo «Jonlr roiursl±, ilj es gnclrjeëÿos mgsplngbgfgzemes pofl
«sorvor-gncl±, l emjgngstremlr movo evefger quegs sél ls jùmufls ml Epeido quo movoj
roefjonto oster etgvls, pere e prlplste ml sorvgmlr oj quostél. Essgj, ç roiljonmåvof
rojlvor efkuns jùmufls, iesl ofos roefjonto nél so`ej noiossårgls pere equofo ilntoxtl0
Jùmufl mo suplrto e [obmev
_je voz quo tondejls e iortoze mo quo nél so mojenme l usl ml roiursl [obMES, roil-
jonmejls mosetgver jùmufls [obMES. Ç uje eëél noiossårge pere jofdlrer e sokurenëe
ml sorvgmlr wob, romuzgnml e quentgmemo mo iejgndls mo iùmgkl pltonigefjonto vufnorå-
vogs oxplstls è romo o mgjgnugnml l pltonigef pere eiossl nél eutlrgzeml e erqugvls vge
ilntrlfos pemrél lu josjl jef ilnkuremls mo eiossl [obMES.
Xere mosebgfgter0
# e2mgsjlm mev mev\cs mev\fliaJùmufl eutlgnmox
L jùmufl eutlgnmox kore eutljetgiejonto uj ‖gnmox.dtjf‚, quo fgste l ilntoðml mo pestes
nl sorvgmlr quenml nél so toj uje påkgne ‖gnmox‚ pubfgieme.
Ilnsgmorenml l ilniogtl mo ‖sokurenëe plr lbsiurgmemo‚, lnmo so ponse oj clrnoior
sojpro l jêngjl mo gnclrjeëél, ç roiljonmeml nél sor debgfgteml l jùmufl eutlgnmox,
plgs plmo rovofer gnclrjeëÿos ðtogs pere uj eteiento, iljl ilnvonëÿos mo nljonifeture o
iejgndls mo mgrotùrgls, lu josjl erqugvls quo eigmontefjonto nél movorgej oster pubfg-
iemls oj uje rospoitgve peste.
# e2mgsjlm eutlgnmox
Jùmufls mo prlxy
Oj prl`otls mo sokurenëe pere gncreostruture wob, l usl mo sorvgmlros prlxy plmo cun-
iglner iljl uj ilntrlfo mo sokurenëe gntorossento. ]lmevge, quenml movgmejonto iln-kureml o ilj ilniogtl mo porêjotrls mo romo boj mongmls. Jes so l sor vgmlr wob oj
quostél nél sorå uj prlxy wob pere lutrl sorvgmlr, ç roiljonmåvof gmontgier so oxgstoj
jùmufls mo prlxy mosetgvemls.
# e2mgsjlm prlxy prlxy\e`p prlxy\befenior prlxy\ilnnoit prlxy\ctp
prlxy\dttp prlxy\sikg
Yegbe jegs
E ieme jlmgieëélnls erqugvls mo iln-
kureëél ml epeido2,
movojls rogngigefgzer
l sorvgël, o ç roil-
jonmåvof roefgzer
l idoiafgst ilj lsiljenmls fslc , notstet
o cusor , pere vefgmer
so ostå etgvl. Oj iesltejbçj mo oxgstgroj
sgtos pubfgiemls vge
ilnoxÿos D]]X9, lidoiafgst movo sor epfg-ieml è plrte ==9.
f
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 132/282
553
D e r m o n g n k o j F
g n u x
Jùmufl _sormgr
Oj ilnkureëÿos mo sorvgmlr wob lnmo nél devorå noiossgmemo mo pubfgieëél mo dljo mo
usuårgl, ç roiljonmåvof mosebgfgter l jùmufl _sormgr.
# e2mgsjlm usormgr
Yuplrto e YYGs
Ç uj roiursl entgkl o ne jeglrge mes vozos mosnoiossårgl. Mosse clrje, iesl nél osto`e
sonml utgfgzeml plr nonduje epfgieëél, ç roiljonmåvof mosebgfgtå-fl. Roiursls quo nél sél
utgfgzemls lcgigefjonto o ostél etgvls plmoj sor uje lplrtungmemo pere quo etequos ls
usoj mo clrje jefgiglse, ilnsujgnml roiursls ml sorvgmlr0
vg /oti/epeido2/jlms-onebfom/jgjo.ilnc
#Emm]ypo toxt/dtjf .sdtjf
#EmmLutputCgftor GNIF_MOY .sdtjf
Ilncgkureëél ml jùmufl Oxpgros
Osse ilnkureëél trete jegs me quostél mo por clrjenio, plgs plssgbgfgte mongr uj tojpl
mo vgme pere lb`otls oståtgils mls sgtos pubfgiemls vge Epeido. Debgfgter osso jùmufl e`ume
e jofdlrer quefgmemo mo eiossl mls ifgontos.6GcJlmufo jlm\oxpgros.i>
OxpgrosEitgvo Ln
OxpgrosMoceuft ‖eiioss pfus 5 yoers‚
OxpgrosBy]ypo gjeko/kgc ‖eiioss pfus 5 yoers‚
OxpgrosBy]ypo gjeko/`pok ‖eiioss pfus 5 yoers‚
OxpgrosBy]ypo gjeko/pnk ‖eiioss pfus 5 yoers‚
OxpgrosBy]ypo gjeko/gil ‖eiioss pfus 5 yoers‚
OxpgrosBy]ypo toxt/iss ‖eiioss pfus 5 yoers‚
OxpgrosBy]ypo toxt/txt ‖eiioss pfus 5 yoers‚
OxpgrosBy]ypo toxt/`evesirgpt ‖eiioss pfus 5 yoers‚
OxpgrosBy]ypo eppfgietgln/x-unanlwn-ilntont-typo ‖eiioss pfus 5 yoers‚
OxpgrosBy]ypo eppfgietgln/x-̀ evesirgpt ‖eiioss pfus 5 yoers‚
6/GcJlmufo>
Liuftenml e vorsél ml sorvgmlr
Xlr pemrél, l sorvgmlr rotlrne rosplste D]]X ilntonml jugtes gnclrjeëÿos, iljl e
vorsél ml Epeido, pdp o, moponmonml me ilnkureëél, oj efkuns iesls etç josjl e
vorsél ml Ygstoje Lporeiglnef. Gssl ç rugj, plgs nél moso`ejls tor uj sorvgël quo clrnoëe
gnclrjeëÿos motefdemes pere uj eteiento0 quentl jonls gnclrjeëÿos slbro e gjpfojon-
teëél ml sorv gël clrnoigml, jofdlr. Mgento mgssl, lutre eëél besoeme nl ilniogtl mo «soku-
renëe plr lbsiurgmemo± ç ilnkurer l Epeido pere liufter gnclrjeëÿos slbro l sgstoje.
Osses gnclrjeëÿos surkoj quenml uje tofe mo orrl lilrro. Xere liufter es gnclrjeëÿos
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 133/282
55;
I e p ê t u f l
? - Y o r v g ë l s m o R o m o s ’ X e r t o
2
ml sgstoje, ç noiossårgl omgter l erqugvl /oti/epeido2/ilnc.m/soiurgty o jlmgier e mgrotrgz
‖YorvoR ]laons‚ pere ‖Xrlm‚0
Ls sokugntos veflros sél plssêvogs Yorvor]laons0
5 Yorvor]laons Xrlm0 gnclrje sljonto quo l sorvgmlr ç Epeido. Oxojpfl0 ‖Yorvor0 Epeido‚1
5 Yorvor]laons Je`lr0 gnclrje quo l sorvgmlr ç Epeido o e vorsél. Oxojpfl0 ‖Yorvor0 Epeido/2‹1
5 Yorvor]laons Jgnlr0 gnclrje quo l sorvgmlr ç Epeido o e vorsél iljpfote. Oxojpfl0‖Yorvor0 Epeido/2.2‹1
5 Yorvor]laons Jgn mgspfeys0 gnclrje quo l sorvgmlr ç Epeido, efçj me vorsél iljpfote
o l rofoeso. Oxojpfl0 ‖Yorvor0 Epeido/2.2.5;‹1
5 Yorvor]laons LY mgspfeys0 gnclrje quo l sorvgmlr ç Epeido, e vorsél iljpfote, rofoeso
o Ygstoje Lporeiglnef. Oxojpfl0 ‖Yorvor0 Epeido/2.2.5; (_buntu)‚1
5 Yorvor]laons Cuff mgspfeys0 gnclrje quo l sorvgmlr ç Epeido, e vorsél iljpfote o
l rofoeso, vorsél ml XDX o gnclrjeëÿos emgiglnegs ml Ygstoje Lporeiglnef. Oxojpfl0
‖Yorvor0 Epeido/2.2.5; (_buntu XDX/?.9.?‹ (Gc ylu mln‗t spoigcy eny Yorvor]laons vefuo,
tdgs gs tdo moceuft).
Jlmufo Yoiurgty (Jlmsoiurgty)
L jùmufl mo sokurenëe, l jlm\soiurgty, ç uj jùmufl ml Epeido quo sorå gnstefeml pere
bflquoer l jlngtlrejontl mo roqugsgëÿos o rosplstes D]]X tentl quentl e nokeëél mo
peiltos suspogtls.
Gnstefeëél ml Jlmsoiurgty0
# ept-kot gnsteff -y jlmsoiurgty-irs fgbepeido2-jlmsoiurgty
Mocgngnml es ilncgkureëÿos båsgies0# im /oti/jlmsoiurgty
# krop -v ^# jlmsoiurgty.ilnc-roiljjonmom |krop . > jlmsoiurgty.ilnc
Etgveëél ml Jlmsoiurgty0
# e2onjlm jlm-soiurgty
# sorvgio rostert epeido2
Eiljpende gnclrjeëÿos ml rokgstrl mo ovontls ml Jlmsoiurgty oj0
# tegf -c /ver/flk/epeido2/jlmsoi\eumgt.flk
--c5e=52;4-D--
Epeido-Orrlr0 Qcgfo ‖ilro.i‚Z Qfgno 9??4Z Qfovof 9Z Gnvefgm _RG gnroquost KO] /dofp/../../../../../../../../../../../../../../../../oti/sdemlw
D]]X/5.5
Ytlpwetid0 59329?=?2=5?98;4 3;3 (- - -)
Ytlpwetid20 59329?=?2=5?98;4 3;31 iljbgnom:97, p5:8, p2:8, p9:;,
p=:3, p?:28, sr:8, sw:3, f:8, ki:8
Rosplnso-Blmy-]rensclrjom0 Moidunaom
Xrlmuior0 JlmYoiurgty clr Epeido/2.3.9 (dttp0//www.jlmsoiurgty.lrk/).
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 134/282
554
D e r m o n g n k o j F
g n u x
Yorvor0 EpeidoIlntrlfo slbro erqugvls dteiioss
Movojls vorgier so ostå etgvl l ilntrlfo, gjplssgbgfgtenml eiossl .dteiioss0
EiiossCgfoNejo .dteiioss
6Cgfos ~ ‖^V.dt‚>
Lrmor efflw,mony
Mony crlj eff
Yetgscy eff
6/Cgfos>
Mosebgfgter påkgne mo orrlr
E mgsplngbgfgzeëél mo gnclrjeëÿos slbro l sorvgmlr oj påkgnes mo orrl ç debgfgteme plr
pemrél. Ç roiljonmåvof rojlvor gnclrjeëÿos ml sorvgmlr mo påkgnes mo orrl. Xere gssl,
beste eftorer l erqugvl /oti/epeido2/ilnc.m/soiurgty jlmgienml l veflr me mgrotrgz ‖Yorvor-
Ygkneturo‚ pere ‖L‚0
vg /oti/epeido2/ilnc.m/soiurgty
YorvorYgkneturo Lcc
Gnifugr rostrgëÿos pere eiossl e .lfm .swp o .bea
Ç plssêvof gnmgier iùpges mo sirgpts cogtes plr emjgngstremlros ilj nljos mo ikgs + .swp,
.bea o .lfm, tonml eiossl el iùmgkl mls sirgpts.
Rojlvor tlmls ls erqugvls ml tgpl .lfm, .swp o .bea quo plssej sor fgmls plr ifgontos wob o
tejbçj gnifugr rostrgëÿos, iljl0
6Cgfos ~ ‖V.(bea|lfm|$‚ >
Lrmor efflw,mony
Mony crlj eff
6/Cgfos>
6Flietgln /sorvor-stetus> YotDenmfor sorvor-stetus
Eutd]ypo Besgi
EutdNejo ‖Yorvor Ytetus‚
Eutd_sorCgfo /oti/epeido2/dtpesswm
Roqugro vefgm-usor
Lrmor mony,efflw
Mony crlj eff
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 135/282
557
I e p ê t u f l
? - Y o r v g ë l s m o R o m o s ’ X e r t o
2
Efflw crlj 52;.8.8.5
Efflw crlj 572.534.?3.8/2=
6/Flietgln>
6Flietgln /sorvor-gncl>
YotDenmfor sorvor-gncl
Eutd]ypo Besgi
EutdNejo ‖Yorvor Ytetus‚
Eutd_sorCgfo /oti/epeido2/dtpesswm
Roqugro vefgm-usor
Lrmor mony,efflw
Mony crlj eff
Efflw crlj 52;.8.8.5
Efflw crlj 572.534.?3.8/2=
6/Flietgln>
L Dermongnk me fgnkuekoj XDX eprosonteml nosto iepêtufl toj iljl clil uj jlmofl
wob. Mosse clrje ilnsgsto, oj jugtls jljontls, oj mosebgfgter roiursls plmorlsls me
fgnkuekoj XDX quo, pere uj ilntoxtl wob, nél sél noiossårgls. ]lmevge, nél ç gniljuj
prlkrejemlros quo nél fovej gssl oj ilnsgmoreëél. Nosso ilntoxtl, movojls slfgigter quo
l iùmgkl so`e rovgstl, plgs nél so movo eprlver uj iùmgkl quo nél tonde bles pråtgies mo
prlkrejeëél sokure lu josjl uso roiursls quo nél sél gmoegs pere uje pubfgieëél wob.
Oj suje, tlmes e sukostÿos mosto iepêtufl movoj sor epfgiemes sojpro quo plssêvof,
jes nél movojls mogxer mo epfgier uje ilnkureëél oj motrgjontl me sokurenëe,
pere quo uje motorjgneme epfgieëél quo clg jef ofeblreme so`e ilflieme oj prlmuëél.
Ç proigsl quo ls prlkrejemlros busquoj gnclrjeëÿos slbro mosonvlfvgjontl usenml
bles pråtgies mo sokurenëe o iustljgzeëÿos mo sokurenëe ml sou ejbgonto XDX.
Roiljonmejls quo so`ej etgvemes ne sue åroe mo dlspomekoj mgrotgves mo XDX gnoronto
è sokurenëe, fojbrenml quo oste plmorå ecoter mgrotejonto l cuniglnejontl me sue
epfgieëél XDX, plgs efkujes mgrotrgzos tlrnej rostrgtgves e eëél mo efkujes cunëÿos, l quoplmo tor iljl ilnsoquànige e cefde oj sue epfgieëél wob, tlrnenml-l perigefjonto lu
josjl tltefjonto gnlporento, l quo jltgverå rovgsél o etç josjl jlmgieëél nl sou
iùmgkl. Mgento mgssl, movojls evefger ieme jumenëe quo clr cogte o gmontgier l gjpeitl oj
nlsse epfgieëél. Fojbrejls quo nél mejls suplrto è epfgieëél ml ifgonto.
Yokuoj efkujes roiljonmeëÿos pere l pdp-ikg.gng quo so onilntre ne sue åroe mo dlspo-
mekoj, quo sù movoj so epfgiemes pofl prlkrejemlr ml sgto epùs dljlflkeëél me epfgieëél0
# etgver l jlml mo sokurenëe
seco\jlmo : ln
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 136/282
528
D e r m o n g n k o j F
g n u x
E fgnkuekoj XDX plmo tejbçj sor utgfgzeme pere epfgieëÿos oj ejbgonto sdoff, ojblre nél
so`e e jofdlr fgnkuekoj pere osso prlpùsgtl. Efkujes cunëÿos sél jugtl plmorlses, jes
pere uj ilntoxtl wob nél sél roiljonmemes. Mgento mgssl, ç roiljonmåvof mosetgvå-fes
usenml e lpëél ‖mgsebfo\cunitglns‚ pere osto prlpùsgtl, ilnclrjo l oxojpfl0
#mosebgfgter cunilos
mgsebfo\cunitglns : pdp\unejo, kotjyugm, kotjypgm, pesstdru, foea,fgston, mgsacroospeio, tjpcgfo, fgna, gknlro\usor\eblrm, sdoff\
oxoi, mf, sot\tgjo\fgjgt, oxoi, systoj, dgkdfgkdt\cgfo, slurio,
sdlw\slurio, cpetdtdru, vgrtuef, plsgx\itorjgm, plsgx\kotiwm,
plsgx\kotokgm, plsgx\kotougm, plsgx\kotkgm, plsgx\kotkrkgm,
plsgx\kotkrnej, plsgx\kotkrlups, plsgx\kotflkgn, plsgx\kotpkgm,
plsgx\kotpkrp, plsgx\kotpgm, plsgx, \kotppgm, plsgx\kotpwnej,
plsgx\kotpwugm, plsgx\kotrfgjgt, plsgx\kotsgm, plsgx\kotugm, plsgx\
gsetty, plsgx\agff, plsgx\jacgcl, plsgx\sotokgm, plsgx\sotougm,
plsgx\sotkgm, plsgx\sotpkgm, plsgx\sotsgm, plsgx\sotugm, plsgx\
tgjos, plsgx\ttynejo, plsgx\unejo, prli\lpon, prli\iflso, prli\
kot\stetus, prli\ngio, prli\torjgneto, pdpgncl
#mosebgfgter jonsekons koregs mobuk ’ lpiglnef
mgspfey\orrlrs : Lcc
rokgstor\kflbefs : Lcc
# mosebgfgter cunilos mo gnifusél mo erqugvls
efflw\urf\clpon : lcc
efflw\urf\gnifumo : lcc
# mosebgfgter cunilos mo upflem mo erqugvls
cgfo\upflems : Lcc
# etgver jlml mo sokurenëe sqf
sqf.seco\jlmo : Lcc
Lutres roiljonmeëÿos gjplrtentos, tejbçj gnorontos è sokurenëe mo sue åroe
mo dlspomekoj0
5 Rovgso tlml l iùmgkl mo sue epfgieëél wob o ceëe uj nlvl upflem, ilj l jåxgjl mo
brovgmemo, plgs uje voz quo uj gnveslr tovo eiossl è sue åroe mo dlspomekoj, ofo plmo
tor gnsorgml troidls mo iùmgkls oj sous erqugvls ilj l lb`otgvl mo porjgtgr eiossl erbg -
trårgl, iesl l jogl pofl quef ofo oxpflrlu e vufnorebgfgmemo so`e ilrrgkgml. Osso tgpl mo
ertgjende ç ceigfjonto gjpfojonteml usenml cunëÿos ilj ‖pesstdru‚1
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 137/282
525
I e p ê t u f l
? - Y o r v g ë l s m o R o m o s ’ X e r t o
2
5 Etuefgzo sou entgvêrus o mojegs prlkrejes quo plssej gmontgier Jefwero, plgs ostå
ieme voz jegs iljuj e prlfgcoreëél mo Jefweros mosondemls pere gntoriopter sondes
lu josjl ilntejgner ls prlkrejes iljujonto usemls pere e pubfgieëél mo sgtos.
_je voz gntoriopteme e sonde, l Jefwero pesse eutljetgiejonto e roefgzer l mlwnflem
mo påkgnes, gnsorgr jlmgieëÿos o cezor uj nlvl upflem1
5 Iesl utgfgzo YYD, roiljonmejls quo pesso e roefgzer es ilnoxÿos utgfgzenml idevos, plgs
josjl quo uj Jefwero ilnsgke gntoriopter sue sonde o onvgå-fe pere uj gnveslr, soj eidevo ofo nél ilnsokugrå ocotuer flkgn oj sue åroe mo dlspomekoj1
5 Mgspljls mo jùmufls pere sokurenëe ospoiêils pere l Epeido (sorvgmlr wob), tegs iljl
sudlsgn o jlm\soiurgty o ostos plmoj sor ilnkuremls oj sue åroe mo dlspomekoj.
Mgento ml quo clg rofeteml, ç roiljonmåvof quo tlml l iùmgkl so`e rovgstl ilj l jåxgjl
mo urkànige, plgs nél tojls iljl kerentgr prlbfojes mo sokurenëe vgniufemls è prlkre -
jeëél me epfgieëél ml ifgonto. Xlmojls, sgj, sor roetgvls o e`umer nl jljontl oj quo
l gnigmonto ç gmontgieml, iljl clg l iesl equg. O osso sgto so onilntre ilj prlbfojes
sçrgls o vufnoråvof nl quo tenko è sue prlkrejeëél o ne jenogre oj quo es vergåvogs
tretej ls memls quo sél pessemls. O tonde oj jonto tejbçj quo jugtes gnvesÿos
plmoj jltgver prlbfojes jeglros, plgs uje voz tonml eiossl è sue åroe, l gnveslr plmouså-fe pere lutrls prlpùsgtls.
Ç cetl quo pere ofgjgner tlmls ls prlbfojes, vefgmenml-ls mo clrje e tor ior toze quo ieme
vufnorebgfgmemo clg ilrrgkgme, ç roiljonmåvof quo l prlkrejemlr murento e ceso mo tostos
ceëe tlmes es sgjufeëÿos. Xlr osso jltgvl, busiejls mosteier es fgndes mo flks jegs rofo-
ventos ml gnigmonto. Mosse clrje, l prlkrejemlr me epfgieëél plmo enefgser iljl clg oxpfl-
reml o, so qugsor, plmo irger uj ejbgonto mo sgjufeëél pere tonter roprlmuzgr l gnigmonto
iljl prlve mo ilniogtl mo quo ls prlbfojes clrej gmontgiemls o roslfvgmls.
Mosteiejls efkuns fgnas rofoventos ml sgto ml prl`otl Lpon [ob Eppfgietgln Yoiurgty Xrl`oit
(L[EYX), quo roðno gnclrjeëÿos jugtl gjplrtentos pere mosonvlfvgjontl mo epfgieëÿos wob.
L[EYX ’ Etequos mo XDX Gn`oitgln0
5 dttp0//www.lwesp.lrk/gnmox.pdp/Xetd\]revorsef
5 dttp0//www.lwesp.lrk/gnmox.pdp/Ilmo\Gn`oitgln
5 dttp0//www.lwesp.lrk/gnmox.pdp/]lp\58\288;-Gn`oitgln\Cfews
5 dttp0//www.lwesp.lrk/gnmox.pdp/Iljjont\Gn`oitgln\Etteia
5 dttp0//www.lwesp.lrk/gnmox.pdp/Irlss-sgto\Yirgptgnk\(TYY)
5 dttp0//www.lwesp.lrk/gnmox.pdp/]ostgnk\clr\GJEX/YJ]X\Gn`oitgln\(L[EYX-MS-855)
5 dttp0//www.lwesp.lrk/gnmox.pdp/Xerejotor\Mofgjgtor
L[EYX ’ Etequos mo YUF Gn`oitgln0
5 dttp0//www.lwesp.lrk/gnmox.pdp/YUF\Gn`oitgln
5 dttp0//www.lwesp.lrk/gnmox.pdp/]ostgnk\clr\YUF\Gn`oitgln\(L[EYX-MS-88?)
Dermongnk ml sorvgël MNY/BGNM
_j sorvgmlr mo MNY besoeml nl BGNM nlrjefjonto oxorio uje mes quetrl cunëÿos oj
uje romo0
5 MNY Eutlrgtetgvl0 sonml l sorv gmlr prgnigpef mo uj lu jegs mljêngls1
5 MNY Yoiunmårgl0 rosplnsåvof pofe rçpfgie mo mljêngls1
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 138/282
522
D e r m o n g n k o j F
g n u x
5 MNY Ieido0 etuer sljonto iljl sorvgmlr mo ilnsufte1
5 MNY Clrwermor0 oniejgnde ilnsuftes pere lutrls sorvgmlros.
L gmoef pere gjpfojonteëél mo sorvgmlros MNY ç tor uj sorvgmlr momgieml pere ieme
cunëél soperemejonto mo lutrls sorvgëls1 mosse clrje, e gnstefeëél mo uj Ygstoje Lpo-
reiglnef oj uj sorvgmlr quo veg suplrter uj sorvgël MNY movo sor e jegs onxute plssêvof,
movgmejonto mgroiglneme pere sou prlpùsgtl.
Efçj mes bles pråtgies mo gjpfojonteëél, movojls ilnkurer l BGNM ilj e`usto nls quo
e`umoj o roclrioj e sokurenëe mo uj sorvgmlr MNY.
Ilncgkureëÿos roiljonmemes
E sokugr, sorél ofoniemes efkujes ilnkureëÿos roiljonmemes ne ilnkureëél ml BGNM0
5 Oxoiuter l BGNM iljl usuårgl1
5 Ovgter es tçingies mo onujoreëél mo vorél1
5 Fgjgter ilnsuftes roiursgves1
5 Fgjgtes ilnsuftes sojpro quo plssêvof1
5 Fgjgter ilnsufte el ieido ml sorvgmlr sojpro quo plssêvof1
5 _sl mo fgstes nokres pere ovgter etequos mo lrgkoj ilndoigme1
5 Ilnkureëél mo rokgstrls mo ovontls (flks).
Ilncgkurer me mgrotrgz —vorsgln‗
Sorgquo so ls prliossls ml sorvgmlr BGNM quo etonmorél es ilnsuftes ostél sonml oxoiu-
temls plr uj usuårgl mo sgstoje mostgneml pere l j, quo nél tonde dljo mongml o noj
sdoff våfgme, lu so`e, l BGNM nél movo sor oxoiuteml pofl usuårgl ilj GM 8 (usuårgl rltl).
E ilnkureëél me mgrotrgz ‖lptgln‚ ç roiljonmåvof, plgs plr pemrél uj sorvgmlr BGNM
clrnoio gnclrjeëél me vorsél utgfgzeme, essgj l emjgngstremlr plmo gjplssgbgfgter eonujoreëél. Xere e mgrotrgz ‖vorsgln‚ tor ocogtl slbro tlml l sorvgmlr, ofe movo sor gnsorgme
nl erqugvl nejom.ilnc , montrl me sossél ‖lptglns‚, lu oj erqugvl quo osto`e mgrotejonto
vgniufeml vge mgrotrgz ‖gnifumo‚.
lptglns {
vorsgln ‖Nlno‚1
}1
Fgjgte ilnsufte roiursgves
Oxpfgigter quo l roiursl mo ilnsuftes roiursgves osterå fgjgtemls e GX prç-mongmls.
eif ‖fliefdlst‚ {
52;.8.8.51
}1
eif ‖ifgonts\ilrp‚
{ 572.534.8.8/2=1
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 139/282
529
I e p ê t u f l
? - Y o r v g ë l s m o R o m o s ’ X e r t o
2
572.534.5.8/2=1
h72.534.2.8.8/2=1
}1
efflw-roiursgln {
fliefdlst1
ifgonts\ilrp1
}1
Lnmo ‖ifgonts\ilrp‚ ç uje EIF prç-mongme ne quef osterél rofeiglnemls ls GX o Romos quo
plmorél roefgzer uje posqugse roiursgve. Xere e mgrotrgz ‖efflw-roiursgln‚ tor ocogtl slbro
tlml l sorvgmlr, ofe movo sor gnsorgme nl erqugvl nejom.ilnc montrl me sossél ‖lptglns‚ lu
oj erqugvl quo osto`e mgrotejonto vgniufeml vge mgrotrgz ‖ gnifumo‚.
Fgjgteëél mo ilnsuftes el ieido ml sorvgmlr MNY
efflw-quory {
fliefdlst1
ifgonts\ilrp1
}1
E mgrotrgz ‖efflw-quory‚ fgjgte es ilnsuftes el sorvgmlr mo Ieido. Osse mgrotrgz rostrgnko
sljonto e fgste mo sorvgmlros gnclrjeme l mgrogtl e ilnsuftes. Xere quo e mgrotrgz ‖efflw-quory‚
tonde ocogtl slbro tlml l sorvgmlr, ofe movo sor gnsorgme nl erqugvl nejom.ilnc montrl me
sossél ‖lptglns‚ lu oj erqugvl quo osto`e mgrotejonto v gniufeml vge mgrotrgz ‖gnifumo‚.
]retenml-so mo uj sorvgmlr MNY Ieido, plmo sor gntorossento etgver e mgrotrgz efflw-quory-ieidone sossél ‖lptglns‚ me josje clrje. Oxojpfl0
efflw-quory-ieido {
fliefdlst1
ifgonts\ilrp1
}1
Rostrgëél mo trenscorànige mo zlne
Ç roiljonmåvof pere quefquor tgpl mo sorvgmlr MNY e fgjgteëél mo trenscorànige mo zlne.
Xere gssl, movojls utgfgzer e mgrotrgz efflw-trenscor.
efflw-trenscor {
fliefdlst1
ifgonts\ilrp1
}1
Ç roiljonmåvof iontrefgzer l usl me mgrotrgz ‖efflw-trenscor‚ ne sossél zlno, lu so`e, lnmo
sél mongmes es ilnkureëÿos mes zlnes prgjårges.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 140/282
52=
D e r m o n g n k o j F
g n u x
Fgste nokre
L ilniogtl mo fgste nokre nl jêngjl movo sor utgfgzeml pere ofgjgner e plssgbgfgmemo mo
porme mo tojpl ilj ilnsuftes clr`emes ilj GX lrgkoj gnvåfgml (nél rltoåvogs sokunml e RCI
5754). Nl ontentl, tejbçj plmo sor ðtgf pere l sysemjgn rostrgnkgr uje motorjgneme renko
mo GXs e roefgzer ilnsuftes e uj sorvgmlr MNY ospoiêil.
eif ‖prgvemls‚ {
58/41
572.534/531
5;2.53/521
}1
bfeiadlfo {
prgvemls1
}1
Ilncgkureëél mo rokgstrls mo ovontls (flks)
L usl me mgrotrgz ‖flkkgnk‚ ç roiljonmåvof tentl pofl cetl mo quo l rokgstrl mo ovontl ç uje
noiossgmemo pere ilnclrjgmemo ilj quefquor nlrje lu bles pråtgies mo sokurenëe, quentl
pofl cetl mo plssgbgfgter el emjgngstremlr evefger mo clrje pefpåvof l cuniglnejontl ml
sorvgël, mgeknlstgier prlbfojes o tejbçj gmontgier plssêvogs ebusls o etequos jefgiglsls.
E ilnkureëél ç mgvgmgme oj mues pertos. E prgjogre perto, quo ç mongme pofe mgrotrgz
‖idennof‚, ilnsgsto oj mongr l nêvof ml flk, iljl ofo sorå rlteiglneml o oj quo erqugvl soråerjezoneml. Gjplrtento fojbrer quo e mgrotrgz idennof movo oster gnsorgme ne sossél ‖flkkgn‚.
flkkgnk {
idennof eumtgrge\flk {
cgfo ‖/ver/run/nejom/eumgtlrge.flk‚ vorsglns 58 sgzo
28j1
sovorgty mobuk1
prgnt-tgjo yos1
}1
Uuenml so use e mgrotrgz ‖sovorgty ‚, ç plssêvof tor lgtl nêvogs mo flks0
5 irgtgief0 flks mo nêvof mo ir getgvgmemo jegs eftl1
5 orrlr0 gnclrjeëÿos mo orrl1
5 werngnk0 nltgieëÿos mo prlbfojes1
5 nltgio0 flk mo gnclrjeëÿos båsgies1
5 gncl0 flks mo gnclrjeëÿos koregs ml cuniglnejontl ml sorvgmlr1
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 141/282
52?
I e p ê t u f l
? - Y o r v g ë l s m o R o m o s ’ X e r t o
2
5 mobuk Q fovof Z0 flks mo orrls jugtl motefdemls pere euxgfger e mopureëél mo uj prlbfoje1
5 nlno0 nonduj nêvof mo sovorgmemo
_je voz mongml l ‖idennof‚, irge-so e rokre mo flk, rofeiglneme ilj e ietoklrge quo so
moso`e. E sokugr, efkuns oxojpfls.
Flk mo gnclrjeëÿos slbro l prliossejontl mls erqugvls mo ilnkureëél ml Bgnm0
ietoklry ilncgk {
eumtgrge\flk1
}1
Flk mo gnclrjeëÿos mo MNYYOI, iesl osto`e debgfgteml nl sorvgmlr0
ietoklry mnssoi {
eumtgrge\flk1
}1
Gnclrjeëÿos koregs mo iljungieëél mo romo0
ietoklry notwlra {
eumtgrge\flk1
}1
Ilniontre gnclrjeëÿos koregs mo ilnsuftes quo clrej roqugsgtemes el sorvgmlr Bgnm0
ietoklry soiurgty {
eumtgrge\flk1
}1
Gnclrjeëÿos slbro etuefgzeëÿos mo zlnes0
ietoklry upmeto {
eumtgrge\flk1
}1
Xerejotrgzeëél pere flks mo trenscoràniges mo zlnes roiobgmes0
ietoklry xcor-gn {
eumtgrge\flk1}1
Xerejotrgzeëél mo flks mo trenscorànige mo zlne onvgemes0
ietoklry xcor-lut {
eumtgrge\flk1
}1
E sokugr, lutrl oxojpfl mongnml l idennof pere flks pere ‖mobuk‚, jes debgfgtenml epones
es ietoklrges mo flks pemrÿos (moceuft) o flks koregs (konoref)0
Yegbe jegs
Oxgsto lutre clrje mo
mongr osse quostélmo nêvogs0 user mgrotgve
‖sysflk‚, quo veg
perejotrgzer l Bgnm
pere lrkengzer ls nêvogs
usenml e josje clrje
mo lrkengzeëél mls flks
nl prltlilfl sysflk.
f
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 142/282
523
D e r m o n g n k o j F
g n u x
// Lptglnef mobuk flk cgfo, jey bo onebfom mynejgieffy.
idennof mobuk\flk {
cgfo ‖/ver/run/nejom/mobuk.flk‚1
sovorgty mynejgi1
prgnt-tgjo yos1
}1
ietoklry moceuft {
mobuk\flk1
}1
ietoklry konoref {
mobuk\flk1
}1
}1
Ilnsgmorenml ls oxojpfls eprosontemls mo ilnkureëél ‖flks‚, nl nef, utgfgzenml tlmls,
torêejls0
flkkgnk {
idennof eumtgrge\flk {
cgfo ‖/ver/run/nejom/eumgtlrge.flk‚ vorsglns 58 sgzo
28j1
sovorgty mobuk1
prgnt-tgjo yos1
ietoklry ilncgk {
eumtgrge\flk1
}1
ietoklry mnssoi {
eumtgrge\flk1
}1
ietoklry notwlra {
eumtgrge\flk1
}1
ietoklry soiurgty {
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 143/282
52;
I e p ê t u f l
? - Y o r v g ë l s m o R o m o s ’ X e r t o
2
eumtgrge\flk1
}1
ietoklry upmeto {
eumtgrge\flk1
}1
ietoklry xcor-gn {
eumtgrge\flk1
}1
ietoklry xcor-lut {
eumtgrge\flk1
}1
idennof mobuk\flk {
cgfo ‖/ver/run/nejom/mobuk.flk‚1
sovorgty mynejgi1
prgnt-tgjo yos1
}1
ietoklry moceuft {
mobuk\flk1
}1
ietoklry konoref {
mobuk\flk1
}1
}1
}1
XY-[etidor0 Jlngtlreëél mo sorvgëls etgvls
qJlngtlre ls sorvgëls, ilj l lb`otgvl mo jentà- fls etgvls.
5 Eëél jugtl gjplrtento.
5 Movo sor uje eëél oj uj prliossl mo Dermongnk mo sor vgël mo romos, plgs e‚ mgspl-
ngbgfgmemo‚ tejbçj ç uj pgfer mo sokurenëe.
Irger ilntrlfo quo plsse eujonter e kerentge mo quo ls sor vgëls osto`ej mgsplnêvogs ç
uj veflr ekrokemlr nl prliossl mo Dermongnk.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 144/282
524
D e r m o n g n k o j F
g n u x
Ç plssêvof jlngtlrer iljputemlros o sorv gëls mo romo ilj uje ejpfe vergomemo mo slfu-
ëÿos mgcorontos. Ontro ofes oxgstoj bles slfuëÿos CLYY mo jlngtlrejontl, iljl l Nekgls,
Pebbgx lu LponNJY, jes egnme essgj, roquor uj pfeno`ejontl o e`ustos. ]lmevge, quenml
proigse roslfvor prlbfojes jonlros lu plntuegs, ilj memls mo prliossl oj uj sgstoje,
l prliossl mo jlngtlrejontl plmo sor roefgzeml pofe correjonte ps-wetidor.
L ps-wetidor ç uj mls blns oxojpfls mo correjonte ml junml _ngx quo cez uje ilgse
’ o cez boj. Ofo porjgto quo so`ej eiossemes tlmes es gnclrjeëÿos ml prliossl oj ujsgstoje o quo so`e plssêvof tljer efkuje eëél ilj beso nosses gnclrjeëÿos. L ps-wetidor
clrnoio uje gntorceio ilnsgstonto (ilj efkujes rossefves) pere es gnclrjeëÿos ml prliossl
vergemes, mgsplnêvof oj mgcorontos jåqugnes _ngx o Fgnux, `å tonml peiltos prlntls pere
efkujes mes mgstrgbugëÿos Fgnux, ontro ofes _buntu o Mobgen.
Moplgs mo tor ps-wetidor gnstefeml, l prùxgjl pessl ç irger uj erqugvl mo ilnkureëél quo
ilntçj es rokres quo moso`ejls user pere jlngtlrer lu ekgr slbro l quo l iljenml ps
clrnoio mo gnclrjeëél. @untl ilj l erqugvl mo ilnkureëél clrnoigml, plmojls user e fgnde
mo iljenml lpëÿos pere e`uster l iljplrtejontl mo ps-wetidor o e`umer ne mopureëél.
Xorglmgiejonto ç oxtreême uje fgste mo prliossls lbtgmls vge ‖ps‚, lnmo ieme gtoj me fgste
ilntçj l nljo ml prliossl (epones l quo ostå fgsteml ne ‖ijm‚ iejpl, nél l iljenml
iljpfotl o erkujontls) o sou GM mo prliossl (XGM).
Oj uj erqugvl mo ilnkureëél, ç ospoigieme uje fgste mo oxprossÿos rokuferos pere oxtregr
gnclrjeëÿos mls prliossls pere plstorglr enåfgso. Xere ieme iln`untl mo gnclrjeëÿos oxtre -
êmes ml prliossl, ç roefgzeme uje evefgeëél. Ieme iln`untl mo gnclrjeëÿos evefgeme plmo
so rocorgr e vergåvogs quo sél ostebofoigmes pofl XY o mgzoj rospogtl el prliossl iljbgneml
evefgeml, iljl, plr oxojpfl, e quentgmemo mo jojùrge ilnsujgme pofl prliossl, lu l tojpl
tltef oj quo osto ostå oj oxoiuëél. Efkujes lutres vergåvogs plmoj sor mongmes, tef iljl
l nðjorl mo vozos oj quo l prliossl clg oxoiuteml. Murento e enåfgso, so ç gmontgieme uje
gnstebgfgmemo, l prliossl plmo sor jlrtl o rogngigefgzeml nlvejonto.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 145/282
527
I e p ê t u f l ? - R l t o g r l m o E t g v g m e m o s ?
Rltogrl mo Etgvgmemos ?
Etgvgmemo ?.5 ’ Ygstojes mo motoiëél mo gntrusÿos (GMY) oj romos [FEN
Ne pråtgie, sorél tostemes es ilnkureëÿos ronemes pere jofdlrer e sokurenëe mo sorvgëlsifåssgils, iljl D]]X o l suplrto e XDX o BGNM.
5. Epfgquo tlmes es ilnkureëÿos roiljonmemes nosto iepêtufl nl sorvgmlr [OB.
2. Roefgzo tlmls ls tostos prlplstls nl iepêtufl = o evefgo l quo es ilnkureëÿos mo Dermo-
ngnk prlplriglnerej mo jofdlrges.
9. Roefgzo l Dermongnk nl BGNM, epfgienml tlmes es ilnkureëÿos prlplstes.
=. Ilnkuro l XY-[E]IDOR pere ilntrlfer YYD, D]]X, BGNM o CEGF2BEN, o roefgzo tostos
pere evefger l sou cuniglnejontl.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 146/282
598
D e r m o n g n k o j F
g n u x
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 147/282
595
I e p ê t u f l
3 - D e r m o n g n k o j s
g s t o j e F g n u x ’ X r l x y [ o b
l b ` o t g v l s
i l n i o g t l s
3Dermongnk oj sgstoje Fgnux ’Xrlxy [ob
Epronmor ilniogtls mo sorvgmlr Xrlxy [ob1 Gnstefer l YU_GM1 Ontonmor ls ilniogtls
mo EIF1 Ilndoior EIF mo Eutontgieëél1 Korer rofetùrgl.
Yorvgmlr mo Xrlxy [ob1 Gnstefeëél ml YU_GM Xrlxy [ob1 Ilnkureëél mo uj sorvgmlrmo Flks1 Ilntebgfgzeëél mo Xrliossls1 Motoiëél mo eftoreëél nl sgstoje ’ DGMY.
Gntrlmuëél
Nosto iepêtufl, sorél eprosontemls ilniogtls mo Xrlxy [ob o tejbçj iljl oxoiuter e
gjpfojonteëél mo uj sorvgmlr ilj e nefgmemo mo Xrlxy [ob besoeml ne correjonte CLYY
Yqugm. Sårgls espoitls me ilnkureëél, ilntrlfo mo ilntoðml o eutontgieëél tejbçj sorél
jlstremls nosto iepêtufl.
Oxoriêigl mo ngvofejontl 5oXrlxy wob
Iljl vlià evefge l usl gnmgsirgjgneml me wob oj uje ilrplreëél<
Oxgsto ilntrlfo mo eiossl el ilntoðml oj sue ojprose<
Evefgo e plssgbgfgmemo mo koreëél mo rofetùrgls gnclrjenml l ilntoðml mls usuårgls mo uje
ojprose iljl correjonte mo eplgl è kostél ml usl me wob oj ejbgonto ilrplretgvl.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 148/282
592
D e r m o n g n k o j F
g n u x
qXrlxy0
5 Yorvo iljl plntl gntorjomgårgl ontro uj ifgonto o uj sorvgmlr.
Xlmojls irger prlxy pere vårgls tgpls mo prltlilfl0
5 stjp, plp9, dttp oti.
Yorvgmlr prlxy Yqugm0
5 ]oj cunëél mo prlxy wob.
2 Jentçj uj ieido mo ilntoðml eiosseml mo tlmls ls ifgontos wob mo uje romo.
E cunëél båsgie mo uj prlxy ne romo ç sorvgr iljl uj plntl gntorjomgårgl, uj prliu-
remlr ontro e ilnoxél mo uj ifgonto o uj sorvgmlr. Nlrjefjonto, ontro uje romo flief o
uj sorvgël mo romo ne gntornot, oxgsto e plssgbgfgmemo mo irgeëél mo prlxy pere vårgls tgpls
mo prltlilfl, iljl sjtp, plp9, dttp, ontro lutrls. L sorvgmlr prlxy Yqugm toj e cunëél mo
prlxy wob, lu so`e, jentçj uj ieido mo ilntoðml wob eiosseml mo tlmls ls ifgontos wob
mo uje motorjgneme romo.
L Yqugm ç uje slfuëél mo slctwero fgvro pere prlxy ieido pere e [ob ilj suplrto e prltl-
ilfls D]]X, D]]XY o C]X, ontro ls prgnigpegs. E gjpfojonteëél mosso sorvgmlr oj uje romo
plssgbgfgte romuzgr e ferkure mo benme o jofdlre ls tojpls mo rosplste cezonml ieido o
routgfgzeëél mo påkgnes me wob croquontojonto eiossemes. Xorjgto tejbçj e mongëél mo
ilntrlfos mo eiossl ejpfls o plmo sor uj eioforemlr wob. Oxgstoj vorsÿos pere mgvorsls
Ygstojes Lporeiglnegs, gnifugnml [gnmlws, o ostå fgionigeml slb e KN_ KXF.
Ojblre sue prgnigpef iereitorêstgie so`e l prlxy-ieidgnk slb ls prltlilfls D]]X o C]X, l
Yqugm suplrte tejbçj0
5 Xrlxygnk mo ilnoxÿos YYF1
5 Dgorerquge mo ieido1
5 Eioforeëél D]]X1
5 Ieidgnk mo posqugses MNY1
5 YNJX.
L squgm, iljl sorvgmlr prlxy ieido, cuniglne mo clrje lb`otgve, lnmo quenml uje slfgig-
teëél mo uje osteëél ne romo slfgigter uj josjl ilntoðml wob oståtgil, ofo sorå clrnoigml
vge ostruture mo ieido. Xere quo gssl cuniglno emoquemejonto, ç roiljonmåvof mongr
rokres mo Cgroweff nl porêjotrl me romo quo romgroiglno ilnoxÿos wob pere e plrte ml
sorvgmlr prlxy squgm utgfgzeme, quo nlrjefjonto ç e plrte pemrél 9524. L usl mo sorvgmlr
prlxy wob slje veflr è sokurenëe me romo, efçj mo plssgbgfgter l jofdlr usl ml fgna ssl,
plgs e ðngie jåqugne quo cerå ilnoxél wob mgrotejonto pere e gntornot ç l sorvgmlr prlxy,
o ls ifgontos me romo so iljungiej mgrotejonto ilj ofo.
Xlrçj, so l ilntoðml nél tgvor sgml eiosseml entos o plr ilnsoquànige nél ostgvor
prosonto nl ieido, ontél l sorvgmlr veg begxer osso ilntoðml pere l sou ieido. Mosse
clrje, pere quo få oxgste uje iùpge pere uje ilnsufte cuture prlvongonto mls ifgontos,
romuzgnml essgj l tojpl mo eiossl o l ilnsujl mo benme pere usl mo gntornot.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 149/282
599
I e p ê t u f l
3 - D e r m o n g n k o j s
g s t o j e F g n u x ’ X r l x y [ o b
Ilntrlfo mo ilntoðml eiosseml ne wob
Romo Gntorne
58.8.8.8/2=
Yqugm
Ieido wob
Gntornot
Romo Gntorne
58.5.8.8/2=
Gjpfojonteëél mo uj Xrlxy [ob ilj Yqugm ’Gnstefeëél o Ilncgkureëél ml Xrlxy Ieido
qYqugm0
5 Correjonte lpon slurio pere ilnkureëél mo uj prlxy ieido.
2 Yuplrte memls mo prltlilfls iljl C]X, Klpdor o D]]X.
2 ]oj suplrto e YYF, jçtlmls mo eutontgieëél o plfêtgies mo ilntrlfo mo ilnoxél
besoemes oj EIF (Eiioss Ilntrlf Fgst ’ Fgste mo Ilntrlfo mo Eiossl).
Xere roefgzer e ilnkureëél mo uj prlxy ieido, sorå eprosonteme uje correjonte lpon
slurio mo krenmo utgfgzeëél pere osso tgpl mo prliomgjontl, quo ç l Yqugm, uj mls jofdlros
prlkrejes pere e roefgzeëél mo prlxy ieido pere ifgontos wob. Yuplrte memls mo prltlilfls
iljl C]X, Klpdor o D]]X. ]ejbçj trez suplrto e YYF, jçtlmls mo eutontgieëél o plfêtgies mo
ilntrlfo mo ilnoxél besoemes oj EIF (Eiioss Ilntrlf Fgst ’ Fgste mo Ilntrlfo mo Eiossl).
E prùxgje otepe e sor roefgzeme ç e gnstefeëél mls peiltos usemls pere e ilnkureëél ml
Yqugm, quo sorå besoeme oj Mobgen KN_/Fgnux (ojblre l Yqugm plsse sor onilntreml oj
clrjetl pere iljpgfeëél lu oj lutres mgstrgbugëÿos quo cezoj usl mo aornof Fgnux). Xlr-
tentl, eilnsofdejls quo l ilndoigjontl mls jçtlmls mo koronigejontl mo peiltos so`e
uj prç-roqugsgtl pere e ilnkureëél ne mgstrgbugëél quo jegs ekreme el usuårgl.
Ne gnstefeëél mls peiltos, l koronigejontl sorå cogtl vge EX]. Xlmorå sor useml quefquor
jgrrlr C]X lu D] ]X mo årvlro stebfo ml Mobgen KN_/Fgnux quo ilntonde l peilto ml
sorvgmlr Yqugm eblrmeml nosse ilnkureëél. Epùs e roefgzeëél mo tlml osso prliomgjontl
roefgzeml, sorå gnstefeml l peilto ml Yqugm0.
# ept-kot gnsteff ’y squgm
Cgkure 3.5
Iljl ç
ilntrlfeml l
ilntoðml eiosseml
ne gntornot.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 150/282
59=
D e r m o n g n k o j F
g n u x
_j prliomgjontl nlrjef mo vorgieëél oj uj sgstoje _buntu Fgnux , pere sebor so l
peilto clg gnstefeml lu nél, plmo sor roefgzeml etrevçs ml iljenml mpak 0
# mpak -f | krop squgm
Ilncgkureëÿos båsgies iljl Xrlxy Ieido
Entos mo soroj gngigemes es ilnkureëÿos, uj prliomgjontl gjplrtento e sor oxoiuteml
ç l beiaup mls erqugvls mo ilnkureëÿos lrgkgnegs, pere jentor uje iùpge mo sokurenëe,
iesl lilrre efkuj gjprovgstl murento l prliomgjontl mo ilnkureëél ml sor vgmlr. Xlr gssl,
movojls jentor uje iùpge ml erqugvl lrgkgnef ml sorvgmlr Yqugm, quo ç l squgm.ilnc .
Korefjonto, oj uj sorvgmlr ilj Mobgen KN_/Fgnux, l erqugvl mo ilnkureëél ml sorvgmlr
squgm, l squgm.ilnc , ostå fliefgzeml oj ‖/oti/squgm‚. Korefjonto, osse ç e fliefgzeëél pemrél,
jes tejbçj plmojls onilntrer nl mgrotùrgl ‖/oti‚. ]uml veg moponmor mo iljl l peilto me
mgstrgbugëél utgfgzeme clg irgeml0
Iùpge mo sokurenëe ml erqugvl mo ilnkureëél lrgkgnef o irgeëél mo uj erqugvl soj
ls iljontårgls.
# im /oti/squgm
# ip squgm.ilnc squgm.ilnc.lrgkgnef
# iet squgm.ilnc.lrgkgnef | krop -v ^# | krop . > squgm.ilnc
Montrl ml erqugvl mo ilnkureëél ml squgm, oj /oti/squgm/squgm.ilnc , l prgjogrl perâjotrl
e sor koronigeml lu irgeml sorå equofo quo gnmgie l Yqugm pere trebefder iljl sorvgmlr mo
ieido wob epones pere ilnoxÿos e pertgr me gntor ceio vlfteme pere e seême me romo flief.
Gssl plrquo, uje voz mongme e plfêtgie mo eiossl oxiopiglnefjonto pere e romo flief, ç
roiljonmåvof quo l Yqugm movo sor debgfgteml oxifusgvejonto pere romo flief, lu so`e, l
sliaot mo ilnoxél (plrte) nél sorå pubfgieml vge gntorceio ox torne (gntornot).
E nefgmemo ç tor uje prltoëél jeglr ilntre e plssgbgfgmemo mo l sorvgmlr sor etrgbuêml ilj
e cunëél mo prlxy enýngjl o cezor perto mo fgstes mo prlxy enýngjls pubfgiemes ne gntornot.
Lutrl jltgvemlr ç quo nl ionårgl mo prlxy pere romo FEN nél ç noiossårge e pubfgieëél
pere gntorceio oxtorne, ilflienml jegs uje voz oj pråtgie l ilniogtl mo ‖jonlr prgvgfçkgl o
jonlr roiursl‚.
Osse iereitorêstgie ç ut gfgzeme jugtes vozos plr gnveslros pere jesierer ls GXs mo
lrgkoj me gnvesél lu plr usuårgls jef-gntoniglnemls quo moso`ej burfer plfêtgies
mo ilntrlfo mo eiossl prç-ostebofoigmes.
Xere gssl, beste debgfgter e plrte pere eiossl el prlxy, quo plr pemrél ç fgsteme ne plrte9524 (suplnml quo e gntorceio ml prlxy vlfteme pere e romo osto`e ilj l GX 58.8.8.5). Efçj
mgssl, ç roiljonmåvof tejbçj etgver l squgm ne gntorceio fllpbeia0
dttp\plrt 52;.8.8.509524
dttp\plrt 58.8.8.509524
]ejbçj ç gntorossento e ilnkureëél ml nljo mo oxgbgëél ml sorv gmlr, plgs quenml l
Yqugm rotlrner efkuj orrl murento l eiossl, l nljo ml sor vgmlr osterå prosonto nl rlmepç
mosses påkgnes mo orrl0
vgsgbfo\dlstnejo sorvgmlr.ojprose.ilj.br
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 151/282
59?
I e p ê t u f l
3 - D e r m o n g n k o j s
g s t o j e F g n u x ’ X r l x y [ o b
Iesl l nljo iljpfotl ml sorvgmlr so`e gmontgieml ne ilnkureëél, osso nljo movorå
oster prosonto nl erqugvl mo roslfuëél flief ml sorvgmlr, l /oti/dlsts rofeiglneml ilj l GX
ml sorvgmlr el quef ostå essligeml osso nljo.
Yljonto osses eftoreëÿos sél noiossårges pere e sgjpfos etgveëél ml Yqugm iljl uj prlxy
ieido båsgil. Eklre l sorvgël ml Yqugm plmo sor gngigeml etrevçs ml sirgpt mo gngigefgzeëél
montrl ml mgrotùrgl /oti/gngt.m 0
# /oti/gngt.m/squgm stlp
# /oti/gngt.m/squgm stert
Lutre clrje mo gngiger l squgm ç vge l iljenml sorvgio0
# sorvgio squgm stlp
# sorvgio squgm stert
Epùs e gngigefgzeëél ml sorvgël, movojls vorgier es plrtes etgves ne pgfde mo romo ml sorvgmlr.0
# notstet -nftp | jlro
# notstet -nfup | jlro
]ejbçj ç gjplrtento e vorgieëél mls prliossls etgvls nes rospoitgves plr tes efliemes
pofl Yqugm, usenml l cusor0
# cusor -v 9524/tip
# cusor -v 9598/ump
# cusor -v 92;34/ump
_je toriogre clrje mo ilnsufter prliossls vgniufemls è plrte ç ilj l iljenml fslc 0
# fslc ’n ’g 09524
# fslc ’n ’g 09598
# fslc ’n ’g 092;34
Mojenme-so tejbçj utgfgzer l iljenml Njep pere ilnsufter so es plrtes ostél etgves pere
ilnoxÿos oxtornes o tejbçj etgves ne gntorceio Fllpbeia0
# njep ’s] -s_ -n -X8 ’p 9524,9598,99;34 58.8.8.5
# njep ’s] -s_ -n -X8 ’p 9524,9598,99;34 52;.8.8.5
Epùs gssl, ls ifgontos mo eiossl wob, iljl ls brlwsors mes jåqugnes me romo, `å plmoj sor
ilnkuremls pere eiosseroj e gntornot etrevçs ml prlxy. Ls eiossls mls ifgontos plmoj sorjlngtlremls etrevçs mls flks rofeiglnemls el Yqugm, quo so fliefgzej oj /ver/flk/squgm , utgfg-
zenml plr jogl mls torjgnegs gnetgvls tty58, tty55 o tty52 pere vgsuefgzeëél me seême ml flk.0
# tegf -c /ver/flk/squgm/ieido.flk >> /mov/tty58 &
# tegf -c /ver/flk/squgm/stlro.flk >> /mov/tty55 &
# tegf -c /ver/flk/squgm/eiioss.flk >> /mov/tty52 &
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 152/282
593
D e r m o n g n k o j F
g n u x
_sl mo EIFs nl Yqugm
_j mls prgnigpegs ilniogtls prosontos ne ilnkureëél ml Yqugm ç l usl mo Fgstes mo
Ilntrlfo mo Eiossl (EIFs), pere motorjgner mgcorontos rokres mo eiossl etrevçs mo vårgls
jçtlmls. Ofes plmoj ostebofoior nêvogs mo ilntrlfo mo eiossl els motorjgnemls ilntoðmls
roqugsgtemls pofls ifgontos.
Es EIFs sojpro plssugrél uj clrjetl ospoiêil montrl ml erqugvl mo ilnkureëél ml prlxy.0
eif nljo tgpl Q‖erqugvl‚ | strgnkZ
Lnmo0
5 eif0 moifere quo sorå uje fgste mo ilntrlfo mo eiossl1
5 nljo0 ç e gmontgieëél me EIF, l nljo rofetgvl quo rocoronige osse rokre1
5 ]gpl0 ç meml l clrjetl mo EIF e sor enefgseml, lnmo ontro ossos tgpls ls quegs plmojls
tor, plr oxojpfl, ilntrlfo plr GX mo lr gkoj, plr mostgnl, plr mete lu dlre, plr pefevre,
plr prltlilfl oti.1
5 Ytrgnk lu ‖erqugvl‚0 mongjls quef e pefevre-idevo, l mljêngl, l GX lu e lutre clrje moilntrlfo (etrevçs ml tgpl mo EIF) lu mono-so uj iln`untl mofos montrl mo uj erqugvl
nl sgstoje.
Eklre, montrl ml erqugvl mo ilnkureëél ( /oti/squgm/squgm.ilnc ), plmorge sor eflieme uje
fgnde ilj uje nlve EIF, quo, plr oxojpfl, ilntrlfe tuml l quo so lrgkgne me romo flief0
eif jgnderomo sri 572.534.8.8/2??.2??.2??.8
Nosse fgnde, clg irgeme e EIF idejeme jgnderomo, quo ilntrlfe tlmes es roqugsg-
ëÿos quo plssuoj uj motorjgneml GX mo lrgkoj (sri)1 nl iesl, tlml l renko me romo
572.534.8.8/2??.2??.2??.8.
Ilj osse EIF, mono-so osso tgpl mo ilntrlfo pere e romo. Jes iljl l Yqugm veg t rebe-fder osso ilntrlfo oj ospoiêil< Ofo sebo quo movo enefgser tuml quo so lrgkgne ne romo
572.534.8.8, jes l quo cezor ilj osses roqugsgëÿos<
Xere gssl ç quo oxgstoj ls ilntrlfos montrl ml erqugvl ml Yqugm idejemls dttp\eiioss,
quo motorjgnej iljl osses roqugsgëÿos sorél tretemes (porjgtgmes lu nél) oj rofeëél el
eiossl el mliujontl roqugsgteml.
L clrjetl ml perâjotrl dttp\eiioss ç0
dttp\eiioss Qmony|efflwZ eif
Montrl ml erqugvl mo ilnkureëél ml Yqugm, sorå gnifuême uje nlve fgnde quo gmontgie l
ilntrlfo prosonto ne EIF idejeme jgnderomo, pere quo so`e porjgtgml l sou eiossl0.
dttp\eiioss efflw jgnderomo
Ostruture mo IEIDO ml Yqugm
Nl Yqugm, plmojls mongr mgvorsls perâjotrls pere l erjezonejontl mo ieido mo
påkgnes, lnmo plmorél sor mongmls ls vårgls nêvogs mo mgrotùrgls lu pertgëÿos mgcorontos
oxgstontos pere ilntrlfer l eiossl ès gnclrjeëÿos oj ieido.
L mgrotùrgl mo ieido sorge l ‖peg‚ mls nêvogs mo mgrotùrgls mo swep ml prlxy. Xlmo sor useme
tejbçj uje pertgëél, jes l Yqugm nél irgerå osso mgrotùrgl o noj jlnterå e pertgëél0
ejbls movoj oster mgsplnêvogs provgejonto.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 153/282
59;
I e p ê t u f l
3 - D e r m o n g n k o j s
g s t o j e F g n u x ’ X r l x y [ o b
5 # Jbytos0 ospeël oj mgsil (JB) pere osso mgrotùrgl (pemrél ç 588JB)1
5 # Nêvof-50 l nðjorl ml prgjogrl nêvof mo mgrotùrgls irgeml epùs l mgrotùrgl ‖peg‚ 1
5 # Nêvof-20 l nðjorl ml sokunml nêvof mo mgrotùrgls irgeml epùs l nêvof-5.
# ieido\mgr Mgrotùrgl Jbytos Ngvof-5 Ngvof-2
Lnmo0
5 Jbytos0 ç l ospeël oj mgsil (JB) pere osso mgrotùrgl (l pemrél ç 588 JB)1
5 Ngvof-50 ç l nðjorl ml prgjogrl nêvof mo mgrotùrgls irgeml epùs l mgrotùrgl ‖peg ‚1
5 Ngvof-20 ç l nðjorl ml sokunml nêvof mo mgrotùrgls irgeml epùs l nêvof-5.
Xlmo-so gmontgier uje ostruture mo ieido ospoiêie pere l prlxy, ne fgnde sokugnto, plr
osso oxojpfl, ilj ?52 JB, 524 mgrotùrgls o 2?3 submgrotùrgls.0
ieido\mgr /ver/spllf/squgm ?52 524 2?3
Moplgs mo omgtemls ls perâjotrls ilrrosplnmontos, l erqugvl mo ilnkureëél nef movorå
tor uj espoitl sgjgfer el me påkgne sokugnto0
dttp\plrt 58.8.8.509524
gip\plrt 8
dgoreridy\stlpfgst ikg-bgn <
eif U_ORW urfpetd\rokox ikg-bgn V<
nl\ieido mony U_ORW
ieido\mgr ucs /ver/spllf/squgm ?88 92 2?3
rocrosd\pettorn ^ctp0 5==8 28% 58848
rocrosd\pettorn ^klpdor0 5==8 8% 5==8
rocrosd\pettorn . 8 28% =928
eif eff sri 8.8.8.8/8.8.8.8
eif jenekor prltl ieido\lb`oit
eif fliefdlst sri 52;.8.8.5/2??.2??.2??.2??
eif tl\fliefdlst mst 52;.8.8.8/4
eif YYF\plrts plrt ==9 ?39 # dttps, snows
eif YYF\plrts plrt 4;9 # rsyni
eif Yeco\plrts plrt 48 # dttp
eif Yeco\plrts plrt 25 # ctp
eif Yeco\plrts plrt ==9 ?39 # dttps, snows
eif Yeco\plrts plrt ;8 # klpdor
eif Yeco\plrts plrt 258 # wegs
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 154/282
594
D e r m o n g n k o j F
g n u x
eif Yeco\plrts plrt 582?-3??9? # unrokgstorom plrts
eif Yeco\plrts plrt 248 # dttp-jkjt
eif Yeco\plrts plrt =44 # kss-dttp
eif Yeco\plrts plrt ?75 # cgfojeaor
eif Yeco\plrts plrt ;;; # juftgfgnk dttp
eif Yeco\plrts plrt 395 # iups
eif Yeco\plrts plrt 4;9 # rsyni
eif Yeco\plrts plrt 785 # Y[E]
eif purko jotdlm X_RKO
eif ILNNOI] jotdlm ILNNOI]
eif jgnderomo sri 58.8.8.8/2??.2??.2??.8
eif jgndejequgne sri 58.58.8.9
dttp\eiioss efflw jenekor fliefdlst
dttp\eiioss mony jenekor
dttp\eiioss efflw purko fliefdlst
dttp\eiioss mony purko
dttp\eiioss mony !Yeco\plrts
dttp\eiioss mony ILNNOI] !YYF\plrts
dttp\eiioss efflw fliefdlst
dttp\eiioss efflw jgnderomo
dttp\eiioss efflw jgndejequgne
dttp\eiioss mony eff
dttp\ropfy\eiioss efflw eff
ilromujp\mgr /ver/spllf/squgm
vgsgbfo\dlstnejo prlxy.jlrpdogl.xxx.br
Rokgstrl mo etgvgmemos
Nl quo mgz rospogtl è sokurenëe mo romo, e utgfgzeëél mo uj prlxy ieido oj uje porjgto
tejbçj quo so`ej koremls rokgstrls mo etgvgmemos mls usuårgls o quo ls josjls
rokgstrls so`ej jentgmls plr tojpl mongml pere ilrplreëél, plssgbgfgtenml gnvostgke -
ëÿos cutures o tejbçj e jlngtlreëél ml ilntrlfo mo eiossl. Ossos rokgstrls jentçj e
sokugnto ostruture mo memls0
e. Gmontgieëél mls usuårgls0 nl Yqugm, plr pemrél toj-so l rokgstrl mo GX mo eiossl pofl
ifgonto1 plrçj, ilj l prlxy utgfgzenml eutontgieëél, sél vgniufemes gnclrjeëÿos ilj l
rospoitgvl flkgn ml usuårgl1
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 155/282
597
I e p ê t u f l
3 - D e r m o n g n k o j s
g s t o j e F g n u x ’ X r l x y [ o b
b. Mete o dlrårgls mo ontreme0 nl Yqugm, ossos memls sél rokgstremls plr pemrél1
i. Gmontgmemo ml torjgnef lu, quenml plssêvof, sue fliefgzeëél0 nl Yqugm, osse mgrotrgz
mo roiljonmeëél nél ç epfgiåvof1
m. Rokgstrl mes tontetgves mo eiossl els eiogtls o ro`ogtemls0 nl Yqugm, ossos memls sél
rokgstremls plr pemrél1
o. Rokgstrl mes tontetgves mo eiossl e lutrls roiursls o memls eiogtls o ro`ogtemls0 nlYqugm, ossos memls sél rokgstremls plr pemrél.
Ostruture mo rokgstrls mo ovontls ml Yqugm
Ojblre so`e uj pemrél mo ilnkureëél netgve e ostruture mo erqugvls mo flks sukorgme e
sokugr, ofe sorå mongme nl erqugvl /oti/squgm/squgm.ilnc pere ostebofoior e ostruture mo flks.
Xlr pemrél, motorjgne-so e mgrotgve quo gmontgie l erqugvl mo rokgstrls mo ilnoxÿos D]]X
mo ifgontos etgvls nl prlxy, krevemls oj /ver/flk/squgm/eiioss .flk 0
ieido\eiioss\flk /ver/flk/squgm/eiioss.flk
E sokugr so ostebofoio l perâjotrl ilntonml l erqugvl mo rokgstrl mo gnclrjeëÿos iljl
dlre o mete oj quo l ieido clg gngigefgzeml o l quo clg erjezoneml, gnclrjeëÿos prosontos
oj /ver/flk/squgm/ieido.flk 0
ieido\flk /ver/flk/squgm/ieido.flk
Lutre ostruture jugtl gjplrtento ç l erqugvl ilj l rokgstrl mls lb`otls quo clrej erje-
zonemls oj ilnsuftes ostebofoigmes pofls ifgontos (påkgnes, kures oti.), quo movorå sor
erjezoneml oj /ver/flk/squgm/stlro.flk 0
ieido\stlro\flk /ver/flk/squgm/stlro.flk
Irgeëél mo EIFs
qXlssgbgfgte ftrer l ilntoðml wob mls usuårgls.
Oxgstoj tràs tgpls mo EIFs0
5 urfpetd\rokox.
5 urf\rokox.
5 mstmljegn.
Lutrl roiursl jltgvemlr pere l usl mo uj prlxy-wob ç l ilniogtl mo ftrl mo ilntoðml,
quo plssgbgfgte ftrer l ilntoðml wob mls usuårgls. Xere roefgzer osse ilnkureëél, sorél
mongmls tràs tgpls mo EIFs, iljbgnenml sous mgvorsls roiursls. Ls tgpls utgfgzemls sorél0
5 urfpetd\rokox0 ftrl mo uje strgnk ne _RF1
5 urf\rokox0 ftrl mo iljpfojontl mo uje _RF1
5 mstmljegn0 ftrl mo uje _RF.
Xere uje ocotgve lrkengzeëél, mono-so e plfêtgie mo ilntoðml ilntrlfeml oj mgvorsls
erqugvls fliefgzemls montrl mo uj mgrotùrgl idejeml /oti/squgm/fgstenokre, quo sorå irgeml0
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 156/282
5=8
D e r m o n g n k o j F
g n u x
# jamgr /oti/squgm/fgstenokre
O e ostruture mo erqugvls montrl mosso mgrotùrgl sokugrå e sokugnto fùkgie0
5 pefevrequonto 0 torå pefevres-idevo quo sorél ftremes1
5 oxioilos0 sgtos quo sorél oxioëÿos è rokre1
5 mlwnflem0 oxtonsÿos quo sorél ftremes1
5 sgtoquonto0 sgtos mo ilntoðml plrnlkråil (oxojpfl0 www.ulf.ilj.br/pfeybly)1
5 urfquonto0 _RF mo sgtos plrnlkråils1
5 eumglvgmol0 sgtos ilj ilntoðml mo mlwnflems o vêmols1
5 mljgngls \ekrossgvls0 sgtos ilj ilntoðml quo tonde iljl toje ekrossÿos1
5 mrlkes0 sgtos slbro mrlkes1
5 `lklspessetojpls0 sgtos mo ̀ lkls iljl iessgnls ln- fgno1
5 vglfonige0 sgtos ilj cltls mo v glfànige lu eigmontos1
5 weroz0 sgtos mo pgreterge1
5 deiagnk0 sgtos mo ilntoðml deiagnk, ilj vêrus, trl`ens o ireiagnks.Es EIFs sorél moiferemes ne soquànige montrl ml erqugvl mo ilnkureëél ml Yqugm, noste
soquànige, moste clrje0
Rofeëél mo sgtos quo sorél oxioëÿos ès plfêtgies mongmes0
eif oxioilos mstmljegn ‖/oti/squgm/fgstenokre/sgto\oxioilos‚
]retejontl ospoigef etrevçs mo strgnk montrl mo uje _RF0
eif pefevrequonto urf\rokox -g ‖/oti/squgm/fgstenokre/pefevrequonto‚
eif mlwnflem urf\rokox -g ‖/oti/squgm/fgstenokre/mlwnflem‚
eif sgtoquonto urf\rokox -g ‖/oti/squgm/fgstenokre/sgtoquonto‚
]retejontl e pertgr mo uje _RF lu onmoroëejontl GX0
eif urfquonto mstmljegn ‖/oti/squgm/fgstenokre/urfquonto‚
eif eumglvgmol mstmljegn ‖/oti/squgm/fgstenokre/ eumglvgmol‚
eif ekrossgvls mstmljegn ‖/oti/squgm/fgstenokre/mljgngls\ekrossgvls‚
eif mrlkes mstmljegn ‖/oti/squgm/fgstenokre/ mrlkes‚
eif `lklspessetojpls mstmljegn ‖/oti/squgm/fgstenokre/
`lklspessetojpls‚eif vglfonige mstmljegn ‖/oti/squgm/fgstenokre/vglfonige‚
eif weroz mstmljegn ‖/oti/squgm/fgstenokre/weroz‖
eif deiagnk mstmljegn ‖/oti/squgm/fgstenokre/deiagnk ‖
O eklre sorél cogtes es idejemes mes plfêtgies mo eiossl pere es EIFs irgemes, etrevçs me
mgrotgve dttp\eiioss0
Rofeëél mo sgtos quo sorél oxioëÿos ès plfêtgies mongmes0
dttp\eiioss efflw oxioilos !pefevrequonto !mlwnflem !sgtoquonto
!urfquonto !eumglvgmol !ekrossgvls !mrlkes !`lklspessetojpls
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 157/282
5=5
I e p ê t u f l
3 - D e r m o n g n k o j s
g s t o j e F g n u x ’ X r l x y [ o b
!vglfonige !weroz !deiagnk
Lutre clrje jugtl ðtgf mo usl mes EIFs mo ilntoðml ç korer ilntrlfos mo bflquogl mo mlwn-
flem besoeml oj oxtonsÿos. So`e l oxojpfl0
eif mlwnflem\oxtonslos urf\rokox -g V.oxo$ V.ilj$ V.bet$ V.pgc$
V.sir$ V.jp9$ V.vqc$ V.ter.kz$ V.kz$ V.rpj$ V.zgp$ V.rer$ V.evg$ V.jpok$
V.jpo$ V.jpk$ V.qt$ V.rej$ V.rj$ V.gsl$ V.rew$ V.wev$ V.jlv$ V.;z$L usl mo roiursls mo oxprossél rokufer (rokox) ç pere gnclrjer quo då uj torjgnef ilj e
oxtonsél. Xlr gssl l usl ml ‖$‚ o e ilntre berre, ‖ V‚, entos ml plntl. L plntl movo sor gntor-
proteml iljl plntl, plgs oj rokox ç uj iereitoro iurgnke.
Oxojpfl mo usl0
dttp\eiioss mony mlwnflem\oxtonslos
Oxoriêigl mo CgxeëéloXrlxy wob
Evefgo l veflr ekrokeml quo l ilntrlfo mo ilntoðml wob plmo trezor oj uje ilrplreëél.
Iefiufo l iustl mgrotl mo uj krupl mo cuniglnårgls, ilnsgmorenml quo ofos pormoj 2d
mgrotes ilj l usl gnemoqueml me wob, lu so`e, eiossenml ilntoðml clre ml clil. Essuje
l veflr dljoj dlre jçmgl mo R$ 9 pere uj ionårgl mo ?88 cuniglnårgls. Uuef l iustl xl
pere uje ilrplreëél<
Ilnsgmoro l veflr iefiufeml ne quostél entorglr, juftgpfgquo pofes == sojenes ðtogs mo uj
enl, pere tor l veflr montrl mo uj enl0
EIF ]gjo ’ Rokres tojplrergzemesIlntrlfo mo eiossl besoeml oj tojpl ç uj mls roiursls jegs gntorossentos ml Yqugm. El
user osso tgpl mo EIF, plmojls ospoigier uj porêlml mo tojpl, ne clrje mo mge(s) lu
gntorvefl mo tojpl. Oj sokugme, ls pomgmls murento osso porêlml mo tojpl sorél ilrros-
plnmgmls lu gmontgiemls plr osse EIF.
L clrjetl ml tgpl tojpl EIF ç0
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 158/282
5=2
D e r m o n g n k o j F
g n u x
eif EIF\NEJO tgjo Qmge -ebrovgeëélZ Qdlre\gngigef-dlre\cgnefZ
Mges Ebrovgeëél ]remuëél
Yunmey Y Mljgnkl
Jlnmey J Yokunme-cogre
]uosmey ] ]orëe-cogre
[omnosmey [ Uuerte-cogre
]dursmey D Uugnte-cogre
Crgmey C Yoxte-cogre
Yeturmey E Yåbeml
Eff [ooameys M Mges ðtogs me sojene
Oxojpfl mo usl0
Irgeëél mo tràs EIFs, uje pere l dlrårgl me jendé, lutre pere l dlrårgl ml efjlël o lutre
pere l dlrårgl me termo.
eif jende tgjo J][DC 87088-520?7
eif efjlil tgjo M 59088-590?7
eif termo tgjo J][DC 5=088-54088
Xere oxojpfgier l usl, sorél irgemes EIFs mo ilntoðml0
eif trenquogre mstmljegn ylutubo.ilj ceioblla.ilj lraut.ilj bbb.
kflbl.ilj
Ls mljêngls me EIF ‖ trenquogre‚ sorél fgboremls oxifusgvejonto nl dlrårgl ml efjlël.Xrgjogrl oxojpfl0
dttp\eiioss efflw ylutubo !jende !termo
Lutre clrje0
dttp\eiioss efflw ylutubo efjlil
Lutres mgrotgves gjplrtentos pere cuniglnejontl ml prlxy
Mono-so quo e fgjpoze eutljåtgie mo ieido so`e sojenef. Iesl gssl nél so`e mongml, l
pemrél ç uje voz plr jàs. Gssl sorå mongml etrevçs me mgrotgve rocoronio\eko0
rocoronio\eko 5 wooa
Lutrl cetlr mo sokurenëe gjplrtento ç e gjplssgbgfgmemo mo so roefgzer ieido mo påkgnes
sokures, pere ovgter quo gnclrjeëÿos gnvåfgmes so`ej ilnsuftemes plstorglrjonto. Mono-so
osso pemrél etrevçs ml perâjotrl nl\ieido0
nl\ieido mony YYF\plrts
Uuenml l sorvgmlr mo prlxy wob ç ilnkureml, plmojls user e eutontgieëél, plgs ç uj
roiursl jugtl gntorossento pere ilntrlfo mo eiossl.
L roiursl mo eutontgieëél tlrne l koronigejontl mls ‖flks mo eiossl‚ jugtl jegs pråtgil o
]ebofe 3.5
Irgeëél mo EIFs.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 159/282
5=9
I e p ê t u f l
3 - D e r m o n g n k o j s
g s t o j e F g n u x ’ X r l x y [ o b
gntorossento, plgs plssgbgfgte e vgsél ifere ml usl ml roiursl pofl usuårgl. L Yqugm trebefde
ilj l ilniogtl mo eutontgiemlros oxtornls pere roefgzer tef cunëél, lu so`e, prlkrejes è
perto pere roefgzer ls pemrÿos mo eutontgieëél suplrtemls pofl prùprgl prlxy.
Xere so ospoigier uj eutontgiemlr oxtornl pere eiossl el ieido ml Yqugm ’ jugtl ðtgf pere
jentor l ilntrlfo mo usuårgls oj rofeëél el nljo/sonde pere eiossl el prlxy ’, movojls
gnclrjer el Yqugm quoj ç l prlkreje oxtornl rosplnsåvof pofe teroce. Mls tgpls mo eutontg-
iemlros oxtornls, plmoj sor usemls vårgls tgpls, iljl eutontgiemlros mo pemrél NIYE (iljloj sorvgmlros wob), oj uje beso FMEX, oj uje beso Yejbe lu uj mljêngl Jgirlslct.
Nosto oxojpfl, ç utgfgzeml l eutontgiemlr pemrél mo sorvgmlr wob, l nise\eutd, plr cezor
perto me beso ml prùprgl Yqugm0
eutd\perej besgi prlkrej /usr/fgb/squgm/nise\eutd /oti/squgm/pesswm
L erqugvl squgm.ilnc voj iljonteml, gnclrjenml lutrls jçtlmls mo eutontgieëél, o e
clrje iljl l Yqugm clg ilniobgml tlrne cåigf pere l emjgngstremlr utgfgzer uj lutrl jçtlml
pere eutontgier usuårgls. Xere oxojpfgier l quo ç mgtl, sokuoj gnstruëÿos slbro iljl
prliomor pere eutontgier usuårgls Yqugm ne beso mo usuårgls FMEX, quo oj sorvgmlros Fgnux
ç iljujonto gjpfojonteml utgfgzenml l LponFMEX.
# vg /oti/squgm/squgm.ilnc
eutd\perej besgi prlkrej /usr/fgb/squgm/fmep\eutd -b
mi:tosto,mi:xxx,mi:br -c ugm:%s 572.534.8.52=
Movojls mongr l nðjorl mo prliossls-fdl pere e roefgzeëél ml prliomgjontl mo euton-
tgieëél, plgs veflros jegs begxls sorvoj pere mgiufter l usl mo prlkrejes mo ‖brutoclrio‚
quo tontej, etrevçs mo etequos mo mgiglnårgls, ‖emgvgnder‚ e sonde ml usuårgl0
eutd\perej besgi idgfmron ?
Lutre gjplrtento mongëél ç l tojpl mo oxpgreëél me sonde pere e eutontgieëél ml usuårgletrevçs mo uje ilnoxél ifgonto (osso tojpl ç meml oj sokunmls)0
eutdontgieto\ttf 988
Eklre sorå motorjgneme uje EIF idejeme pesswlrm, ml tgpl prlxy\eutd, pere etgver l
roiursl mo eutontgieëél.0
eif pesswlrm prlxy\eutd ROU_ORGM
Moplgs mgssl, l ilntrlfo mo eiossl vge mgrotgve dttp\ eiioss movo sor ospoigieml, pere cezor
e idejeme me EIF. Nl iesl ml Yqugm, e lrmoj mes EIFs prosontos ç gjplrtento murento e
enåfgso ml erqugvl pofl sorvgmlr1 plr ilnsoquànige, osse EIF movorå sor gnvlieme entos mo
quefquor lutre, so nél e eutontgieëél nél sorå roquorgme ilrrotejonto murento l eiosslpofls ifgontos0
dttp\eiioss efflw pesswlrm
O, plr j, cez-so noiossårge e prosonëe mo uje EIF ostretçkgie, nl nef ml erqugvl mo iln-
kureëél, nokenml quefquor plssgbgfgmemo quo nél so onquemrlu nes EIFs entorglros0
dttp\eiioss mony eff
Epùs tlmls ls prliomgjontls, l erqugvl mo ilnkureëél ml Yqugm plmo sor sefvl o l sorvgël
sor roierrokeml, iljl cogtl entorglrjonto, pere ospoigier tlmes es nlves jumenëes. L tosto
e sor roefgzeml movorå sor l josjl ocotueml ne ilnkureëél entorglr, etrevçs me ilnku-
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 160/282
5==
D e r m o n g n k o j F
g n u x
reëél mls brlwsors ifgontos eplntenml pere l sorvgmlr prlxy.
Ne pråtgie oxgstoj mues clrjes mo cezor l Yqugm so eutontgier oj uj sorvgmlr [gnmlws
ilj Eitgvo Mgroitlry. Oj uje mofes, e cogte plr FMEX, l usuårgl torå mo mgkgter e sonde ml
mljêngl o, quenml qugsor nevoker ne gntornot, ofo movorå so eutontgier nl prlxy (Yqugm).
Osso tgpl mo eutontgieëél ç cogte plr fmep. Lutre clrje ç plr N]FJ, jes nosto iepêtufl sorå
oxojpfgieme sljonto e eutontgieëél plr FMEX, plgs tejbçj ç e sukorgme pere eutontg-
ieëél nl LponFMEX.
L jlml vge EM ç uje eutontgieëél gntorossento. Beste ilflier es sokugntos fgndes nl squgm.ilnc 0
# vg /oti/squgm/squgm.ilnc
Fgnde pere eutontgieëél mo usuårgls0
eutd\perej besgi prlkrej /usr/fgb/squgm/fmep\eutd -R -b
mi:mljgngl,mi:ilj,mi:br -M in:squgm,mi:mljgngl,mi:ilj,mi:br -w
‖wgnsorvor‚ -c sEJEiiluntNejo:%s -d 572.534.8.5
# fgnde pere eutontgieëél mo krupls
oxtornef\eif\typo fmep\krlup %FLKGN /usr/fgb/squgm/squgm\fmep\krlup -R -b mi:mljgngl,mi:ilj,mi:br -d 572.534.8.5 -M in:squgm,m
i:mljgngl,mi:ilj,mi:br -w wgnsorvor -c ‖(&(in:%e)(jojbor:%v))‚ -C
‖(sEJEiiluntNejo:%s)‚
Iesl so`e uj sorvgmlr LponFMEX, plmojls eutontgier0
eutd\perej besgi prlkrej /usr/fgb/squgm/fmep\eutd -b
mi:tosto,mi:xxx,mi:br -c ugm:%s 572.534.8.52=
Epùs gnifugr osses fgndes, beste rogngiger l sorvgël ml Yqugm quo e eutontgieëél `å osterå
cuniglnenml.
# /oti/gngt.m/squgm stlp
# /oti/gngt.m/squgm stert
E emlëél mo uj Xrlxy Ieido oj uje romo ç uj prliomgjontl oxtrojejonto vgåvof montrl
mo uje tlplflkge mo romo, plgs etrevçs mofo plmoj-so ostebofoior mgvorsls ilntrlfos slbro
l eiossl mls usuårgls o ifgontos me romo els ilntoðmls oxtornls, l quo ceigfgte l prliossl
mo eumgtlrge o koronigejontl mes plssêvogs ilnsuftes roefgzemes. Efçj mgssl, osse ilnku-
reëél vgse e uj jofdlr eprlvogtejontl mo roiursls gjplrtentos me romo, iljl l usl mo
fgna oxtornl, jlmofenml l eiossl mossos josjls ifgontos e j mo so tor kendl jeglr oj
porclrjenio, mgsplngbgfgmemo o sgjpfgigmemo, tentl nl eiossl pofls usuårgls quentl pofls
ilntrlfos ospoiêils mls emjgngstremlros.
Lutrl cetlr gjplrtento quo `ustgie l usl mo uj prlxy wob ç tor ilntrlfo slbro l iln-
toðml mo eiossl ne ilrplreëél, plgs uj prlxy wob plssgbgfgte tejbçj korer rokgstrls
pere eumgtlrge mo etgvgmemos mls usuårgls quo plmoj sor jentgmls plr tojpl mongml
montrl me ilrplreëél, plssgbgfgtenml gnvostgkeëÿos cutures o tejbçj e jlngtlreëél ml
ilntrlfo mo eiossl.
Ossos rokgstrls movoj jentor e sokugnto ostruture mo memls0
5 Gmontgieëél mls usuårgls0 nl Yqugm, plr pemrél, tojls l rokgstrl mo GX mo eiossl pofl
ifgonto1 plrçj, ilj l prlxy utgfgzenml eutontgieëél, sél vgniufemes gnclrjeëÿos ilj l
rospoitgvl flkgn ml usuårgl1
Yegbe jegs
Nél ç clil mosso trog-
nejontl e utgfgzeëél mo
mgrotùrgls besoemls nl
prltlilfl FMEX, jes ç
gntorossento fojbrerquo l Yqugm ç uje
slfuëél jemure o toj
suplrto e uj krenmo
nðjorl mo jçtlmls mo
eutontgieëél, ontro ofos
ls mgrotùrgls besoeml
oj FMEX, iljlLponFMEX o JgirlslctEitgvo Mgroitlry.
f
E EBN] NBR GYL/GOI2;88202884 roiljonme
e sokrokeëél mo romo.Mosse clrje, e
utgfgzeëél mo uj prlxy
wob ç uj mgsplsgtgvlmo romo quo, efçj mo
e`umer e ostebofoior e
sokurenëe mo porê-
jotrl, tejbçj ilflie
e romo oj ilnclrjg-
memo ilj e 2;882.
m
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 161/282
5=?
I e p ê t u f l
3 - D e r m o n g n k o j s
g s t o j e F g n u x ’ X r l x y [ o b
5 Mete o dlrårgls mo ontreme0 nl Yqugm, ossos memls sél rokgstremls plr pemrél1
5 Rokgstrl mes tontetgves mo eiossl els eiogtls o ro`ogtemls0 nl Yqugm, ossos memls sél
rokgstremls plr pemrél1
5 Rokgstrl mes tontetgves mo eiossl e lutrls roiursls o memls eiogtls o ro`ogtemls0 nl
Yqugm, ossos memls sél rokgstremls plr pemrél.
Mgento mgssl, l usl mo prlxy wob besoeml nl Yqugm plssgbgfgte tejbçj ilnclrjgmemo ilj l
gtoj 58.58.5 me nlrjef.
Jlngtlrejontl mls flks ml Yqugm ilj YERK
Koroniger es etgvgmemos ml usuårgls mgrotejonto nls flks koremls pofl Yqugm ç uje teroce
plssêvof, jes ç gntorossento treter ls flks mo eiossl vge rofetùrgls dtjf koremls pofe
correjonte Yerk. L Yqugm Enefysgs Roplrt Konoretlr (Yerk) clg mosonvlfvgml pofl bresgfogrl
Xomrl Lrsl.
Xere gnstefer l Yerk, movojls user l iljenml ept-kot 0
# ept-kot gnsteff ’y serk
E ilnkureëél ml Yerk ç iontrefgzeme nl erqugvl serk.ilnc . Movojls eftorer efkujes mongëÿos
montrl ml erqugvl serk.ilnc , quo ç onilntreml nlrjefjonto montrl ml mgrotùrgl /oti/squgm 0
fenkueko Xlrtukuoso0
eiioss\flk /ver/flk/squgm/eiioss.flk
tgtfo ‖Rofetùrgl YERK‚
tojplrery\mgr /tjp
lutput\mgr /ver/www/Qsou-nljoZ/squgm-roplrts
roslfvo\gp nl
usor\gp nl
Moplgs mo ilnkurer l serk.ilnc , beste korer ls rofetùrgls ilj l iljenml0
# serk
Epùs e oxoiuëél, ç noiossårgl vorgier e påkgne irgeme oj /ver/www/Qsou-nljoZ/squgm-roplrts
o uså-fe oj sou nevokemlr.
L peilto serk trez ilnsgkl uj sirgpt monljgneml ‖serk-roplrts‚. Epùs ilnkurer l serk, ç
plssêvof korer rofetùrgl mo clrje sgjpfos.
Rofetùrgl mgårgl0
# serk-roplrts megfy‚
Rofetùrgl sojenef0
# serk-roplrts wooafy‚
Efçj mgssl, cez perto ml peilto e koreëél ml erqugvl /oti/irlnteb.m/serk , quo cez l ekonme-
jontl me koreëél mls rofetùrgls vge irlnteb.
Gnstefeëél ml cgftrl mo ilntoðml Menskuermgen
L Menskuermgen ç uj ftrl mo ilntoðml quo plmo sor gntokreml el Yqugm pere e ftrekoj mo
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 162/282
5=3
D e r m o n g n k o j F
g n u x
‖ilntoðml‚, jugtl jegs errl`eml quo es rokres besoemes oj EIF mgsplnêvogs nl Yqugm.
Xere l prliossl mo gnstefeëél o ilnkureëél ml Menskuermgen, ç roiljonmåvof quo so`ej
cogtes iùpges mo sokurenëe ml erqugvl squgm.ilnc . Xere gssl, beste eiosser l mgrotùrgl0
# im /oti/squgm/
Cezor e iùpge ml squgm.ilnc lrgkgnef0
# ip squgm.ilnc squgm.ilnc.LRGKGNEF
E gnstefeëél ml Menskuermgen plmo sor cogte pofl roplsgtùrgl, etrevçs me correjonte ept0
# ept-kot gnsteff menskuermgen
Ls erqugvls mo ilnkureëÿos ml Menskuermgen osterél oj /oti/menskuermgen0
# im /oti/menskuermgen
# fs -f
Ç roiljonmåvof cezor uje iùpge mo sokurenëe ml erqugvl mo ilncgkureëél menskuermgen.ilnc
entos mo quefquor eftoreëél0
# ip /oti/menskuermgen/menskuermgen.ilnc /oti/menskuermgen/
menskuermgen.ilnc.LRGKGNEF
Montrl ml erqugvl menskuermgen.ilnc noiossårgl0 prliurer e tek ‖_NILNCGK_ROM‚ o
eftorer pere0
# _NILNCGK_ROM
Eftorer e mgrotrgz ftorgp pere0
cgftorgp:
Eftorer e mgrotrgz ftorplrt pere0
cgftorplrt:4848
Eftorer e mgrotrgz prlxygp pere0
prlxygp:52;.8.8.5
Eftorer e mgrotrgz prlxyplrt pere0
prlxyplrt:9524
Epùs es eftoreëÿos, movojls rogngigefgzer l sorvgël ml menskuermgen0
sorvgio menskuermgen stlp
sorvgio menskuermgen stert
_je voz ilj l Menskuermgen etgveml, movojls roefgzer ls tostos vge brlwsor o evefger ls
rosuftemls cezonml sgjufeëÿos mo eiossl e sgto gnmovgmls.
suml /oti/gngt.m/menskuermgen rostert
Eklre ç sù ilnkurer ls brlwsors pere useroj l prlxy.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 163/282
5=;
I e p ê t u f l 3 - R l t o g r l m o E t g v g m e m o s 3
Rltogrl mo Etgvgmemos 3
Xråtgie mo gnstefeëél, ilnkureëél mls ilntrlfos mo ilntoðml, eutontgieëél o koreëél mo
rofetùrgls. Yorå noiossårgl quo l efunl utgfgzo e jåqugne vgrtuef propereme iljl Sgr tueblx.
Mosse clrje, sorå plssêvof epfgier tlmls ls ilndoigjontls (tçingies o correjontes).
Etgvgmemo 3.5 ’ Dermongnk Fgnux ’ Xrlxy wob ’ Yqugm
5. Ilnkuro uj Yqugm pere cuniglner iljl uj prlxy wob oxifusgvl mo ieido. Rogngigo l
Yqugm, tosto-l o vefgmo sou cuniglnejontl o ls flks koremls.
2. Yefvo es ilnkureëÿos ml oxoriêigl 5 o etrgbue ilntrlfo mo ilntoðml, rogngigo l Yqugm,
tosto-l o vefgmo sou cuniglnejontl o ls flks koremls.
9. Yefvo es ilnkureëÿos ml oxoriêigl 2 o etrgbue ilntrlfo utgfgzenml e EIF ]GJO, rogngigo l
squgm, tosto-l o vefgmo sou cuniglnejontl o ls flks koremls.
=. Yefvo es ilnkureëÿos ml oxoriêigl 9 o etrgbue ilntrlfo utgfgzenml Eutontgie NIYE\ E_]D,
rogngigo l Yqugm, tosto-l o vefgmo sou cuniglnejontl o ls flks koremls.
?. Ilnkuro l Yerk pere korer rofetùrgls D]JF.
3. Ilnkuro e eutljeëél mo rofetùrgls vge irlnteb pere tlml mge, 9d.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 164/282
5=4
D e r m o n g n k o j F
g n u x
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 165/282
5=7
I e p ê t u f l
; - C g r o w e f f ’ X e r t o 5
l b ` o t g v l s
i l n
i o g t l s
;Cgroweff ’ Xerto 5
Ifessgier uj roweff quentl è sue etueëél1 Mosonder tlplflkges quo ilntojpfoj l
usl mo Cgroweff1 Oxoiuter iljenmls mo emjgngstreëél ml GXtebfos1 Ilnkurer rokres
mo ftrl mo peiltos ml GXtebfos.
]gpls mo roweff o tlplflkge mo romos ilj roweff1 Yokurenëe mo Xorêjotrl o usl ml
roiursl ml Aornof ml Fgnux monljgneml Notftor, pere gjpfojonteëél mo roweff iljeuxêfgl me correjonte Gptebfos1 Xerejotrgzeëél o irgeëél mo idegns, emjgngstreëél mes
tebofes1 Oxojpfgieëÿos mo iljl treter iortls sorvgëls o prltlilfls (]IX, _MX o GIJX).
Gntrlmuëél
qCgroweffs0
5 Ylzgndls, nél tàj iljl kerentgr e sokurenëe mo uje romo mo iljputemlros.
5 Igtemls ne nlrje gntorneiglnef mo Yokurenëe me GYL/GOI 2;88202884.
Ygstojes mo roweffs sél gjplrtentos oj uj prl`otl mo sokurenëe1 tlmevge, slzgndls
nél tàj iljl kerentgr e sokurenëe mo uje romo mo iljputemlros. Mojenmej-so lutrls
joiengsjls iljl tejbçj uje emjgngstreëél prletgve. Jes e sue gjplrtânige ç nltùrge,
l quo `å ç treteml ne nlrje gntorneiglnef mo Yokurenëe me GYL/GOI 2;88202884, lu so`e,
ontro ls ilntrlfos me romo, då e roiljonmeëél mo sokrokeëél me romo, essgj iljl e
gjpfojonteëél mo prltoëél mls sorvgëls mgsplngbgfgzemls ilntre eiossls nél eutlrgzemls
’ uj trebefdl pere uj sgstoje mo ftrls (roweff), pere irger porêjotrls mo romos movgme -
jonto prltokgmls o koronigemls.
Nosto iepêtufl, sorå utgfgzeml l Gptebfos, correjonte quo surkgu nl Aornof 2.= , ovlfugu, clgjentgme nl Aornof 2.3 o plstorglrjonto tejbçj porjenoiou ne sçrgo 9.8. L GXtebfos plssg-
bgfgte el emjgngstremlr jengpufer es ‖iepeigmemos‚ ml Notftor, l roweff mo toinlflkge Yteto
Cuff netgve nl Fgnux.
Nlssl lb`otgvl sorå iljproonmor iljl es iljungieëÿos mo romo eilntoioj nl ilntoxtl ml
prltlilfl, lu so`e, trebefder e jetçrge-prgje, quo ç l ]IX/GX, etrevçs mo uj jçtlml mgmåtgil
ejgkevofjonto ‖Fokl‚, movgml el cetl mo quo nl prliossl gngigef mo epronmgzeml tretejls
ieme eëél gjplrtento soperemejonto, iljl poëes mo uj quobre-ieboëe, pere nl nef
`untå-fes ilj ilorànige o ilnstrugr uj jlmofl mo plfêtgies mo roweff roefjonto cuniglnef.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 166/282
5?8
D e r m o n g n k o j F
g n u x
Erqugtoture mo cgroweff
Nlrjefjonto, es ojproses procoroj gjpfojonter uj roweff besoeml epones oj uje
jåqugne, so`e uj dlst XI lu uj rltoemlr. Ontrotentl, ls roweffs jegs rlbustls sél ilj-
plstls plr vårges pertos. So`e efkujes erqugtotures e sokugr.
swgtid/dub
Rltoemlr ilj ]rgekoj(Yiroongnk Rlutor)
swgtid/dub
Rltoemlr ilj ]rgekoj
(Yiroongnk Rlutor)
Bles Xråtgies roiljon-
memes ne EBN] NBRGYL/GOI 2;882028840sgstojes mo roweff sélgjplrtentos oj uj
prl`otl mo sokurenëe1nl ontentl, slzgndls
nél tàj iljl kerentgre sokurenëe mo uje
romo mo iljputemlros.Mojenmej-so lutrls
joiengsjls, efçj mo
emjgngstreëél prletgve.Ontrotentl, sue
gjplrtânige ç nltùrge, e
plntl mo e nlrje
gntorneiglnef mo
Yokurenëe me
Gnclrjeëél BY;;77,
vgniufeme nl Bresgf pofe
EBN] iljl NBR GYL/GOI 5;;7702885, nl
gtoj 4.?.5, Ilntrlfos meromo, roiljonmer e
sokrokeëél me romo,
essgj iljl e
gjpfojonteëél mo
prltoëél mls sorvgëls
mgsplngbgfgzemls ilntre
eiossls nél eutlrg-
zemls. Gssl sgkngie ujtrebefdl pere uj
sgstoje mo ftrls(roweff) quo, jegsoncetgiejonto, ç igteml
ne NBR GYL/GOI
5;;7702885 nes efênoeso o c ml gtoj 7.=.2, Rltemo romo lbrgketùrge.
m
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 167/282
5?5
I e p ê t u f l
; - C g r o w e f f ’ X e r t o 5
swgtid/dub
Ketowey mo Beso Mupfe
(Muef Dljom Ketowey)
swgtid/dub
Ketowey Dlst ilj ]rgekoj
(Yiroonom Dlst Ketowey)
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 168/282
5?2
D e r m o n g n k o j F
g n u x
swgtid/dub
Ketowey mo Beso Mupfe
(Muef Dljom Ketowey)
swgtid/dub
Ketowey Dlst ilj ]rgekoj
(Yiroonom Dlst Ketowey)
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 169/282
5?9
I e p ê t u f l
; - C g r o w e f f ’ X e r t o 5
Rlutor ilnstkureml
ilj EIF pre
stftrer peiltos
swgtid/dub
Ketowey Dlst ilj ]rgekoj
(Yiroonom Yubnot)
Fgnux
Yorvgmlr moGjprossél
Fgnux
YorvgmlrMDIXGntrenot
Romo porgcçrgie
Fgnux
Cgroweff
DGMY
Yorvgmlr[obMNY 5
Fgnux
Cgroweff
DGMY
Yorvgmlr[obMNY 2
Fgnux
Cgroweff
DGMY
Yorvgmlrmo IlrroglEntgvêrus[objegf
Fgnux
Cgroweff
DGMY
GMY
YorvgmlrNotsegnt
GX Såfgml
NE]
GX Gnvåfgml
Fgnux
SXN
Cgroweff
NGMY
DGMY
Xrlxy
Ketowey
Fgnux
Yorvgmlr moErqugvls
FEN
OsteëÿosFgnux / [gnmlws
swgtid
Fgnux
Cgroweff
GMY
Xrlxy
Ketowey
Cgkure ;.5
Iljplsgëél
mls roweffsjegs rlbustls.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 170/282
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 171/282
5??
I e p ê t u f l
; - C g r o w e f f ’ X e r t o 5
_je vgsél e pertgr ml metekreje
Mo uje clrje mgrote o mgmåtgie, plmo-so ifessgier uj roweff mo eilrml ilj sou nêvof mo
etueëél oj uj metekreje, lu so`e, l quentl oj jçmge ml metekreje ç ocotgvejonto prlios-
seml, lu quegs ls iejpls ml rospoitgvl ieboëefdl plmoj sor rofoventos pere eëél ml roweff.
28 bytos
Onmoroëejontl GX
]rensplrto
]IX / _MX / GIJX* Åroe mo Memls (JYY)
5=38 bytos28 bytos
Xeiaot Cgftor - ]rete 28 e 2= bytos
YtetoFoss - ]rete uj pluil jegs mo 2= bytos
YtetoCuff - ]rete nl jêngjl ls =8 bytos gngigegs
* L prltlilfl mo trensplrto plmo tor l ieboëefdl mo etç 28 bytos
* Seflr jåxgjl ml Metekreje (J]_) 5?88 bytos
5 Xeiaot Cgftor0 trete oj jçmge mo 28 e 2= bytos gngigegs mo uj peilto, lu so`e, osso tgpl mo
roweff trete o toj roiursls pere treter tlml l ieboëefdl GX (ls prgjogrls 28 bytos ml
peilto) o e perto ml ieboëefdl mo trensplrto nl quo mgz rospogtl è plrte lrgkoj o plrte
mostgnl. Fojbrenml quo l iejpl ‖plrte‚ toj 2 bytos (53 bgts quo ilrrosplnmoj e
2^53:3??93 plrtes)1
5 YtetoFoss0 trete oj jçmge uj pluil jegs quo 2= bytos gngigegs mo uj peilto, lu so`e,
osso tgpl mo roweff sorge uj Xeiaot Cgftor jofdlreml. Yonml rofovento fojbrer quo osso
tgpl mo roweff plmo etç tor uj tretejontl pere efkuj iejpl ospoiêil ml ieboëefdl
mo trensplrto, jes nél ç iepez mo tgrer prlvogtl ml ilniogtl mo Osteml mo Ilnoxél1
5 YtetoCuff0 osse ietoklrge mo roweff trete nl jêngjl ls =8 bytos gngigegs mo uj mete-
kreje, lu so`e, tlmls l ieboëefdl GX o, so`e quef clr l prltlilfl mo trensplrto (_MX lu
]IX), sél iepezos mo treter l ieboëefdl mo ]rensplrto. Yonml iepez mo eprlvogter es
gnclrjeëÿos mo osteml mo ilnoxél ml ieboëefdl ]IX.
Cunmejontls pere l GXtebfos
Entos josjl mo soroj eblrmemls ilniogtls jegs ospoiêils ml GXtebfos, ç gntorossento
quo osto`ejls cejgfgergzemls ilj efkuns cunmejontls båsgils rofeiglnemls el Notftor o l
aornof ml Fgnux.
L Notftor ç e plrëél ml Aornof ml Fgnux quo veg iljplr es iepeigmemos mo roweff ne Aornof
spieo o quo sorå ilnkureml o koronigeml pofe correjonte Gptebfos ne usorsiepo. ]lmevge,
quenml so joniglne l roweff ml Fgnux, ç iljuj sgjpfosjonto monljgnå-fl Gptebfos.
Xrl`otl oj ovlfuëél, e ieme nlve vorsél l Notftor tlrne-so ieme voz jofdlr o jegs iljpo-
tgtgvl, trez nlvls roiursls pere tretejontl mo peiltos o sokurejonto, pofe sue quefgmemo,
tlrne-so oj jugtls jljontls ùtgje lpëél oj rofeëél els roweffs iljorigegs. Nl ontentl,
quenml uje ojprose mo krenmo plrto cez e lpëél plr uje slfuëél mo roweff besoeme
oj slctwero fgvro, nél l cez pofl iustl. Cez gnmoponmontojonto ml proël. Ilfliejls oj
Cgkure ;.?
L roweff o lmetekreje.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 172/282
5?3
D e r m o n g n k o j F
g n u x
prgjogrl fuker e cuniglnefgmemo o jeturgmemo me toinlflkge. Mosse clrje, slfuëÿos mo
roweff besoemes oj Fgnux lu josjl besoemes oj _ngx BYM sél usemes plr soroj cun -
iglnegs o ilnåvogs.
Efkujes mes prgnigpegs iereitorêstgies ml cgroweff GXtebfos
5 Xlssgbgfgmemo mo mofgjgter plrtes/onmoroël mo lr gkoj/mostgnl1
5 Yuplrto e prltlilfls ]IX/_MX/GIJX o GKJX, ontro lutrls1 5 Xlssgbgfgte tretejontl mo peiltos plr gntorceio lrgkoj/mostgnl1
5 Romgroiglnejontl1
5 L ilniogtl mo tretejontl mo tråcokl mgvgmgnml tebofes l tlrne ox trojejonto vorsåtgf,
plssgbgfgtenml el emjgngstremlr mongr plfêtgies iferes pere ieme sgtueëél, so`e ontreme,
seême lu ropesso mo peiltos ilj tremuëél lu nél mo onmoroëejontl1
5 Ç oståvof o råpgml1
5 Xlssgbgfgte l tretejontl ml osteml me ilnoxél, sonml jugtl cåigf bflquoer lu ro`ogter
peiltos jengpufemls plr etequos (jef clrjemls)1
5 L cetl mo sue ostruture so besoer oj jùmufls l tlrne uj prl`otl ceigfjonto osiefåvof1 5 Yuplrto e rltoejontl mo peiltos, tretemls oj uje åroe mgcoronto mo tråcokl pemrél1
5 Yuplrto è jengpufeëél mo iejpls mo uj metekreje1
5 Iepeigmemo mo trebefder ilj crekjonteëél1
5 Xlssgbgfgmemo mo porslnefgzer l rokgstrl mo ovontls1
5 Yuplrto e NE]1
5 Ilntebgfgzeëél mo peiltos1
5 Ilntrlfo slbro ls fgjgtos mo peilto.
]rebefdenml ilj GXtebfos
qXrl`otl Notftor0
5 Xlssug e gntorceio Gptebfos.
2 Oxtrojejonto errl`eml.
Ilnclrjo `å joniglneml, l prl`otl Notftor trez ilnsgkl e gntorceio Gptebfos, quo plssgbg-
fgte e jengpufeëél mo roiursls ml Aornof ml Fgnux. Etuefjonto, osse ç e lpëél mo roweff
mls emjgngstremlros Fgnux. E prlplste mosto iepêtufl ç eblrmer es iepeigmemos ml GX]ebfos
mo clrje mgmåtgie, plr jogl mo sgtueëÿos ospoiêies, tontenml sojpro oxojpfgier o nél
epones mongr perâjotrls. ]lmevge, l GXtebfos ç oxtrojejonto errl`eml, o ostå sonml
jofdlreml kremetgvejonto mosmo e sue prgjogre vorsél1 plr gssl, nél so toj e protonsél
mo eblrmer tlmls ls sous roiursls nosto iepêtufl lu josjl nosto fgvrl.
L Gptebfos trebefde ilj l ilniogtl mo tebofes, nl quef ieme uje mofes trete l peilto mo
eilrml ilj e sgtueëél vgniufeme, lu so`e, ilj e mgroëél o lrgkoj. ]ebofes quo ftrej peiltos0
5 GNX_]0 peiltos rltoemls pere l roweff1 l mostgnl ç l prùprgl roweff1
5 L_]X_]0 peiltos koremls fliefjonto pofl roweff1 tuml quo e jåqugne roweff onvge1
5 CLR[ERM0 tretej ls peiltos quo vél etrevosser l roweff1 mo uje romo pere lutre,
lnmo nél oxgsto e noiossgmemo mo tremuëél mo onmoroëejontl (rokres mo NE]).
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 173/282
5?;
I e p ê t u f l
; - C g r o w e f f ’ X e r t o 5
]ebofes quo tretej mo NE]0
5 XRORL_]GNK0 peilto ontrenml pofl roweff pere uje romo gntorne, entos me moigsél mo
rltoejontl. Oj suje, e NE] mo 505.
5 XLY]RL_]GNM0 seême mls peiltos me romo etrevçs ml roweff pere e gntornot.
Rokres
Mo clrje lb`otgve, plmo-so mongr uj iln`untl mo rokres pofl iljenml GXtebfos pereroefgzer efkuj tgpl mo eëél oj rofeëél mo uje iljungieëél mo romo (krupl mo peiltos).
Osses rokres sél jentgmes oj idegns o porjenoioj etç uje nlve mongëél ml emjgngs-
tremlr lu rogngigefgzeëél ml sgstoje. _j blj oxojpfl mo rokre sorge bflquoer roqugsgëÿos
lrgunmes ml GX 58.8.8.5 pere e plrte mo mostgnl 48/]IX etrevçs me gntorceio otd5 ilj mostgnl
è prùprge jåqugne Cgroweff.
E sgntexo mosse rokre pere l Gptebfos ie essgj0
# gptebfos -E GNX_]-` MRLX -g otd5 -s 58.8.8.5 -p tip --mplrt 48
Mgento mgssl, tejbçj plmo-so mongr iljl uj iln`untl mo rokres quo ospoigiej
motorjgnemes eëÿos ilnclrjo iereitorêstgies mo uje iljungieëél mo romo o sue mgroëél(lrgkoj/mostgnl).
Ilniogtls mo idegns
Nl Gptebfos, es idegns sél fliegs lnmo sél erjezonemes es rokres ml roweff, lu so`e, ç e
clrje iljl l Gptebfos lrkengze ls irgtçrgls mo moigsÿos prç-mongmes pere l tråcokl mo
peiltos mo uje iljungieëél mo romos. Osse rokres sél gntorprotemes mo clrje tlp-mlwn
(mo igje pere begxl), menml l movgml tretejontl el peilto.
Oxgstoj mlgs tgpls mo idegn0 es netgves, lu so`e, bugft-gn, o es ojbutgmes ’ es perejotrgzemes
o mongmes pofl emjgngstremlr ml sgstoje. Es idegns bugft-gn sél prç-ostebofoigmes nl
prùprgl GXtebfos, onquentl quo es ojbutgmes plmoj sor irgemes/jlmgiemes/rojlvgmespofl emjgngstremlr.
E tebofe Cgftor plssug tràs idegns bugft-gn, quo sél GNX_], L_]X_] o CLR[ERM. So`e l oxojpfl0
# gptebfos -n -F ’t cgftor
Idegn GNX_] (plfgiy EIIOX])
terkot prlt lpt slurio mostgnetgln
Idegn CLR[ERM (plfgiy EIIOX])
terkot prlt lpt slurio mostgnetgln
Idegn L_]X_] (plfgiy EIIOX])
terkot prlt lpt slurio mostgnetgln
Xofl cetl mo sor e tebofe pemrél, nél ç noiossårgl pesså-fe iljl perâjotrl, ilnclrjo oxpfgieml0
# gptebfos ’n ’F
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 174/282
5?4
D e r m o n g n k o j F
g n u x
Idegn Mosirgëél
GNX_] Mostgneme e peiltos iu`l mostgnl e jåqugne cgroweff .
CLR[ERM Mostgneme e peiltos quo etrevossej e jåqugne cgroweff .
L_]X_] Mostgneme e peiltos iu`l lrgkoj ne cgroweff .
]ebofes
]ebofes sél lnmo iej erjezonemes uje lu jegs idegns quo tàj iereitorêstgies sgjgferos.
Oxgstoj tràs tgpls mo tebofes nl Gptebfos0 e tebofe CGF]OR, `å mocgngme, e tebofe NE] (tremuëél
mo onmoroëejontl) o e tebofe Jenkfo (jengpufeëél mo iejpls ml metekreje). Xlmojls
rocoronigå-fes etrevçs ml perâjotrl -t tebofe.
# gptebfos -n -F -t net
Idegn XRORL_]GNK (plfgiy EIIOX])
terkot prlt lpt slurio mostgnetgln
Idegn GNX_] (plfgiy EIIOX])
terkot prlt lpt slurio mostgnetgln
Idegn L_]X_] (plfgiy EIIOX])
terkot prlt lpt slurio mostgnetgln
Idegn XLY]RL_]GNK (plfgiy EIIOX])
terkot prlt lpt slurio mostgnetgln
Idegn Mosirgëél
XRORL_]GNK Mostgneme e peiltos quo proigsej mo tremuëél entos mlrltoejontl, lu so`e, NE] Rovorsl.
XLY]RL_]GNK Mostgneme e peiltos quo proigsej mo tremuëél moplgsml rltoejontl.
L_]X_] Mostgneml e peiltos koremls nl prùprgl cgroweff , jes quo
proigsej mo tremuëél entos ml rltoejontl, lu so`e, uj tgplXrorlutgnk pere peiltos ilj lrgkoj nl prùprgl Cgroweff.
E tebofe Jenkfo ç utgfgzeme oj sgtueëÿos lnmo dluvor e noiossgmemo mo eftoreëÿos ospoigegs
oj peiltos. E tebofe Jenkfo lrgkgnefjonto toj ignils idegns0 XRORL_]GNK, XLY]RL_]GNK,
GNX_], L_]X_] o CLR[ERM. Ne pråtgie, ieme uje mosses idegns ç prliosseme entos me
idegn ilrrosplnmonto ne tebofe ftor o net, pere mongr lpëÿos ospoigegs, iljl, plr
oxojpfl, lpëÿos iljl l ]gpl mo Yorvgël (]LY).
]ebofe ;.5Idegs me
tebofe ftor.
]ebofe ;.2Idegs me
tebofe NE].
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 175/282
5?7
I e p ê t u f l
; - C g r o w e f f ’ X e r t o 5
Iejgndl mo uj peilto nes tebofes o idegns
E kure e sokugr gfustre l uxl o e soquànige mo prliossejontl quo uj peilto sokuo
quenml ontre nl roweff GXtebfos. Lnmo es idegns sél enefgsemes soquonigefjonto mo igje
pere begxl ilnclrjo ç gfustreml ne kure. Uuenml uj peilto ilncoro ilj uje rokre, e
eëél ospoigieme ne rokre ç oxoiuteme nl peilto.
Notwlra
Notwlra
jenkfo ]ebfo
XRORL_]GNK Idegn
net ]ebfo
XRORL_]GNK Idegn(Mostgnetgln NE])
(Ylurio NE] besom ln rlutgnk)
Rlutgnk
Mete clr
tdgs sorvor<Wos Nl
Rlutgnk
stftor ]ebfo
GNX_] Idegn
Flief Xrliossgnk
lc Mete
stftor]ebfo
CLR[ERM Idegn
jenkfo ]ebfo
L_]X_] Idegn
net ]ebfo
L_]X_] Idegn
net ]ebfo
XLY]RL_]GNK Idegn
stftor ]ebfo
L_]X_] Idegn
Cgkure ;.3
Cfuxl o soquànigemo prliossejontl
quo uj peilto
sokuo quenml
ontre nl roweffGXtebfos.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 176/282
538
D e r m o n g n k o j F
g n u x
Iljl emgiglner rokres oj uje idegn
L perâjotrl -E (epponm) ç l rosplnsåvof plr emgiglner rokres ès idegns, lnmo e ðftgje rokre
emgiglneme vge osso iljenml sorå e ðftgje e sor prliosseme, plgs ieme nlve rokre emgigl-
neme veg pere l j me fe.
Ygntexo0 GXtebfos -t tebofe -E idegn Qospoigcgieëél me rokreZ QlpëÿosZ
Oxojpfgieëél mo uje rokre nokenml quefquor peilto GIJX ilj mostgnl e gntorceio fl
(fllpbeia).
# gptebfos -E GNX_] -` MRLX -g fl -p gijp
Lu0
# gptebfos -t cgftor -E GNX_] -` MRLX -g fl -p gijp
Fgstenml (-F) es rokres oj tebofes o idegns
Ilnclrjo `å oxojpfgieml, plmo-so vorgier es rokres etgves oj jojùrge mo tlmes es
idegns mo uje tebofe lu oj uje idegn ospoiêie etrevçs ml perâjotrl -F .
Ygntexo0 GXtebfos -t tebofe -F QidegnZ QlpëÿosZ
Es lpëÿos sél perâjotrls quo sél pessemls pere e ofeblreëél mo uj rokre jegs roneme o
motefdeme. E tebofe jlstre es prgnigpegs lpëÿos0
Lpëél Mosirgëél
-v Jlml vorblso, jlstre gnclrjeëÿos jegs motefdemes slbro erokre.
-n Eprosonte gnclrjeëÿos oj clrjetl nujçrgil, iljl plroxojpfl0 GX o Xlrtes.
-x Oxgbo gnclrjeëÿos ebslfutes.
--fgno-nujbors Oxgbo l nðjorl mo ieme rokre.
Oxojpfgieëél mo uje fgstekoj iljpfote mo gnclrjeëÿos etgves me tebofe Jenkfo0
# gptebfos -t jenkfo -n -F -v --fgno-nujbors
Idegn XRORL_]GNK (plfgiy EIIOX] 5?=? peiaots, 39?A bytos)
nuj pats bytos terkot prlt lpt gn lut slurio
mostgnetgln
Idegn GNX_] (plfgiy EIIOX] 5?=? peiaots, 39?A bytos)
nuj pats bytos terkot prlt lpt gn lut slurio
mostgnetgln
Idegn CLR[ERM (plfgiy EIIOX] 8 peiaots, 8 bytos)
]ebofe ;.9Lpëÿos mes idegns.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 177/282
535
I e p ê t u f l
; - C g r o w e f f ’ X e r t o 5
nuj pats bytos terkot prlt lpt gn lut slurio
mostgnetgln
Idegn L_]X_] (plfgiy EIIOX] 484 peiaots, 328=3 bytos)
nuj pats bytos terkot prlt lpt gn lut sluriomostgnetgln
Idegn XLY]RL_]GNK (plfgiy EIIOX] 423 peiaots, 3999; bytos)
nuj pats bytos terkot prlt lpt gn lut slurio
mostgnetgln
Ls iejpls oxgbgmls ne fgstekoj tàj ls sokugntos sgkngiemls0
Iejpl Mosirgëél
Nuj Nðjorl me rokre ne idegn.
Xats Nðjorl mo peiltos quo betorej ilj e rokre.
Bytos Nðjorl mo bytos rofeiglnemls ilj e rospoitgve rokre.
]erkot L efvl e sor roefgzeml iesl uj peilto ilncgre ilj e rokre.
Xrlt Xrltlilfl treteml pofe rokre irgeme.
Lpt Lpëÿos oxtres pessemes ne rokre g irgeme.
Gn Gntorceio mo ontreme treteme.
Lut Gntorceio mo seême treteme.Ylurio Onmoroël lrgkoj.
Mostgnetgln Onmoroël mostgnl.
Lutres lpëÿos Mojegs iejpls iljpfojonteros, iljl plr oxojpfl0 plrte molrgkoj/mostgnl, jetid quo ostå sonml utgfgzeme.
Epekenml (-M) uje rokre
Ilj l —‚-M‚ ç plssêvof epeker uje idegn mo mues clrjes0 etrevçs ml ênmgio lu nðjorl me
rokre (roprosonteml plr nuj), lu roosirovonml e rokre nlvejonto jes trlienml l
perâjotrl ‖-E‚ lu ‖-G‚ pofl perâjotrl ‖-M‚. So`e ls oxojpfls0
# gptebfos -M GNX_] 4
# gptebfos -t net -M XLY]RL_]GNK ?
# gptebfos -M CLR[ERM -` EIIOX] -s 58.8.8.8/4 -m 5;2.53.8.8/53
Gnsorgnml (-G) uje rokre
Xlssgbgfgte gnsorgr uj rokre oj uje plsgëél mongme oj uje idegn.
]ebofe ;.=Iejpls me
fgstekoj mo
gnclrjeëÿos etgves
me tebofe Jenkfo.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 178/282
532
D e r m o n g n k o j F
g n u x
Ygntexo0 GXtebfos -t tebofe -G idegn QênmgioZ Qospoigieëél me rokreZ QlpëÿosZ
# gptebfos -G CLR[ERM 9 -j steto --steto NO[ -m 58.8.8.8/8 -` EIIOX]
Yubstgtugnml (-R) uje rokre
Cuniglne mo clrje sgjgfer è gnsorëél mo rokre, jes ilj l prlpùsgtl mo substgtugr uje motor-
jgneme rokre. Sgmo oxojpfls0
# gptebfos -R L_]X_] 5? ’` EIIOX] -l otd8 -p gijp --gijp-typo oidl-
roquost
# gptebfos -R GNX_] 53 ’̀ EIIOX] -g otd8 -p gijp --gijp-typo
oidl-ropfy
Irgenml uje nlve (-N) idegn
E plssgbgfgmemo mo irger idegn prlplriglne e lplrtungmemo mo l emjgngstretlr irger roweffs
jegs errl`emls o oigontos, plgs plmo irger idegns pere treter sgtueëÿos ospoiêies. L perâ-
jotrl utgfgzeml pere irger uje nlve idegn ç l -N, ilnclrjo gfustreml0
Ygntexo0 GXtebfos -t tebofe -N QnljoZ
Epùs e irgeëél, e idegn plmo sor jengpufeme iljl quefquor lutre idegn, iljl gnsorgr,
rojlvor, substgtugr lu emgiglner0
# gptebfos -N MRLX\NO]
# gptebfos -E MRLX\NO] -` MRLX -g otd8 -s 5;2.53.8.8/53
# gptebfos -E MRLX\NO] -` MRLX -g otd8 -s 5;2.5;.8.8/53
_je voz mongml quef sorå l tretejontl el peilto ne rospoitgve idegn, movo-so irger uje
rokre ne tebofes prgnigpegs pere quo l uxl mo tretejontl so`e mosvgeml pere e idegn irgeme.
# gptebfos -E GNX_] -` MRLX\NO] ’s 5;2.53.8.8/53
# gptebfos -E GNX_] -` MRLX\NO] ’s 5;2.53.8.8/53
Ronljoenml (-O) uje idegn
Xlmo-so ronljoer l nljo mo uje idegn etrevçs ml perâjotrl ‖-O‚0
Ygntexo0 GXtebfos -t tebofe -O Qnljo-oxgstontoZ Qnlvl-nljoZ
Gssl sù ç plssêvof pere idegns irgemes, o nél so epfgie ès idegns pemrél ml GXtebfos.
Epeker (-C) es rokres mo uje idegn
Oxgstoj mues jenogres mo epeker es rokres oxgstontos oj uje idegn0 lu epekejls es
rokres mo ieme idegn gnmgvgmuefjonto lu epekej-so tlmes es rokres mes idegns oxgstontos
oj uje tebofe.
# gptebfos -t cgftor -C MRLX\NO]
# gptebfos -t cgftor -C
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 179/282
539
I e p ê t u f l
; - C g r o w e f f ’ X e r t o 5
Porenml (-P) ilntemlros mo idegns
L roiursl mo ilntebgfgmemo mo peiltos prliossemls pofes idegns plmo sor jugtl gntoros-
sento pere emjgngstremlros quo moso`ej tor uje vgsél ostetêstgie e pertgr mo gnclrjeëÿos
ml roweff. Osso roiursl ç etgveml plr pemrél o plmo sor ilnsufteml ilj l usl ml -v lu -x
ne fgstekoj mo rokres mo uje idegn. Xere rogngigefgzer ls ilntemlros, plmo-so user l perâ-
jotrl ’P, ilnclrjo gfustreml0
# gptebfos -P GNX_]
# gptebfos -t jenkfo -P L_]X_]
Oxifugnml (-T) idegns irgemes plr usuårgls
Uuenml moso`ejls oxifugr idegns irgemes pofl emjgngstremlr gnmgvgmuefjonto lu tlmes es
oxgstontos oj uje tebofe0
# gptebfos -t tebofe -T
# gptebfos -t tebofe -T MRLX\NO]
Xlfêtgie båsgie
E plfêtgie båsgie, tejbçj idejeme mo plfêtgie pemrél, toj iljl lb`otgvl mongr quef l
tretejontl ml peilto iesl ofo nél ilnre ilj quefquor rokre oj uje idegn. Ifessgiejonto
oxgstoj mlgs jlmls, l jlml porjgssgvl o l jlml rostrgtgvl.
5 Jlml porjgssgvl (EIIOX])0 l roweff ç mongml pere eiogter quefquor peilto iesl l
peilto nél tonde sgml treteml plr quefquor lutre rokre1
5 Jlml rostrgtgvl (MRLX)0 roweff ç mongml pere noker quefquor peilto iesl l peilto
nél tonde sgml treteml plr quefquor lutre rokre.
Nl Gptebfos es rokres pemrél sél mongmes pofl iljenml -X0
# gptebfos ’X GNX_] MRLX
# gptebfos ’X L_]X_] MRLX
# gptebfos ’X CLR[ERM MRL
Ospoigcgienml gntorceios mo ontreme o seême
Ls perâjotrls -g o -l monoj gntorceios mo ontreme (lrgkoj) o seême (mostgnl), rospoitgve-
jonto, pere ls peiltos mo romo. Yue sgntexo flnke pere ossos perâjotrls sél --gn-gntorceio
o --lut-gntorceio. Ne irgeëél mo rokres jegs rostrgtgves e uj motorjgneml uxl mo peiltos, e
perejotrgzeëél me gntorceio ç uj roiursl jugtl ðtgf.
Ontrotentl, noj tlme idegn eiogte ls mlgs perâjotrls sgjuftenoejonto, lu so`e, toj mo
so fover oj ilnsgmoreëél l uxl mo peiltos, plgs nél toj sontgml plr oxojpfl ospoigier
uje gntorceio mo seême ne idegn GNX_] me tebofe ftor quo veg treter l uxl mo ontreme mo
peiltos. E tebofe e sokugr cez uje rofeëél me plssgbgfgmemo mo utgfgzeëél mls perâjotrls -g o -l
oj tlmes es idegns.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 180/282
53=
D e r m o n g n k o j F
g n u x
]ebofe Idegn Gntorceio Ontreme (-g) Gntorceio Yeême (-l)
Cgftor GNX_] YGJ NÉL
CLR[ERM YGJ YGJ
L_]X_] NÉL YGJ
Net XRORL_]GNK YGJ NÉL
XLY]RL_]GNK NÉL YGJ
L_]X_] NÉL YGJ
RE[ XRORL_]GNK YGJ NÉL
L_]X_] NÉL YGJ
Jenkfo GNX_] YGJ NÉL
CLR[ERM YGJ YGJ
L_]X_] NÉL YGJ
XRORL_]GNK YGJ NÉL
XLY]RL_]GNK NÉL YGJ
E tebofe REJ sù plmo sor useme nes idegns XRORL_]GNK o L_]X_]. Nél då suplrto
pere lutres idegns plrquo osse clrje mo tretejontl sù ç noiossårge uje voz quo
ossos sél ls ðngils fukeros oj quo so plmo fgmer ilj ls peiltos entos quo ofos
roefjonto coidoj uje trgfde mo ilnoxél.
Xrlplste mo rokres
q5 _sl ml Gptebfos pere ilnkurer uje jåqugne ilj ls sorvgëls mo roweff o Xrlxy [ob.
5 Xlmo cezor l pepof mo roweff mo crlntogre mo uje poquone lu krenmo romo.
Osto iepêtufl torå iljl lb`otgvl tejbçj prgjogrl ilniogtuer o oxojpfgier l usl ml
Gptebfos pere ilnkurer uje jåqugne ilj ls sorvgëls mo roweff o Xrlxy [ob. Nlrjef-
jonto, uj sorvgmlr ilnkureml pere osse nefgmemo plmo cezor l pepof mo roweff mo
crlntogre mo uje poquone lu josjl krenmo romo1 mosse clrje, plmorå ftrer tlml l
tråcokl me gntornot pere e romo gntorne, o me romo gntorne pere e gntornot. @å uj prlxy plmo
sor utgfgzeml iljl cgftrl mo ilntoðml wob.
E jotlmlflkge utgfgzeme pere e gjpfojonteëél ml roweff sorå e sokugnto0 grojls ‖noker‚
tlml l tråcokl pere es IDEGNY mo GNX_], L_]X_] o CLR[ERM me tebofe ftor o, plsto-
rglrjonto, l koronto mo ]G nls pesserå e rofeëél mls sorvgëls quo movoj sor fgboremls nl
Cgroweff, l quo idejerojls mo oxioëÿos. ]lml l tråcokl mo peiltos quo es jgndes oxioëÿos
nél ilbrgroj osterél bflquoemls plr pemrél. Oj suje, l quo nél clr ligefjonto porjg-
tgml ̀ å ostå oxprossejonto nokeml. Xere nefgzer, ç gntorossento quo ceëejls uje eumgtlrge
oj igje mo tontetgves mo gntrusél o verromures quefgiemes iljl rokres mo ilntrlfo.
]ebofe ;.?Lpëÿos mo idegnspere ieme tebofe ml
Notftor.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 181/282
53?
I e p ê t u f l
; - C g r o w e f f ’ X e r t o 5
Lrkengzeëél mes plfêtgies
Xlfêtgies båsgies
O x i o
ë ÿ o s I
l n t r l
f o
s
Es plfêtgies båsgies pere l roweff sél tretemes plr ðf tgjl moplgs quo l peilto pesser tlmes
es plfêtgies mongmes nes lutres idegns1 tlmevge, ofes sél mongmes prgjogrl pere moplgs
soroj mongmes es idegns mo plfêtgies mo oxioëÿos o ls ilntrlfos.
Xerto-so ml prgniêpgl mo quo sou sgstoje Fgnux ostå movgmejonto ilnkureml, lu so`e, uj
dermongnk rostrgtgvl clg oxoiuteml nl sorvgmlr o l suplrto e GXtebfos ostå gjpfojonteml.
Xere tlrner l ostuml jegs mgmåtgil, gngigefjonto sorél ilniogtuemes es plfêtgies mgvgmgnml-es oj0
5 Båsgies0 gnorontos e tretejontls me beso ml roweff, lu pertgrojls ml prgniêpgl mo noker
tuml l quo nél ç porjgtgml, `å quo ostå oxprossejonto nokeml1
5 Oxioëÿos0 sorél tlmes es plfêtgies mostgnemes e porjgtgr efkuj tgpl mo eiossl1
5 Ilntrlfos0 sél plfêtgies quo vél plssgbgfgter e koreëél mo rokgstrls mo ovontls, lu so`e,
tlmes e plfêtgies mgrotejonto vgniufemes e flks.
Gngigefjonto, pertgr pere tràs idegns båsgies, nokenml quefquor eiossl pere GNX_], L_X_] o
CLR[EM. Xere gssl, userojls l iljenml -X.
gptebfos -X GNX_] MRLX
gptebfos -X L_]X_] MRLX
gptebfos -X CLR[EM MRLX
Oxgsto e plssgbgfgmemo mo, oj voz mo noker uj peilto (MRLX), ro`ogtå-fl (RO@OI]), l quo nél
epfgie es rokres båsgies lnmo sljonto plmo-so lu eiogter lu noker1 ontrotentl, ç våfgml
fojbrer quo l etl mo ro`ogter peiltos toj l iustl mo quo pere ieme peilto ro`ogteml ç
onvgeme uje rosplste pemrél GIJX ml tgpl GIJX9/9.
Yokugnml e josje fùkgie, so clr moso`eml tor uj sorvgmlr tltefjonto porjgssêvof mo clrje sugigme
ne gntornot, besterge mofgjgter es plfêtgies båsgies eiogtenml quefquor ilnoxél, l quo ilj iortoze
oj jljontl efkuj ç roiljonmåvof1 tlmevge, tef ionårgl plmorge sor mongml essgj0
gptebfos -X GNX_] EIIOX]
gptebfos -X L_]X_] EIIOX]
gptebfos -X CLR[EM EIIOX]
Rokres emgiglnegs e rokres båsgies
Ilj e plfêtgie båsgie pere tràs idegns xemes oj ‖mrlp‚, lu so`e, mosiertenml sgfoniglse-
jonto peiltos, torêejls uj sorvgmlr sokurl. Osto nél osterge roiobonml nonduj peilto,
jes plr lutrl feml tejbçj nél osterge onvgenml neme. Ojblre sokurl, nél toj sontgml o
nél ç l quo so moso`e, jes osse ç e plfêtgie båsgie roiljonmeme pere ilnstruëél mo roweff1
Cgkure ;.;
Moplgs mes plfêtgies
mongmes oj lutresidegns, es plfêtgies
båsgies.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 182/282
533
D e r m o n g n k o j F
g n u x
essgj, e pertgr mosso jljontl, l emjgngstremlr plmo emgiglner plfêtgies mo oxioëÿos mo
clrje gnirojontef, lu so`e0 ne lrmoj oj quo clroj emgiglnemes, ofes sorél tretemes pofl
aornof ml Fgnux o plstorglrjonto plfêtgies mo ilntrlfos pere jltgver rokgstrl mo ovontls
(flks) gnmoso`emls, plgs josjl `å nokemls, ç roiljonmåvof tor l ilntrlfo slbro es lilrràn-
iges pere ns mo eumgtlrge o evefgeëél me sokurenëe.
Ç gjplrtento fojbrer quo mo uje clrje koref e ilnstruëél mo rokres mo roweff sél cunme-
jontemes nes ‖plfêtgies båsgies‚, sonml es rokres mo oxioëél o ilntrlfos (flks) quo treterélble perto ml tråcokl mo romos. Lilrrorå tejbçj e noiossgmemo mo treter egnme essgj es
oxioëÿos. Oxojpfl0 l emjgngstremlr fgborer iljungieëél v ge prltlilfl GIJX, jes josjl
essgj sorå noiossårgl mgzor quef l tgpl mo GIJX o tefvoz e quentgmemo.
Osso ðftgjl oxojpfl retgie e noiossgmemo mo uje enåfgso motefdeme ml quo toj mo so cezor
o tejbçj l jofdlr usl me correjonte. ]or uj roweff ilj uj krenmo nðjorl mo rokres
nél mono so ç blj lu rugj. Uueso sojpro so l nðjorl mo rokres ç jugtl krenmo ç boj
prlvåvof quo jugte ilgse plmo sor ltgjgzeme.
Efçj ml quo `å clg joniglneml, oxgsto e noiossgmemo mo treter jofdlr uj motorjgneml
metekreje lu josjl roosirovor uj motorjgneml iejpl mo uj prltlilfl.
Cgroweffs tejbçj sél rosplnsåvogs pofe rofeëél mo GXs våfgmls ne gntornot vorsus ls nél
rltoåvogs quenml e iljungieëél ç besoeme oj GXv=, lu so`e, roiursls ilj XE] o NE] quo
sorél oxpfgiemls nl iepêtufl 4.
O, plr j, l ilntrlfo mo Benme pesse sor uje cunëél quo oj jugtls jljontls plmo o
movo sor iljbgneme ilj es iepeigmemos ml Cgroweff utgfgzeml. E pgrâjgmo e sokugr gfustrer
ossos ilniogtls o e gntor-rofeëél ontro ofos.
Befenioejontl
mo ierke
Xlfêtgies mo NE]
Xlfêtgies båsgies
Jengpufeëél mo metekrejes
]retejontl mes oxioëÿos
Oxioëÿos Ilntrlfos
Osse eëél plmo sor eutljetgzeme, o ç l gmoef. Mosse clrje, sokuo uje oxojpfgieëél mo
uj sirgpt monljgneml mrlp.sd pere mongr e plfêtgie pemrél0
Xlfêtgies båsgies
# vg mrlp.sd
# ./mrlp.sd
Cgkure ;.4
Ilntrlfo mo Benme.
Cgkure ;.7
Mongnml eplfêtgie båsgie.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 183/282
53;
I e p ê t u f l
; - C g r o w e f f ’ X e r t o 5
Xere fgjper es rokres oj tlmes es idegns o vlfter ilj e plfêtgie pemrél EIIOX], ogs uj
oxojpfl mo sirgpt quo iustljgze e teroce. Ofo clg monljgneml ilj l nljo ‖fgjpe.sd‚.
# vg fgjpe.sd
#!/bgn/besd
XC:$(wdgid GXtebfos)
gc Q -z $XC Z 1 tdon
oidl ‖Iljenml GXtebfos nel onilntreml‚
oxgt
cg
noke ()
{
$XC -X GNX_] MRLX
$XC -X L_]X_] MRLX
$XC -X CLR[ERM MRLX
}
noke
#!/bgn/besd
XC:$(wdgid GXtebfos)
gc Q -z $XC Z 1 tdon
oidl ‖Iljenml GXtebfos nel onilntreml‚
oxgt
cg
fgjpe ()
{
$XC -C
$XC -X GNX_] EIIOX]
$XC -X L_]X_] EIIOX]
$XC -X CLR[ERM EIIOX]
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 184/282
534
D e r m o n g n k o j F
g n u x
}
fgjpe
Nlrjefjonto, gngige-so uj sirgpt mongnml e sdoff quo gntorproterå l sou ilntoðml1 tlmevge,
e fgnde #!/bgn/besd nél ç gnsorgme, es gnstruëÿos ml sirgpt sél gntorprotemes pofe sdoff
ilrronto lu plmo sor mongme e sdoff murento e oxoiuëél, proiomonml l nljo ml sirgpt pofe
sdoff moso`eme ilnclrjo oxojpfl gfustretgvl0 ‖# besd sirgpt.sd‚
Oxojpfl mo uj sirgpt pere vgsuefgzer es plfêtgies ne tebofe CGF]OR, monljgneml iljl stetus.sd0
# vg stetus.sd
XC:$(wdgid GXtebfos)
gc Q -z $XC Z 1 tdon
oidl ‖Iljenml GXtebfos nel onilntreml‚
oxgt
cg
vor ()
{
$XC -nF -t cgftor
}
vor
# ./stetus.sd
Iljl clg mongml l jlml rostrgtgvl nes plfêtgies båsgies, lu so`e, clg coideml (MRLX) pere
tlmes es idegns quo monoj es plfêtgies båsgies ml roweff, sorå noiossårgl irger plfêtgies
mo oxioëÿos, lu so`e, rokres mo fgboreëél (EIIOX]), pere e iljungieëÿos prç-mongmes
pofl emjgngstremlr.
O x i o
ë ÿ
o s
Xere jofdlr ilntoxtuefgzer, sorå prlplstl uj ionårgl lnmo moso`ejls e oxoiuëél ml
iljenml pgnk . Mosse clrje, ç gntorossento sojpro fgborerjls e seême o e ontreme mo memls
pere e prùprge jåqugne1 pere tentl, tojls e gntorceio fllpbeia ‖fl‚.
gptebfos -E GNX_] -g fl -m 52;.8.8.5 -̀ EIIOX]
gptebfos -E L_]X_] -l fl -s 52;.8.8.5 -` EIIOX]
Cgkure ;.58
Rokres mo fgboreëél
(EIIOX]).
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 185/282
537
I e p ê t u f l
; - C g r o w e f f ’ X e r t o 5
Ilj osse plfêtgie, e jåqugne ilnsokuo roefgzer ‖pgnk‚ e sg prùprge, lu so`e, lrgkoj o mostgnl
ne prùprge jåqugne.
Oxojpfl mo sirgpt mo iustljgzeëél pere mongr uje plfêtgie pere e gntor ceio mo fllpbeia0
fl
# vg fllp.sd
XC:$(wdgid GXtebfos)
gc Q -z $XC Z 1 tdon
oidl ‖Iljenml GXtebfos nel onilntreml‚
oxgt
cg
FL:‚52;.8.8.5‚
fllp ()
{
$XC -E GNX_] -g fl -m $FL -` EIIOX]
$XC -E L_]X_] -l fl -m $FL -` EIIOX]
}
fllp
# ./fllp.sd
Jes osse plfêtgie entorglr ç oklêste, plgs sù plssgbgfgte ‖pgnker‚ l prùprgl dlst, jes nonduj
dlst lu josjl lutres gntorceios ml prùprgl dlst. Ilnsgmoro quo ostå mongml l GX 58.8.8.5
ne gntorceio otd8 o moso`e-so quo l sorv gmlr so`e iepez mo oniejgnder e ilnsufte mo pgnk
pere quefquor lutrls dlst. Mosse clrje, ç noiossårgl emgiglner plfêtgies pere oidl-rosquost
o oidl-ropfy
# gptebfos -E GNX_] -` EIIOX] -p gijp --gijp-typo 8 -m 58.8.8.5 -s8/8 ’g otd8
# gptebfos -E L_]X_] -` EIIOX] -p gijp --gijp-typo 4 -s 58.8.8.5 -m
8/8 ’l otd8
Yokuo uje iustljgzeëél oj sirgpts sdoff pere etgver e plfêtgie mo pgnk pofe gntorceio otd8.
# vg pgnk2.sd
XC:$(wdgid GXtebfos)
Cgkure ;.55
Xlfêtgie pere
e gntorceio mo
fllpbeia.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 186/282
5;8
D e r m o n g n k o j F
g n u x
gc Q -z $XC Z 1 tdon
oidl ‖Iljenml GXtebfos nel onilntreml‚
oxgt
cg
O]D8:‚58.8.8.5‚
pgnk2()
{
GXtebfos -E GNX_] -̀ EIIOX] -p gijp --gijp-typo 8 -m $O]D8 -s 8/8 ’g
otd8
GXtebfos -E L_]X_] -` EIIOX] -p gijp --gijp-typo 4 -s $O]D8 -m 8/8
’l otd8
$XC -E GNX_] -g fl -m $FL -` EIIOX]
$XC -E L_]X_] -l fl -m $FL -` EIIOX]
}
pgnk
# ./pgnk2.sd
Yokugjls osse fùkgie pere irger uje plfêtgie mo oxioëél pere quo so`e plssêvof treëer rltes
usenml l iljenml jtr ml Fgnux, quo ç uje correjonte mo treiorluto quo utgfgze gijp(oniejgnde peiltos oidl-roquost). Xlrçj, sebojls quo ofo utgfgze uje tçingie sgjpfùrge,
egnme quo jegs cuniglnef, pere onvger peiltos gijp oidl-rosquost ilj veflros mo t tf, ls
quegs ieuserél e jlrto sðbgte ml peilto ieme voz quo pesseroj plr uj rltoemlr, fojbrenml
quo l etosteml mo ùbgtl ml peilto ç l gijp mo tojpl oxiomgml (tgjo-oxiomom) tgpl 55.
Nlssl lb`otgvl sorge fgborer e oxoiuëél ml iljenml jtr gp.gp.gp.gp e pertgr me jåqugne
58.8.8.5. Iljl e seême mo gijp oidl-rosquost `å clg fgboreme entorglrjonto, sgjpfosjonto
besterge eiogter GIJX tgpl 55
Oxojpfl0
gptebfos -E gnput -̀ EIIOX] -p gijp --gijp-typo 55 -m 8/8 -g otd8Oxojpfl mo sirgpt pere mocgngr plfêtgies pere plmor utgfgzeëél ml
prlkreje jtr0
XC:$(wdgid GXtebfos)
gc Q -z $XC Z 1 tdon
oidl ‖Iljenml GXtebfos nel onilntreml‚
oxgt
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 187/282
5;5
I e p ê t u f l
; - C g r o w e f f ’ X e r t o 5
cg
NO]:‚8/8‚
O]D8:‚572.534.288.4‚
jtr ()
{
$XC -E GNX_] -p gijp --gijp-typo 55 -s $NO] -m $O]D8 -` EIIOX]
}
jtr
# ./jtr.sd
Ilj e rokre mo GIJX 55 etgve ç plssêvof treëer rltes ilj jtr tonml iljl efvl uj nðjorl
GX1 tlmevge, so moso`er cezor l josjl ilj l treiorluto ml Fgnux, sebonml quo ofo utgfgze
peiltos _MX tonml iljl mostgnl plrtes eftes, mojenme-so irger uje plfêtgie mo oxioëél.
Nosso iesl, plr so treter mo uj prltlilfl mo trensplrto, tojls mo trebefder ilj es
plrtes lrgkoj (--splrt) o ilj es plrtes mostgnl (--mplrt). Mgento mosso ionårgl, ie iferl
quo ç noiossårgl ebrgr uje oxioëél pere e iljungieëél mo peiltos _MX. Movo-so tejbçj
fover oj ilnsgmoreëél quo l treiorluto ml Fgnux trebefde mo clrje gnirojontef pere e
plrte mostgnl, el gngiger ilj l veflr mo plrte efte e pertgr 99=9?, gnirojontenml oj rezél
mgrote els nðjorls mo dlps (seftls) o use e josje plrte mo lrgkoj, e quef, quenml ç
mongme, eiebe sonml uje plrte fgvro eigje mo 582=. Mgento mgssl, e rokre movorå etonmor
e tlmls ossos motefdos.
Oxojpfl
# gptebfos -E GNX_] -p 5; -s 58.8.8.5 --splrt 582=03??9? -m 8/8
--mplrt 99=9?099=3? -` EIIOX]
L veflr 5; ç rocoronto el prltlilfl _MX, vgmo /oti/prltlilfs).
Oj suje, sonml fgboreml l renko mo 99=9? e 99=3?, l quo må uj tltef mo 98 seftls, l su-
igonto pere mer vårges vlftes ne gntornot.
Gjekgno quo ç moso`eml rosplnmor e slfgigteëÿos ml iljenml pgnk lutrls dlsts. Xlmo-so
irger uje plfêtgie pere l pgnk me sokugnto clrje0 irge-so uje plfêtgie mo oxioëél pere e
seême mo peiltos gijp oidl-ropfy (tgpl 8) o pere mo ontreme mo gijp oidl-roquost (tgpl 4).
Ilnsgmorenml e jåqugne oj quostél ilj l GX 58.8.8.5.
Oxojpfls0
# gptebfos -E GNX_] -` EIIOX] -p gijp --gijp-typo 4 -m 58.8.8.5 -s 8/8
# gptebfos -E L_]X_] -` EIIOX] -p gijp --gijp-typo 8 -s 58.8.8.5 -m 8/8
Essgj, clrej irgemes mues oxioëÿos, uje pere e seême mo peiltos mo GIJX, quo ç gmontg-
ieml iljl prltlilfl tgpl 5 (vgmo e tebofe iljpfote /oti/prltlilfs), iu`l mostgnl ç e jgnde
jåqugne, gnmgieme plr -s quo fojls ilj slurio, lu so`e, lrgkoj o mostgnl sél gnmgiemls
ilj ’m, o ostél sonml eiogtes.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 188/282
5;2
D e r m o n g n k o j F
g n u x
582=03??9?
?9
Oxojpfl mo sirgpt mo eutljeëél monljgneml pgnk\rosplnso.sd pere fgborer e ontreme mo
peiltos GIJX oidl roquost o e seême mo peiltos GIJX oidl ropfy0
# vg pgnk\rosplnso.sd
XC:$(wdgid GXtebfos)
gc Q -z $XC Z 1 tdon
oidl ‖Iljenml GXtebfos nel onilntreml‚
oxgt
cg
NO]:‚8/8‚
O]D8:‚572.534.288.4‚
pgnk\rosplnso ()
{
$XC -E GNX_] -p gijp --gijp-typo 8 -s $NO] -m $O]D8 -` EIIOX]
$XC -E L_]X_] -p gijp --gijp-typo 4 -s $O]D8 -m $NO] -` EIIOX]
}
pgnk
# ./pgnk\rosplnso.sd
Jes nes plfêtgies mo oxioëél ̀ å oxojpfgiemes pere treëer es rltes oxgsto uje fgjgteëél.
Movgml è plfêtgie båsgie mo MRLX, nél ç plssêvof cezor nonduje roslfuëél mo nljo, lu so`e,
etç l jljontl l treiorluto ostå fgboreml sljonto pere GX, nél sonml plssêvof etç ontél
cezor uj jtr lu treiorluto pere uj www.mljgngl.ilj.br. Xere quo gssl so`e plssêvof,
movo-so fgborer ilnsuftes MNY vge _MX ne plrte mo sorvgmlr, quo plr pemrél ç ?9, pere e
jåqugne oj quostél, e j mo quo oste plsse cezor e roslfuëél mo nljos. Oxojpfls0
Gptebfos -E L_]X_] -p 5; -s 58.8.8.5 - -splrt 582=03??9? -m 8/8 -
-mplrt ?9 -` EIIOX]
Gptebfos -E GN]X_] -p 5; -m 58.8.8.5 - -mplrt 582=03??9? -s 8/8 -
-splrt ?9 -` EIIOX
Oxojpfl mo sirgpt monljgneml mns.sd pere quo so`e so iljungier ilj sorvgmlros MNY0
# vg mns.sd
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 189/282
5;9
I e p ê t u f l
; - C g r o w e f f ’ X e r t o 5
XC:$(wdgid GXtebfos)
gc Q -z $XC Z 1 tdon
oidl ‖Iljenml GXtebfos nel onilntreml‚
oxgt
cg
NO]:‚8/8‚
O]D8:‚58.8.8.5‚
XE:‚582=03??9?‚
mns ()
{
$XC -E GNX_] -p 5; -s $NO] --splrt ?9 -m $O]D8 --mplrt $XE -` EIIOX]
$XC -E GNX_] -p 5 --gijp-typo 9 -s $NO] -m $O]D8 -` EIIOX]
$XC -E L_]X_] -p 5; -s $O]D8 --splrt $XE -m $NO] --mplrt ?9 -`
EIIOX]
}
mns
# ./mns.sd
Fgboreëél, ontreme o seê me mo sorvgëls ]IX o _MX, soj l ilntrlfo mo osteml mo ilnoxél lu
ilntrlfo mo peiltos rofeiglnemls rospoitgvejonto, ç uje clrje sgjpfgste mo cezor trete-
jontl ml uxl mo peiltos mo iljungieëél mo romos, lu so`e, josjl sonml uj l Gptebfos,
uj l roweff ml tgpl Ytetocuff, sél rokres ml tgpl Xeiaot Cgftor.
Yokuo uj oxojpfl mo rokre mo ifgonto essujgnml l 58.8.8.5 pere l sor vgël plrtjep iu`e
plrte pemrél ç 555. Yokuo e josje fùkgie mo sorvgëls ]IX0 l ifgonto so ilnoite oj uje
plrte mo sorvgël tonml e rosplste oj uje plrte efte fgvro0
gptebfos -E G,NX_] -̀ EIIOX] -m 58.8.8.5 -p ump --splrt 555 --mplrt582=03??9?
gptebfos -E L_]X_] -̀ EIIOX] -s 58.8.8.5 -p ump --splrt 582=03??9?
--mplrt 555
Ilnsgmorenml uje rokre, sonml e jåqugne ilj e rokre mo roweff o uj sorvgmlr0
gptebfos -E GNX_] -̀ EIIOX] -m 58.8.8.5 -p ump --splrt 555 --mplrt
582=03??9?
gptebfos -E L_]X_] -̀ EIIOX] -s 58.8.8.5 -p ump --splrt 582=03??9?
--mplrt 555
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 190/282
5;=
D e r m o n g n k o j F
g n u x
Ilnsgmorenml e rokre quo plssgbgfgte iljungieëél ilj l sorvgël MNY `å emgiglneme, plmo-so
oxoiuter e roslfuëél mo nljos. Ilntgnuenml e fùkgie mo roweff, `å quo ç plssêvof treëer
rltes o roslfvor nljos, beste eklre fgborer e nevokeëél wob roefgzeme etrevçs ml prltlilfl
dttp, l quef ç trensplrteml vge ]IX o, plr pemrél, utgfgze e plrte mo sorvgmlr 48.
Gptebfos -E L_]X_] -̀ EIIOX] -p 3 -s 58.8.8.5 --splrt 582=03??9?
-m 8/8 - -mplrt 48
Gptebfos -E GNX_] -̀ EIIOX] -p 3 -m 58.8.8.5 --mplrt 582=03??9?
-s 8/8 - -splrt
582=03??9?
48
Oxojpfl mo sirgpt monljgneml dttp.sd pere eutljetgzer rokres pere eiosser sorvgmlros wob0
# vg dttp.sd
XC:$(wdgid gptebfos)
gc Q -z $XC Z 1 tdon
oidl ‖Iljenml gptebfos nel onilntreml‚
oxgt
cg
NO]:‚8/8‚
O]D8:‚58.8.8.5‚
XE:‚582=03??9?‚
dttp ()
{
$XC -E L_]X_] -p 3 -s $O]D8 --splrt $XE -m $NO] --mplrt 48 -` EIIOX]
$XC -E GNX_] -p 3 -s $NO] --splrt 48 -m $O]D8 --mplrt $XE -` EIIOX]
}dttp
# ./dttp.sd
]lme fùkgie mo plfêtgies quo epfgiejls equg mgz rospogtl e uje ðngie jåqugne, uj ilniogtl
mo roweff dljo1 jes es plfêtgies plmoj sor tremuzgmes pere uje sgtueëél mo romo, l quo
cerojls e sokugr.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 191/282
5;?
I e p ê t u f l
; - C g r o w e f f ’ X e r t o 5
Ilj ilniogtl mo plfêtgies mo oxioëél, plmo-so irger oxioëÿos pere ls prltlilfls jegs utg-
fgzemls. Es oxioëÿos e sokugr pertgrél ml prgniêpgl mo quo e jåqugne ç uj ifgonto. So`ejls
oxojpfls mo plfêtgies mo oxioëél pere ls prltlilfls YJ]X, XLX9, GJEX, ]OFNO], YYD, C]X,
D]]XY, D]]X, ilnsgmorenml l dlst 58.8.8.5 iljl dlst ifgonto.
Yorvgël - YJ]X (plrte 2?) o plrte ?4;
gptebfos -E GNX_] -̀ EIIOX] -m 58.8.8.5 -p tip --splrt 2? --mplrt582=03??9?
gptebfos -E L_]X_] -̀ EIIOX] -s 58.8.8.5 -p tip --splrt 582=03??9?
--mplrt 2?
gptebfos -E GNX_] -̀ EIIOX] -m 58.8.8.5 -p tip --splrt ?4; --mplrt
582=03??9?
gptebfos -E L_]X_] -̀ EIIOX] -s 58.8.8.5 -p tip --splrt
582=03??9? --mplrt ?4;
Jumenml mo plntl mo vgste, gjekgno-so mosonvlfvonml uj roweff pere uje jåqugne
quo veg mgsplngbgfgzer vårgls sorvgëls ’ essuje-so pere ns mgmåtgils, plgs uje jåqugne‖juftgusl‚ nél ç roiljonmåvof1 quenml prl`otej-so sorvgmlros, ç noiossårgl tor oj jonto
l ilniogtl mo Bestgln Dlst, plgs ilnsgsto oj prlbfojes mo sokurenëe oj uje jåqugne
o roðno vårgls sorv gëls `untls, pofl mo cetl mo uj sorvgël iljprljotgml plmor sgkngier
tlmls ls mojegs tejbçj iljprljotgmls. ]lmevge, pere gfustrer e fgboreëél mo sorv gëls vge
roweff pere ifgontos, sorå essujgml quo l dlst oj quostél moso`e fgborer pere quefquor
ifgonto ls rospoitgvls sorvgëls0
Yorvgmlr wob (plrte 48)
gptebfos -E GNX_] -̀ EIIOX] -m 58.8.8.5 -p tip --splrt 582=03??9?
--mplrt 48
gptebfos -E L_]X_] -̀ EIIOX] -s 58.8.8.5 -p tip --splrt 48 --mplrt
582=03??9?
Es plfêtgies entorglros movoj sor utgfgzemes iljl beso pere uj roweff dljo pere ieme
sorvgmlr, nokenml tlmls ls eiossls plssêvogs, oxiotl l ml sorvgël quo l sor vgmlr lcoroio.
Nosso oxojpfl, nél ilfliejls plrtes ossonigegs iljl 29 (tofnot) o 22 (ssd), plr soroj sor-
vgëls mo flkgn rojltl, o prlpljls oj nlsses plfêtgies mo roweff sorjls jegs rostrgtgvls,
fgborenml eiossl e sorvgëls mosso nêvof sljonto e GXs ilndoigmls.
_je plfêtgie gntorossento ç fgborer sorv gëls ospoiêils sljonto pere GXs ospoiêils. L
quo quorojls ç fgborer sor vgëls ilj YYD, [OBJGN, N]LX, YNJX, NOYY_Y sljonto pere es
jåqugnes ‖ejgkes‚, gjplssgbgfgtenml el jåxgjl e oxpflreëél mosso tgpl mo sorvgël.
Xere iljproonmor jofdlr, ilnsgmoro e jåqugne 572.534.58.5 iljl e jåqugne ml emjgngs-
tremlr, o 58.8.8.5 iljl uje jåqugne rojlte ilnåvof. So`e ls oxojpfls.
Fgborenml rostrgtgvejonto l YYD0
gptebfo -E GNX_] -s 58.8.8.5 --splrt 582=03??9? -m 572.534.58.5
--mplrt 22 -` EIIOX]
gptebfo -E L_]X_] -m 58.8.8.5 --mplrt 582=03??9? -s 572.534.58.5
--splrt 22 -̀ EIIOX]
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 192/282
5;3
D e r m o n g n k o j F
g n u x
Ilj es plfêtgies igtemes, `å ç plssêvof ponser oj uj roweff mo crlntogre ontro mues lu jegs
romos. Xere jofdlr ilntoxtuefgzer e sgtueëél, essuje uj ionårgl lnmo ç noiossårgl fgborer
l ropesso mo peilto ontro mues romos fliegs 572.534.58.8/2= o 58.8.8.8/4, suplnml quo osso
roweff so`e l ketowey quo etue ne crlntogre mes romos supreigtemes. Ilntuml, pere ceig-
fgter e perejotrgzeëél me rokres, sorå useml l roiursl mo ‖juftgplrt‚, l quef nls plssgbgfgte
moiferer etç 5? plrtes nuje ðngie rokre1 mosse voz, nél sorå noiossårgl osirovor uje rokre
pere ieme prltlilfl oj quostél.
gptebfos -E CLR[ERM -p 3 -s 58.8.8.8/4 -j juftgplrt --splrt
28,25,22,29,2?,48,558,5=9,==9 -m 572.534.8.8/2= -j juftgplrt --mplrt
582=03??9? -` EIIOX]
Ç plssêvof tejbçj, oj voz mo moiferer fgtorefjonto l prltlilfl, user l nðjorl ilrrospln-
monto, iljl, plr oxojpfl0 5 pere GIJX, 3 pere ]IX lu 5; pere _MX. Iesl moso`e-so sebor ls
nðjorls mls mojegs prltlilfls, beste ilnsufter l erqugvl /oti/prltlilfs.
Lu plmorêejls cezor me clrje ifåssgie0
gptebfos -E CLR[ERM -m 572.534.58.8/2= -p tip --splrt 48 --mplrt
582=03??9? -` EIIOX]
gptebfos -E CLR[ERM -m 572.534.58.8/2= -p tip --splrt 558 --mplrt
582=03??9? -` EIIOX]
gptebfos -E CLR[ERM -m 572.534.58.8/2= -p tip --splrt 5=9 --mplrt
582=03??9? -` EIIOX]
]rebefdenml ilj GIJX (RCI ;72)
Iustljgzeëél mo plfêtgies mo oxioëél pere tretejontl ml prltlilfl GIJX, quo ç uj
prltlilfl jugtl ðtgf ne korànige mo romo, jes movgml el krenmo nðjorl mo tgpl mo ros-
plstes, jltgve emjgngstremlros quo tàj pluils ilndoigjontls mo ]IX/GX e irgerojplfêtgies nél emoquemes. Lutrl cetl ç quo osso prltlilfl ç jugtl utgfgzeml plr etequos pere
e ofeblreëél mo Etequos mo Mony lc Yorvgio (MLY) o tçingies mo Cgnkorprgnt. E tebofe e
sokugr sorvgrå mo rocorànige. Jegs motefdos, vgmo RCI;720
]WXO ILMO Mosirgptgln Uuory Orrlr
8 8 Oidl Ropfy x
9 8 Notwlra _nroeidebfo x
9 5 Dlst _nroeidebfo x
9 2 Xrltlilf _nroeidebfo x
9 9 Xlrt _nroeidebfo x
9 = Crekjontetgln noomom but nl crek. bgt sot x
9 ? Ylurio rlutgnk cegfom x
9 3 Mostgnetgln notwlra unanlwn x
9 ; Mostgnetgln dlst unanlwn x
9 4 Ylurio dlst gslfetom (lbslfoto) x
]ebofe ;.?
]gpls o iùmgkls morotlrnl gnifusls
nl ieboëefdl ml
prltlilfl GIJX.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 193/282
5;;
I e p ê t u f l
; - C g r o w e f f ’ X e r t o 5
]WXO ILMO Mosirgptgln Uuory Orrlr
9 7 Mostgnetgln notwlra emjgngstretgvofyprldgbgtom
x
9 58 Mostgnetgln dlst emjgngstretgvofy prldg-bgtom
x
9 55 Notwlra unroeidebfo clr ]LY x9 52 Dlst unroeidebfo clr ]LY x
9 59 Iljjungietgln emjgngstretgvofy prldgb-gtom by cgftorgnk
x
9 5= Dlst proiomonio vglfetgln x
9 5? Xroiomonio iutlcc gn occoit x
= 8 Ylurio quonid
? 8 Romgroit clr notwlra
? 5 Romgroit clr dlst
? 2 Romgroit clr ]LY enm notwlra
? 9 Romgroit clr ]LY enm dlst
4 8 Oidl roquost x
7 8 Rlutor emvortgsojont
58 8 Rluto slfgigtetgln
55 8 ]]F oquefs 8 murgnk trensgt x
55 5 ]]F oquefs 8 murgnk roessojbfy x
52 8 GX doemor bem (ietideff orrlr) x
52 5 Roqugrom lptglns jgssgnk x
59 8 ]gjostejp roquost (lbslfoto) x
5= 8 ]gjostejp ropfy (lbslfoto) x
5? 8 Gnclrjetgln roquost (lbslfoto) x
53 8 Gnclrjetgln ropfy (lbslfoto) x
5; 8 Emmross jesa roquost x
54 8 Emmross jesa ropfy x
L prltlilfl GIJX, plr sor uj prltlilfl mo jonsekoj, iljl l prùprgl nljo `å mgz, nél ç
utgfgzeml nlrjefjonto pere e trlie mo memls, o sgj pere tosto o nltgieëÿos, sonml e jeglrge
ontro rltoemlros. Nél plmo-so noker quo plr sor eperontojonto gnlionto, ofo plmo sor utgfg-
zeml oj etequos onkondlsls. _j blj oxojpfl mo uj etequo ifåssgil vge e cejlse corre-
jonte ]rgbl Cfllm Notwlra (]CN) ç uje correjonte MMlY quo utgfgze peiltos gijp oidl-ropfy
pere onvger e lrmoj mo etequo me jåqugne jestor pere es jåqugnes zujbgs, ilj gnclrje-
ëÿos iljl l tgpl mo etequo o l onmoroël me vêtgje pere es jåqugnes-zujbgs, jlstrenml quo
etç josjl uj metekreje suplstejonto gnlionto plmo trezor porgkl pere e romo.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 194/282
5;4
D e r m o n g n k o j F
g n u x
L cetl gntorossento ç quo jugtls etequos MLY utgfgzej metekrejes GIJX, iljl l Xgnk me
Jlrto, @lft o Yjurc.
Ontrotentl, sgjpfosjonto noker tråcokl mo metekrejes GIJX mo clrje erbgtrårge nél ç gnto-
fgkonto1 jes mo clrje rostrgtgve, ospoigienml oxetejonto ls t gpls mo jonsekons GIJX quo
vlià `ufker ilnvongonto, ç efkl quo so plmo cezor.
Nl gnêigl ml iepêtufl, clrej eprosontemls oxojpfls gntorossentos ml usl mo jonsekons
GIJX. _j mls oxojpfls ç l usl ml iljenml pgnk , quo use mues jonsekons0 roqugsgëél
GIJX OIDL-ROYU_OY] (tgpl 4) o rosplste GIJX OIDL-ROXFW (tgpl 8). Lutrl oxojpfl ç l
etosteml mo ùbgtl mo peiltos quenml oxoiutejls quefquor prlkreje quo so`e iepez mo
trenier e rlte, plgs quenml l veflr mo ] ]F zore, l peilto ç mostruêml o e nltgieëél me
jlrto voj etrevçs mo uj GIJX ]GJO-OTIOOMOM (tgpl 55), quo plmo sor mlgs tgpls mo iùmgkl
mo jonsekoj (]]F-PORL-M_RGNK-]RENYG] o ]]F-PORL-M_RGNK-ROEYYOJBFW).
Ojblre ilj evenël mes toinlflkges mo romos mo iljputemlros nl quo tenko e gncreostru-
ture mo gntornot, ç ieme voz jegs gniljuj e noiossgmemo mo crekjonteëél mo metekrejes
jltgvemls plr veflros mo J]_ gncorglros e 5?88 bytos. Jes josjl essgj, quenml oxgsto
uje crekjonteëél mo GX l prltlilfl GIJX vlfte è ione, plgs quenml e crekjonteëél ç
mojenmeme, l rltoemlr utgfgze uj metekreje GIJX MOY]GNE]GLN-_NROEIDEFBFO (tgpl 9),
jegs ospoigiejonto mo iùmgkl CREKJON]E]GLN (tgpl 9 , iùmgkl =).
L iùmgkl utgfgzeml tejbçj oj GIJX ml tgpl ç l iùmgkl mo XLR]-_NROEIDEBFO (tgpl 9,
iùmgkl 9), useml pere nltgier quo uje plrte nél plssug sorvgël _MX, uje voz quo e oste
roiobo uj metekreje _MX.
Xere nefgzer, nél ç roiljonmåvof bflquoer jonsekons ml tgpl DLY]-_NROEIDEBFO (tgpl 9,
iùmgkl 5) o YL_RIO U_ONID (tgpl =, iùmgkl 8)1 iesl eilntoëe, plmorojls tor prlbfojes nl
ilntrlfo mes ilnoxÿos. Rospoitgvejonto, e prgjogre jonsekoj nltgcgie quenml l mostgnl ç
gnefienëåvof o e sokunme, quo l dlst ostå slbroierrokeml.
Ontrotentl, pere e ilniopëél mo plfêtgies mo oxioëél pere metekrejes GIJX, l GXtebfos ç iepez
mo treter ieme tgpl mo jonsekoj o sous rospoitgvls iùmgkls1 pere gssl, utgfgzo l iljenml e
sokugr pere vor e fgste mo jonsekons o iùmgkls, o ilnsufto es RCI ml GIJX pere jegs motefdos.
# gptebfos -p gijp -d
Efkuns oxojpfls konçrgils0
# gptebfos -E GNX_] -` EIIOX] -s 8/8 -m 58.8.8.5 -p gijp --gijp-typo
tgjo-oxioomom
# gptebfos -E GNX_] -` EIIOX] -s 8/8 -m 58.8.8.5 -p gijp --gijp-typo
oidl-ropfey# gptebfos -E GNX_] -` EIIOX] -s 8/8 -m 58.8.8.5 -p gijp --gijp-typo
mostgnetgln-unroeidebfo
# gptebfos -E L_]_] -` EIIOX] -s 8/8 -m 58.8.8.5 -p gijp --gijp-typo
oidl-rosquost
Xere oxojpfgier mo clrje boj ospoiêie, sorå gfustreml l tretejontl mes jonsekons
GIJX o l iùmgkl mo jonsekoj gnoronto pere plfêtgies mo ropesso (CLR[ERM).
]retenml GIJX 9 (_nroeidebfo), fgborenml l ropesso, jes ilj fgjgteëél mo uj metekreje
plr sokunml0
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 195/282
5;7
I e p ê t u f l
; - C g r o w e f f ’ X e r t o 5
Fgborenml iùmgkl 5 (DLY] _NROEIDEBFO)
# gptebfos -E CLR[ERM -` EIIOX] -p 5 --gijp-typo 9/5 -j fgjgt --fgjgt
5/s
Fgborenml l iùmgkl 9 (XLR] _NROEIDEBFO), rosplste mo plrte _MX
coideme0
gptebfos -E CLR[ERM -` EIIOX] -p 5 --gijp-typo 9/9 -j fgjgt --fgjgt5/s
Fgborenml l iùmgkl = (CR EKJON]E]GLN NOOMOM), metekreje ut gfgzeml pofl rltoemlr pere
nltgier quo devorå crekjonteëél e pertgr mofo, lu so`e, quo l veflr mo J]_ nl prùxgjl
onfeio ç jonlr0
# gptebfos -E CLR[ERM -` EIIOX] -p 5 --gijp-typo 9/= -j fgjgt --fgjgt
5/s
]retenml GIJX 55 (]GJO OTIOOMOM), quo ç rosplnsåvof pofe nltgieëél me jlrto mo uj
peilto. Nl iesl mo prlkrejes quo treëej rltes, l iùmgkl pemrél mo rosplste ç 8. S gmo l
tretejontl e sokugr0
Fgborenml l iùmgkl 8 (]]F OU_EFY 8 M_RGNK ]RENYG] ), nltgieëél me jlrto ml peilto0
# gptebfos -E CLR[ERM -̀ EIIOX] -p 5 --gijp-typo 55/8 -j fgjgt
--fgjgt 5/s
Fgborenml l iùmgkl 5 (]]F OU_EFY 8 M_RGNK ROEYYOJBFW), nltgie e jlrto ml peilto
murento e sue roilnstruëél oj uj rltoemlr. Nél jugtl iljuj, jes ilnvongonto fgborer.
# gptebfos -E CLR[ERM -` EIIOX] -p 5 --gijp-typo 55/5 -j fgjgt
--fgjgt 5/s
]retenml GIJX = (YL_RIO U_ONID)0
# gptebfos -E CLR[ERM -` EIIOX] -p 5 --gijp-typo =/8 -j fgjgt --fgjgt
5/s
]retenml l iljenml XGNK, fgborenml rospoitgvejonto l OIDL-ROXFW tgpl 8 iùmgkl 8, o l
OIDL ROU_OY] tgpl 4 iùmgkl 80
# gptebfos -E CLR[ERM -` EIIOX] -p 5 --gijp-typo 8/8 -j fgjgt --fgjgt
5/s
# gptebfos -E CLR[ERM -` EIIOX] -p 5 --gijp-typo 4/8 -j fgjgt --fgjgt
5/s -` EIIOX]
Oxojpfgieëél mo uj sirgpt pere eutljetgzer o korer es rokres pere tretejontl els prgnig-
pegs tgpls mo GIJX0
# vg /rllt/resiundl/oxoi.gijp
XC:$(wdgid gptebfos)
NO]:8/8
O]D8:572.534.288.4
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 196/282
548
D e r m o n g n k o j F
g n u x
gc Q -z $XC Z1 tdon
oidl ‖Iljenml gptebfos nel onilntreml‚
oxgt
cg
clr tgpl gn 8 9/8 9/5 9/2 9/9 9/= = ? 55 52
ml
$XC -E GNX_] -p gijp -s $NO] -m $O]D8 --gijp-typo $tgpl -` EIIOX] -j
fgjgt --fgjgt 5/s
mlno
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 197/282
545
I e p ê t u f l 5 - R l t o g r l m o E t g v g m e m o s ;
Rltogrl mo Etgvgmemos ;
Xråtgie mo perejotrgzeëél mo plfêtgies pere tråcokl mo romo utgfgzenml l roiursl Notftor
ml Aornof ml Fgnux etrevçs me correjonte GXtebfos. Yorå noiossårgl quo l efunl utgfgzo e
jåqugne vgrtuef propereme iljl Sgrtueblx. Mosse clrje, sorå plssêvof epfgier tlmls lsilndoigjontls (tçingies o correjontes) mo Dermongnk prlplstls etç l jljontl.
Etgvgmemo ;.5 ’ Dermongnk Fgnux ’ Cgroweff Fgnux
5. Ilnstrugr uj sirgpt mo roweff pere treter0
Xlfêtgies mo eiossl els prltlilfls YYD, D]]X, YNJX, ilnsgmoreml e jåqugne roweff ilj
sorvgmlr (efvl).
Xlfêtgies mo eiossl els prltlilfls YYD, MNY, D]]X, N]X ilnsgmorenml e jåqugne roweff
lrgkoj/ifgonto.
]osto es rokres o vefgmo-es.
2. Mosonvlfve uj sdoff sirgpt pere treter ls prgnigpegs tgpls mo GIJX quo uj sorvgmlr movo
roiobor. Ilnsgmoro quo so`e uj ketowey mo crlntogre.
]çingies mo ]reiorluto sél utgfgzemes pere treëer e rlte me lrgkoj etç l mostgnl, lu so`e,
vorgier quentls rltoemlros då ontro e lrgkoj o l mostgnl. Ç sebgml quo l jtr onvge peiltos
gijp oidl roquost o ospore iljl rosplste l gijp 55 (tojpl oxiomgml). Mosse clrje,
torojls e oxioëél pere GIJX (pere ontreme/ gnput)
]]F oquefs 8 murgnk trensgt- ]]F oquefs 8 murgnk roessojbfy
]reterojls iljl oxioëél pere ontreme o ropesso tejbçj GIJX ml ]GX oj nlssl Cgroweff,ontro ofos0
5 Xlrt _nroeidebfo0 rosplste pemrél mo plrte _MX coideme1
5 Dlst _nroeidebfo0 rosplste pemrél pere uj dlst clre mo efienio1
5 Notwlra _nroeidebfo0 quo ç e rosplste pemrél pere romo clre mo efienio1
5 Xlrt _nroeidebfo0 quo ç e rosplste pemrél mo plrte _MX coideme1
5 Crekjontetgln noomom0 tejbçj ilndoigml iljl GIJX XE]D Mgsilvory.
Xere plssgbgfgter l usl ml ‖pgnk‚ mo clrje oklêste, lu so`e, sljonto l sorv gmlr roweff plmo
roefgzer ilnsufte mo Xgnk, jes nél rosplnmor.
5 ]reter e seême mo Oidl-roquost.
5 ]reter e ontreme mo Oidl-ropfy.
5 ]reter tejbçj e ontreme mo jonsekons ml tgpl GIJX Ylurio-quonid.
Ojblre so`e uje sgtueëél rere, ofeblro uje plfêtgie mo oxioëél mo ontreme o ropesso pere
jonsekons GX doemor bem.
Xere ovgter plssgbgfgmemos mo etequos mo Cfllm e per tgr mls tgpls mo rosplstes pere es quegs
clrej koremes plfêtgies mo oxioëél, utgfgzo l ilniogtl mo fgjgter metekrejes.
Ofeblro uj toriogrl sirgpt roungnml es cuniglnefgmemo mls mlgs entorglros, ilpgo l sirgpt
pere l mgrotùrgl /oti/gngt.m o ceëe-l cuniglner eutljetgiejonto nl runfovof 2.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 198/282
542
D e r m o n g n k o j F
g n u x
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 199/282
549
I e p ê t u f l
4 - Y o k u r e n ë e m o X o r ê j o t r l ’ X e r t o 2
l b ` o t g v l s
i l n i
o g t l s
4Yokurenëe mo Xorêjotrl ’ Xerto 2
Epronmor ilniogtls mo plfêtgies mo ilntrlfos (rokgstrls mo ovontls/flk)1 Ilndoior
rokres besoemes oj peiltos mo ilnoxÿos rofeiglnemes o rokres besoemes oj Osteml
mo Ilnoxél (Ytetocuff)1 Ontonmor tremuëél mo Onmoroëejontl GX (NE]) 1 Epronmor
jengpufeëél mo iejpls mo Metekreje1 Gjpfojonter Xlrt Anliagnk.
Rokres mo ilntrlfo1 Rokres Ytetocuff, NE] o Xlrt Anliagnk pere gjpfojonteëél
mo Cgroweff.
Oxoriêigl mo ngvofejontl 5oCgroweffs
Oxgstoj ventekons oj rokgstrer ovontls erbgtrår gls vge Cgroweff<
_je romo besoeme oj uj ketowey quo roefgzer NE] pere tlmes es osteëÿos mo trebefdl
ilnsokuo prlvor sokurenëe suigonto pere gjplssgbgfgter etequos ilj lrgkoj ne gntornot<
Xlr quà<
Ne sue lpgngél, e ilnkureëél mo uj Xlrt Anliagnk ç uje eftornetgve pere eiossl e
roiursls emjgngstretgvls<
Nosto iepêtufl, sorél eprosontemls ilniogtls o rokres mo ilntrlfo pere rokgstrl mo plssêvogs
ovontls erbgtrårgls, plfêtgies ilj l ilniogtl mo Yteto Cuff, gjpfojonteëél mo Xlrt Anliagnk,
tremuëél mo onmoroëejontl GX (NE]) o jengpufeëél mo metekreje vge tebofe Jenkfo.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 200/282
54=
D e r m o n g n k o j F
g n u x
Rokres mo ilntrlfo
qCgroweff0 cez l rokgstrl mes etgvgmemos quo nél sél porjgtgmes.
5 Essgj, l emjgngstremlr, plr jogl mls flks, plmo enefgser iljplrtejontls dlstgs.
_je teroce gjplrtento ml roweff ç `ustejonto cezor l rokgstrl mes etgvgmemos quo nél sél
porjgtgmes, pere quo etrevçs mls flks l emjgngstremlr plsse enefgser iljplrtejontls
dlstgs o tonter entoigper-so quentl ès etgvgmemos mo gnveslros iljl Yir gpt Agmmgos, gnsgmor,
Bfeia Dets o KreyDet. Ls oxoriêigls e sokugr tàj plr lb`otgvl oxojpfgier e ilnstruëél mo
plfêtgies mo ilntrlfo.
_je ostretçkge quo plmo sor emlteme ç ir ger rokres pere rokgstrer ovontls quo plssej
iereitorgzer es etgv gmemos quo osto`ej rofeiglnemes ilj eëÿos osiuses jltgvemes pofls
ekontos iljl gnveslros o/lu jefwero.
I
l n t r l f o s
E irgeëél mo uje rokre mo ilntrlfo quo evefgo peiltos ‖pormgmls‚, lu so`e, peiltos quo nél
portonioj ès ilnoxÿos ostebofoigmes lu josjl etequos mo peiltos jef clrjemls ç roil-
jonmåvof, plgs e gnigmànige mosso tgpl mo peilto plmo iereitorgzer uj etequo mo nokeëél
mo sorvgëls (MLY) oj oxoiuëél0
# vg /rllt/resiundl/jefclrjemls
XC:$(wdgid gptebfos)
jefclrjemls()
{
clr IDEGNY gn GNX_] CLR[ERM
ml
$XC -E $IDEGNY -j steto --steto GNSEFGM -̀ FLK --flk-procgx
‖pat\bem‚
$XC -E $IDEGNY -j steto --steto GNSEFGM -̀ MRLX
mlno
}
jefclrjemls
Iljenmls pere tosto ml sirgpt l sirgpt o fgstekoj mes rokres etgves0
# besd jefclrjemls.cw
# gptebfos -F -n
Cgkure 4.5
Irgeëél mo rokres
pere rokgstrl mo
ovontls0 clil nl
ilntrlfo.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 201/282
54?
I e p ê t u f l
4 - Y o k u r e n ë e m o X o r ê j o t r l ’ X e r t o 2
Lutrl iljplrtejontl quo plmo sor jlngtlreml ç l usl mo iljbgneëÿos mo eks ]IX nél
ilnvoniglnegs, quo plmoj sor utgfgzemls oj etequos mo verromures o nokeëél mo sorvgël.
Yirgpt pere eutljetgzer mongë él mo plfêtgies mo ilntrlfos mo etequo mo peiltos ilj
eks curemes0
# vg /rllt/resiundl/cfeks.tip
XC:$(wdgid gptebfos)
cfeks\cureml()
{
clr CFEKY gn $(iet /oti/cw/cfeks.tip | krop -v ^#)
ml
clr IDEGNY gn GNX_] CLR[ERM
ml
$XC -E $IDEGNY -p 3 --tip-cfeks $CFEKY $CFEKY -̀ FLK
--flk-procgx ‖cfek\$CFEKY‚
$XC -E $IDEGNY -p 3 --tip-cfeks $CFEKY $CFEKY -̀ MRLX
mlno
mlno
}
cfeks\cureml
# vgj /oti/cw/cfeks.tip
NLNO
EFF
CGN,RY]
YWN,RY]
CGN,_RK,XYD
Iljenmls pere tosto ml sirgpt l sirgpt o fgstekoj mes rokres etgves0
# besd cfeks.tip
# gptebfos -F -n
Sgkger plrtes ifåssgies utgfgzemes plr jefwero lu josjl correjontes gnmoso`emes. Xlgs
josjl quo l roweff tonde l ilniogtl rostrgtgvl oj sue plfêtgie båsgie, egnme sgj nokenml l
eiossl ès plrtes quo nél clrej oxprossejonto fgboremes, iesl lilrrej eëÿos rofeiglnemes
e osses plrtes, ofes movoj sor rokgstremes pere eumgtlrge.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 202/282
543
D e r m o n g n k o j F
g n u x
Oxojpfgieëél mo uj sirgpt pere mongr plfêtgies mo ilntrlfos pere eiossl e plrtes gnmovgmes0
# vg /rllt/resiundl/gnmovgmes\tip\ump
# vgj /oti/cw/gnmovgmes\tip\ump
# notbus
529=?529=3
# GRI
333803337
# BL
9599;
95993
333
Iljenmls pere tosto ml sirgpt l sirgpt o fgstekoj mes rokres etgves0
# im /rllt/resiundl/
# besd gnmovgmes\tip\ump
# gptebfos -F -n
Yokugnml e josje fùkgie mo plrtes gnmovgmes, vefo uj tretejontl ospoigef pere plrte mo corre-
jontes X2X, lnmo el gnvçs mo sgjpfosjonto bflquoer, plmo sor gntorossento fgborer, jes fgjgter
l tråcokl mo tef clrje quo so`e rugj l usl mosso tgpl mo correjonte, plgs bflquoer mgrotejonto
plmo jltgver usuårgls jegs errl`emls e tonter jogls mo ilntlrner l roweff. Fgborer ilj fgjg-
teëél plmo mosjltgvå-fls e user e correjonte, plgs l mlwnflem sorå jugtl fontl.
Oxojpfl mo sirgpt pere mongr plfêtgies mo ilntrlfos pere epfgieëÿos X2X0
# vg /rllt/resiundl/p2p
XC:$(wdgid gptebfos)
gnmovgmes\tip\ump()
{
clr XLR]EY gn $(iet /oti/cw/gnmovgmes\tip\ump | krop -v ^#)
ml
clr IDEGNY gn GNX_] CLR[ERM
ml
clr XRL]L gn tip ump
ml
$XC -E $IDEGNY -p $XRL]L --mplrt $XLR]EY -̀ FLK --flk-procgx
‖gnmovgmes\$XLR]EY‚
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 203/282
54;
I e p ê t u f l
4 - Y o k u r e n ë e m o X o r ê j o t r l ’ X e r t o 2
mlno
mlno
mlno
}
gnmovgmes\tip\ump
# vgj /oti/cw/p2p
# KN_toffe
39=3
32=3
#Aezee
525=
?888
4444
32?;
Iljenmls pere tosto ml sirgpt l sirgpt o fgstekoj mes rokres
etgves0
# im /rllt/resiundl/
# besd p2p
# gptebfos -F -n
Movo sor mo ilndoigjontl mo tlmls ls emjgngstremlros mo romo ls ilniogtls mo ifesso mo
romo. Mosse clrje, bflquoer es renkos mo GX nél rltoåvogs ne gntornot, quo sél mongmes
pofl GENE, plmo sor uje eëél gntorossento pere jgtgker etequos besoeml oj cefsgieëél mo
GX (Gp Ypllnk).
Yokuo uj oxojpfl mo sirgpt pere mongr plfêtgies mo ilntrlfos pere peiltos ilj onmoroëe-
jontl rosorveml ml GENE, quo plssgvofjonto sél peiltos clr`emls0
XC:$(wdgid gptebfos)
gene()
{
clr GX gn $(iet /oti/cw/gene | krop -v ^#)
ml
clr IDEGNY gn GNX_]
ml
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 204/282
544
D e r m o n g n k o j F
g n u x
$XC -E $IDEGNY -g otd8 -p 8 -s $GX -̀ FLK --flk-procgx
‖GENE\$GX‚
$XC -E $IDEGNY -g otd8 -p 8 -s $GX -̀ MRLX
mlno
}gene
Erqugvl /oti/cw/gene.
8.8.8.8/4
5.8.8.8/4
2.8.8.8/4
?.8.8.8/4
;.8.8.8/4
29.8.8.8/4
2;.8.8.8/495.8.8.8/4
93.8.8.8/4
9;.8.8.8/4
97.8.8.8/4
=5.8.8.8/4
=2.8.8.8/4
?4.8.8.8/4
?7.8.8.8/4
38.8.8.8/4
3;.8.8.8/4
34.8.8.8/4
37.8.8.8/4;8.8.8.8/4
;5.8.8.8/4
;2.8.8.8/4
;9.8.8.8/4
;=.8.8.8/4
;?.8.8.8/4
;3.8.8.8/4
;;.8.8.8/4
;4.8.8.8/4
;7.8.8.8/4
48.8.8.8/4
45.8.8.8/4
42.8.8.8/4
49.8.8.8/4
4=.8.8.8/4
4?.8.8.8/4
43.8.8.8/4
4;.8.8.8/4
44.8.8.8/4
47.8.8.8/4
78.8.8.8/4
75.8.8.8/4
72.8.8.8/4
79.8.8.8/4
7=.8.8.8/4
7?.8.8.8/4
73.8.8.8/47;.8.8.8/4
74.8.8.8/4
77.8.8.8/4
588.8.8.8/4
585.8.8.8/4
582.8.8.8/4
589.8.8.8/4
58=.8.8.8/4
58?.8.8.8/4
583.8.8.8/4
58;.8.8.8/4
584.8.8.8/4587.8.8.8/4
558.8.8.8/4
555.8.8.8/4
552.8.8.8/4
559.8.8.8/4
55=.8.8.8/4
55?.8.8.8/4
553.8.8.8/4
55;.8.8.8/4
554.8.8.8/4
557.8.8.8/4
528.8.8.8/4
525.8.8.8/4
522.8.8.8/4
529.8.8.8/4
52=.8.8.8/4
52?.8.8.8/4
523.8.8.8/4
57;.8.8.8/4
285.8.8.8/4
254.8.8.8/4
257.8.8.8/4
228.8.8.8/4
225.8.8.8/4
222.8.8.8/4
229.8.8.8/4
22=.8.8.8/=2=8.8.8.8/4
2=8.8.8.8/?
2=5.8.8.8/4
2=2.8.8.8/4
2=9.8.8.8/4
2==.8.8.8/4
2=?.8.8.8/4
2=3.8.8.8/4
2=;.8.8.8/4
2=4.8.8.8/4
2=7.8.8.8/4
2?8.8.8.8/42?5.8.8.8/4
2?2.8.8.8/4
2?9.8.8.8/4
2?=.8.8.8/4
2??.8.8.8/4
]ebofe 4.5
L erqugvl—/oti/cw/gene‗.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 205/282
547
I e p ê t u f l
4 - Y o k u r e n ë e m o X o r ê j o t r l ’ X e r t o 2
Iljenmls pere tosto ml sirgpt l sirgpt o fgstekoj mes rokres etgves0
# im /rllt/resiundl/
# besd gene.gp
# gptebfos -F -n
Ç neturef quo l sou roweff mo crlntogre so`e vêtgje mo verromures. _je bestento iljuj ç
e verromure curt gve, besoemes nes eks urk, psd o rst ml sokjontl ]IX, lu oj peiltos ]IX
quo nél tàj nonduje ek debgfgteme. Gssl plstl, gjpfojonto uje rokre mo ilntrlfo pere
‖rokgstrer‚ osso tgpl mo peilto o plstorglrjonto ‖MRLX ‚ l peilto. Ceëe uj sdoff sirgpt ilj
cunëél pere osse rokre.
XC:$(wdgid gptebfos)
fgboretuml()
{
clr IDEGNY gn GNX_] L_]X_] CLR[ERM
ml
$XC -X $IDEGNY EIIOX]
mlno
$XC -C
}
fgboretuml
Iljenmls pere tosto ml sirgpt l sirgpt o fgstekoj mes rokres etgves0
# im /rllt/resiundl
# besd fgboretuml
# gptebfos -nF
Irgenml Idegns
5 - Irger uj sirgpt ilj IDEGN pere eiogter sljonto e ontreme mo peiltos GIJX tgpl 8, 55, 9 o =0
e) Korenml uje cunëél usenml roiursl mo idegns pere treter ilnoxÿos GIJX0
# vg gijp\typo.sd
NO]:‚8/8‚
O]8:‚572.534.8.2=‚
XC:$(wdgid gptebfos)
gijptypo( )
{
$XC -N EFFL[\GIJX
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 206/282
578
D e r m o n g n k o j F
g n u x
]:‚8 9 55 =‚
clr ]WXO gn $]
ml
$XC -E EFFL[\GIJX -p 5 --gijp-typo $]WXO -s $NO] -m $O]8 -̀
EIIOX]
mlno
$XC -E GNX_] -p 5 -` EFFL[\GIJX
}
Iljenmls pere tosto ml sirgpt l sirgpt o fgstekoj mes rokres etgves0
# ./ gijp\typo.sd
# gptebfos ’n -F
Korenml uje cunëél usenml roiursl mo idegns pere treter ilnoxÿos GIJX sonml oxpfêigtl
quentl els tgpls quo movojls treter, quo clrej ostumemls entorglrjonto.
$XC -N EFFL[\GIJX
NO]:‚8/8‚
O]8:‚572.534.288.7‚
XE:‚582=03??9?‚
XC:$(wdgid gptebfos)
$XC -E EFFL[\GIJX -` EIIOX] -j fgjgt --fgjgt 2/s
clr ]GXL gn 8 9/8 9/5 9/2 9/9 9/= = ? 55 52
ml
$XC -E GNX_] -̀ EFFL[\GIJX -p 5 -s $NO] -m $O]8 --gijp-typo $]GXL
mlno
$XC -E L_]X_] -` EFFL[\GIJX -p 5 -m $NO] -s $O]8 --gijp-typo 4
L roiursl pere e irgeëél mo uje idegns ospoiêie quo plssgbgfgto tlrner jegs errl`eml l
tretejontl mls peiltos. _je ble sgtueëél pere sor perejotrgzeme oj uje idegn pertgiufer
sél es ilnoxÿos ]IX, lnmo plmo-so iljbgner l roiursl mo tretejontl stetocuff ilj uje
idegn ospoiêie. Essgj, tlmes es ilnoxÿos ]IX oxprossejonto porjgtgmes plmoj tor l sou
uxl mo peilto trenscorgml pere osse idegns, ltgjgzenml l roweff.
Oxojpfl mo uj sirgpt iustljgzeml pere osso j, ilnsgmorenml l ilntoxtl lnmo es rokres
etuerél nes josjes jåqugnes o prlvorél l sor vgël tonml iljl ifgonto oxifusgvejonto e
romo 572.534.588.8/2=. Eprlvogtenml egnme l ilniogtl mo ‖osteml mo ilnoxél‚, mosse clrje es
rokres sorél rostrgtgves pere es plr tes-efvl, nl quo tenko l ilniogtl mo denmsdeao tip, jes
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 207/282
575
I e p ê t u f l
4 - Y o k u r e n ë e m o X o r ê j o t r l ’ X e r t o 2
e rosplste (L_]X_] ) sorå treteme plr uje rokre sgjpfos quo ilnsgmorerå sljonto peiltos
rofeiglnemls o mo uje ilnoxél ̀ å ostebofoigme. Gssl oilnljgze rokres o prliossejontl0
# vg steto\tip5.sd
XC:$(wdgid gptebfos)
stetotip5()
{
$XC -N EFFL[\]IX
$XC -E EFFL[\]IX -p 3 --syn -` EIIOX]
$XC -E EFFL[\]IX -p 3 -j steto --steto OY]EBFGYDOM,ROFE]OM -` EIIOX]
$XC -E EFFL[\]IX -p 3 ! --syn -j steto --steto NO[ -` FLK V
--flk-procgx ‖Now nlt syn0‚
$XC -E EFFL[\]IX -p tip ! --syn -j steto --steto NO[ -` MRLX
}
clr XLR]E gn $(iet /oti/cw/plrtessorvgil.tip | krop -v ^#)
ml
$XC -E GNX_] -̀ EFFL[\]IX -s 572.534.588.8/2= --mplrt $XLR]E
Mlno
$XC -E L_]X_] -̀ EIIOX] ]IX -p 3 -j steto --steto
OY]EBFGYDOM,ROFE]OM
$XC -E GNX_] -` EIIOX] ]IX -p 3 -j steto --steto
OY]EBFGYDOM,ROFE]OM
# ./steto\tip5.sd
Yokunml oxojpfl, sgjgfer el entorglr, jes lnmo e iustljgzeëél toj l plntl mo vgs te mo
ifgonto mo uje fgste mongme mo sorv gëls0
vg steto\tip2.sd
XC:$(wdgid gptebfos)
stetotip2()
{
$XC -N EFFL[\]IX
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 208/282
572
D e r m o n g n k o j F
g n u x
$XC -E EFFL[\]IX -p 3 --syn -` EIIOX]
$XC -E EFFL[\]IX -p 3 -j steto --steto OY]EBFGYDOM,ROFE]OM -` EIIOX]
$XC -E EFFL[\]IX -p 3 ! --syn -j steto --steto NO[ -` FLK V
--flk-procgx ‖Now nlt syn0‚
$XC -E EFFL[\]IX -p tip ! --syn -j steto --steto NO[ -` MRLX
clr XLR]E gn $(iet /oti/cw/plrtesifgonto.tip | krop -v ^#)
ml
$XC -E L_]X_] -̀ EFFL[\]IX -m 572.534.588.8/2= --mplrt $XLR]E
Mlno
$XC -E GNX_] -̀ EIIOX] -p 3 -j steto --steto
OY]EBFGYDOM,ROFE]OM
}
# ./steto\tip2.sd
Ilnstrugnml uj sirgpt mo cgroweff qIlnkureëél mo sirgpt pere ligefgzer rokres ml roweff0
5 Moplgs mo tosteml, movo sor gnsorgml nl /oti/gngt.m
5 O mongml pere sor gngigefgzeml ilj uj sirgpt mo runfovof.
E ilnkureëél mo uj sirgpt pere ligefgzer e rokres ml roweff ç e jofdlr slfuëél. Osso
sirgpt, uje voz tosteml, movo sor gnsorgml nl /oti/gngt.m o mongml pere sor gngigefgzeml ilj
uj sirgpt mo runfovof.
Ilflier l sirgpt pere sor ierrokeml murento l bllt nl nêvof pemrél o gngigefgzeëél ml sou
Fgnux, fojbrenml quo es mgstrgbugëÿos fgao Mobgen o RomDet sokuoj l jlmofl Yystoj S, o
Fgao Yfeiawero sokuo l jlmofl BYM. Nl iesl mo mgstrgbugëÿos Fgao Mobgen, iljl _buntu, lroiljonmeml ç l runfovof 2 o, pere mgstrgbugëÿos Fgao Romdet, iljl Comlre o Yuso, l roil-
jonmåvof ç l runfovof 9.
Yokuo uj oxojpfl mo uj roweff Dljo, mostgneml è mocose oxifusgve me prùprge jåqugne
nosso oxojpfl, ilnsgmorenml quo ç uj sorvgmlr [ob o C]X0
#!/bgn/besd
C[:/sbgn/gptebfos
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 209/282
579
I e p ê t u f l
4 - Y o k u r e n ë e m o X o r ê j o t r l ’ X e r t o 2
##--------------------------------
ifoer
oidl GNGIGENML CGRO[EFF
oidl Coide tuml
$C[ -C
clr ]EBOFE gn GNX_] L_]X_] CLR[ERM
ml
$C[ -X $]EBOFE MRLX
mlno
##--------------------------------
oidl Xlfêtgie FLLXBEIA
$C[ -E GNX_] -` EIIOX] -g fl
$C[ -E L_]X_] -` EIIOX] -l fl
##--------------------------------
oidl Xlfêtgie XGNK OKLGY]E
$C[ -E GNX_] -` EIIOX] -m 58.57;.2?.224 -p gijp -j gijp --gijp-typo 8
$C[ -E L_]X_] -` EIIOX] -s 58.57;.2?.224 -p gijp -j gijp --gijp-typo 4
##--------------------------------
#E]OY]EML MO JLR]O ML XEIL]O
oidl Xlfêtgie ]reiorluto
$C[ -E GNX_] -` EIIOX] -m 58.57;.2?.224 -p gijp -j gijp --gijp-typo 55
##--------------------------------
oidl Xlfêtgie MDIX
$C[ -E L_]X_] -` EIIOX] -p ump -j ump --mplrt 34
$C[ -E GNX_] -` EIIOX] -p ump -j ump --splrt 34
##--------------------------------
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 210/282
57=
D e r m o n g n k o j F
g n u x
oidl Xlfêtgie IFGON]O _MX
clr XLR]E gn ?9 ?5=
ml
$C[ -E L_]X_] -̀ EIIOX] -s 58.57;.2?.224 -p ump -j ump --splrt
582=03??9? --mplrt $XLR]E$C[ -E GNX_] -` EIIOX] -m 58.57;.2?.224 -p ump -j ump --splrt
$XLR]E --mplrt 582=03??9?
mlno
##--------------------------------
oidl Xlfêtgie mo YORSGMLR ]IX
clr XLR]E gn 25 48 ==9
ml
$C[ -G GNX_] -̀ EIIOX] -p tip -m 58.57;.2?.224 -j steto --steto
NO[,OY]EBFGYDOM --splrt $XLR]E --mplrt 582=03??9?
mlno
$C[ -G L_]X_] -̀ EIIOX] -p tip -s 58.57;.2?.224 -j steto --steto
OY]EBFGYDOM --splrt 582=03??9?
Lutrl oxojpfl ml osquofotl mo uj sirgpt mo Runfovof nltlrgejonto besoeml oj Yystoj S
ilj l ieboëefdl pemrél roilndoigml plr correjontes iljl ntsysv mgsplnêvof oj mgstrg-
bugëél Fgao Romdet0
#!/bgn/sd
# idailncgk0 9=? 58 58
# mosirgptgln0 Ilntrlfo mo Cgftrls Xeiltos o Osteml mo Ilnoxel
YC:/sbgn/gptebfos
JO_GX:‚572.534.588.5‚IFGON]O:‚582=03??9?‚
#:::::::::::::::::::::::::::
#EU_G ON]REJ EY C_NILOY
#:::::::::::::::::::::::::::
ieso ‖$5‚ gn
stert|-s)
#Equg sel etgvemes es cunilos
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 211/282
57?
I e p ê t u f l
4 - Y o k u r e n ë e m o X o r ê j o t r l ’ X e r t o 2
11
stlp|-p)
# cuniel quo fgjpe es rokres ml cgroweff me jojlrge
11
rostert|-r)
$8 stlp
$8 stert
11
stetus|-i)
$XC -F -n
11
*)
oidl ‖_so0 $8 { |stert|stlp|rostert|stetus| }‚
oxgt 5
11
osei
oxgt
Yokuo uj toriogrl oxojpfl, eklre uj sirgpt iljpfotl, pere uje plssêvof slfuëél mo Yirgpt
mo Cgroweff mo Crlntogre0
#!/bgn/sd
#
# Xeiaotcgftor Ilntrlfo mo rokres båsgie mo Cgftrl (plfgio)
# idailncgk0 9=? 58 58
# mosirgptgln0 Ilntrlfo mo rokres båsgies mo Cgftrls (plfgio) -
Mosgknor by =NGT - www.=NGT.ilj.br
############################ Ilflquo equg es vergåvogs
XC:/sbgn/gptebfos
NO]:‚8/8‚
O]8:‚572.534.288.7‚
XE:‚582=03??9?‚
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 212/282
573
D e r m o n g n k o j F
g n u x
############################ Ilflquo equg es cunëÿos
fgboremns()
{
$XC -E GNX_] -p 5; -s $NO] --splrt ?9 -m $O]8 --mplrt $XE -` EIIOX]
$XC -E GNX_] -p 5 --gijp-typo 9/9 -s $NO] -m $O]8 -` EIIOX]
$XC -E L_]X_] -p 5; -s $O]8 --splrt $XE -m $NO] --mplrt ?9 -` EIIOX]
}
trl`en()
{
clr XLR] gn $(iet /rllt/cgroweff/trl`enplrte.txt)
ml
clr ]EBOFE gn GNX_] CLR[ERM
ml
clr XRL]L gn ump tip
ml
$XC -E $]EBOFE -̀ FLK --flk-procgx ‖]RL@EN $XLR]‚ -p$XRL]L --mplrt $XLR]
$XC -E $]EBOFE -̀ MRLX -p $XRL]L --mplrt $XLR]
mlno
mlno
mlno
}
noketuml()
{
$XC -X GNX_] MRLX
$XC -X L_]X_] MRLX
$XC -X CLR[ERM MRLX
}
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 213/282
57;
I e p ê t u f l
4 - Y o k u r e n ë e m o X o r ê j o t r l ’ X e r t o 2
fgboretuml()
{
$XC -X GNX_] EIIOX]
$XC -X L_]X_] EIIOX]
$XC -X CLR[ERM EIIOX]
}
fgborejtr()
{
$XC -E GNX_] -p gijp --gijp-typo 55 -s $NO] -m $O]8 -` EIIOX]
}
fgborepgnk()
{
$XC -E GNX_] -p gijp --gijp-typo 8 -s $NO] -m $O]8 -` EIIOX]
$XC -E L_]X_] -p gijp --gijp-typo 4 -s $O]8 -m $NO] -` EIIOX]
}
ro`oit\tip()
{
$XC -E GNX_] -` RO@OI] --ro`oit-wgtd tip-rosot -p 3 -s $NO] --mplrt
22
$XC -E L_]X_] -` EIIOX] -p 3 --splrt 22 -m $NO]
}
ro`oit\ump()
{
$XC -E GNX_] -` RO@OI] -p 5; -s $NO] --mplrt ?5=
$XC -E L_]X_] -` EIIOX] -p 5 --gijp-typo 9/9 -j fgjgt --fgjgt 5/s -m
$NO]
}
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 214/282
574
D e r m o n g n k o j F
g n u x
steto\gijp()
{
$XC -N EFFL[\GIJX
$XC -E EFFL[\GIJX -` EIIOX] -j fgjgt --fgjgt 2/s
clr ]GXL gn 8 9/8 9/5 9/2 9/9 9/= = ? 55 52
ml
$XC -E GNX_] -̀ EFFL[\GIJX -p 5 -s $NO] -m $O]8 --gijp-typo $]GXL
mlno
$XC -E L_]X_] -` EFFL[\GIJX -p 5 -m $NO] -s $O]8 --gijp-typo 4
}
steto\tip()
{
$XC -N EFFL[\]IX
$XC -E EFFL[\]IX -p 3 --syn -` EIIOX]
$XC -E EFFL[\]IX -p 3 -j steto --steto NO[,OY]EBFGYDOM,ROFE]OM -`
EIIOX]
$XC -E EFFL[\]IX -p 3 ! --syn -j steto --steto NO[ -` FLK --flk-
procgx ‖Now nlt syn0‚
$XC -E EFFL[\]IX -p 3 ! --syn -j steto --steto NO[ -` MRLX
$XC -E GNX_] -` EFFL[\]IX
$XC -E L_]X_] -` EFFL[\]IX
}
fgjpetuml()
{
$XC -C
$XC -P
$XC -T
}
stetus()
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 215/282
577
I e p ê t u f l
4 - Y o k u r e n ë e m o X o r ê j o t r l ’ X e r t o 2
{
$XC -nF -t cgftor
}
##### Gngigl ml Ieso
ieso ‖$5‚ gn
stert)
sotup\aornof
fgjpetuml
noketuml
fgboremns
fgborejtr
fgborepgnk
steto\tip
steto\gijp
ro`oit\tip
ro`oit\ump
11
stlp)
fgjpetuml
fgboretuml
11
coideml)
fgjpetuml noketuml
11
fgboreml)
fgjpetuml
fgboretuml
11
rostert)
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 216/282
288
D e r m o n g n k o j F
g n u x
$8 stlp
$8 stert
11
stetus)
stetus
11
*)
oidl ‖_so0 $8 {stert|stlp|rostert|stetus|fgboreml|coideml}‚
oxgt 5
11
osei
oxgt 8
]rebefdenml ilj tremuëél mo onmoroëejontl GX
_j roiursl jugtl ðtgf pere romos besoemes nl prltlilfl GXv= , quo tejbçj ostå mgsplnêvof
nl Gptebfos, ç l roiursl mo NE].
L roiursl mo NE] ç ejpfejonto utgfgzeml o tefvoz tonde sgml uj mls roiursls mosonvlf-
vgmls pere l prltlilfl GXv= quo plr ilnsoquànige eujontlu e vgme ml GX v= o emglu e gjpfo-
jonteëél ml GXv3.
Lutrl plntl ml NE] quo ç rofovento ç l cetl mo quo jugtls emjgngstremlros essujo quo l NE]
slzgndl ç uj cetlr mo sokurenëe gnebefåvof. Ne pråtgie, tor uje romo etrås ml NE] plmo e`umer
l ilniogtl mo sokurenëe mo Xorêjotrl oj efkuns jljontls, jes uje romo etrås mo uj NE]
nél ostå gnefienëåvof0 oxgstoj vårges ejoeëes besoemes oj tçingies mo etequos e ifgontos quo
prlvej gssl, iljl plr oxojpfl vufnorebgfgmemos oj nevokemlros. Lutrl blj oxojpfl sél ls
jefweros quo utgfgzej e tçingie mo ‖ilnnoit beia‚ pere plssgbgfgter eiossl rojltl.
L GXtebfos toj e tebofe NE] momgieme e ilntrlfej l uxl mo peiltos quo mojenme e tre-
muëél mls onmoroëls quo etrevossej l iùmgkl mo rltoejontl cogtl pofl aornof ml Fgnux. Osso
roiursl ç plssêvof mo sor gjpfojonteml mo tràs clrjes, es quegs plmojls idejer mo ‖idegns‚0
5 XRORL_]GNK0 jengpufeëél mls metekrejes quo idokej me gntornot pere uj sorvgmlr
oj uj porêjotrl gntornl, nlrjefjonto utgfgzeme pere Net rovorsl1
5 L_]X_]0 ç e jengpufeëél mls metekrejes quo tàj lrgkoj ne prùprge jåqugne roweff o
etç plmoj etonmor è rokres mo ropesso quo noiossgtoj mo tremuëél GX1
5 XLY]RL_]GNK0 jengpufeëél mls metekrejes mo uj porêjotrl gntornl ilj mostgnl è
gntornot, noiossgtenml mo tremuëél GX.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 217/282
285
I e p ê t u f l
4 - Y o k u r e n ë e m o X o r ê j o t r l ’ X e r t o 2
Oxojpfl mo perejotrgzeëél mo uj Jesierejontl (GX jesquoremgnk), me romo gntorne
58.8.8.8/53 pere e gntornot0
# gptebfos ’E CLR[ERM ’s 58.8.8.8/53 ’` EIIOX]
# gptebfos -t net -E XLY]RL_]GNK ’l otd5 -s 58.8.8.8/53 -̀
JEYU_OREMO
# oidl ‖5‚ >/prli/sys/not/gpv=/gp\clrwerm
E rokre mo jesierejontl entorglr toj iljl lb`otgvl porjgtgr quo tlme e romo 58.8.8.8/53
plsse segr pere e gntornot ilj l uxl mo peiltos ilj seême mongme pofe gntorceio otd5, quo
ç e gntorceio ilj GX mo gntornot nosso oxojpfl.
E roefgzeëél mo tremuëél mo GX gnvåfgml (nél rltoåvof ne gntornot) pere våfgml (rltoåvof ne
gntornot) ne seême o l gnvorsl nl rotlrnl mo ieme metekreje plmo sor roefgzeme ilj l jùmufl
JEYU_OR EMO, jes ç våfgml fojbrer quo l JEYU_OREMO ç uje clrje ospoigef ‖Ylurio
Net/YNE]‚. L JEYU_OREMO movo sor useml quenml l GX me gntorceio quo ostå ilnoiteme è
gntornot ç ilnkureml mgnejgiejonto. _j oxojpfl ifåssgil sél es ilnoxÿos EMYF. Uuenml
l GX clr xl, iljl ç iljuj oj uj fgna momgieml, l roiljonmåvof ç user l YNE]. Yokuo uj
oxojpfl cogtl ilj l YNE] oqugvefonto è slfuëél ilj JEYU_OREMO oxojpfgieme0
# gptebfos ’E CLR[ERM ’s 58.8.8.8/53 ’` EIIOX]
# gptebfos -t net -E XLY]RL_]GNK -s 58.8.8.5 -l otd8 -` YNE] ’-tl
288.5.2.9
# oidl ‖5‚ >/prli/sys/not/gpv=/gp\clrwerm
Lbsorvo quo nl iesl ml YNE] l GX `å ç prç-mongml o, nl iesl ml JEYU_OREMO,
devorå uje ilnsufte pere gmontgier l GX me gntor ceio.
Xere fgster es plfêtgies mo NE] etgves, movo-so gnclrjer e tebofe, ilnclrjo oxojpfgieml0
# gptebfos ’t net ’n -F
Lutre plssgbgfgmemo mo tremuëél mo onmoroël mo metekrejes etrevçs ml usl ml roiursl
YNE] ç ospoigier cegxes mo onmoroëls o plrtes quo sorél substgtuêmes ne seême ml mete-
kreje useml pofe gntorceio mongme0
# gptebfos -t net -E XLY]RL_]GNK -s 58.8.8.8/53 -l otd8 -` YNE] ’-tl
288.5.2.5-288.5.2.9.=
Xlmo-so egnme promongr uje cegxe mo plrtes0
# gptebfos -t net -E XLY]RL_]GNK ’p 3 -s 58.8.8.8/53 -l otd8 ’̀ YNE]--tl 288.5.2.5-288.5.2.9.=09?888-9??88
Uuenml ç mongml uje renko mo plrtes o GXs, gntornejonto usejls uj efklrgtjl besoeml
oj igriufer (rlunm rlbgn) pere tremuëél ml onmoroëejontl (NE]) mo ieme ilnoxél.
Lutre clrje ðtgf mo NE] ç l Rovorsl, lnmo so moso`e pubfgier uje plrte mo uj sorvgmlr
gntornl pere e gntornot . So`e ls oxojpfls0
Rokre pere ontreme ml uxl mo peiltos0
# gptebfos -t net -E XRORL_]GNK ’g otd5 ’p 3 ’m 288.5.2.5 ’-mplrt 48
-̀ MNE] ’-tl-mostgnetgln 58.8.8.2048
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 218/282
282
D e r m o n g n k o j F
g n u x
Rokre pere seême ml uxl mo peiltos0
# gptebfos ’t net ’E XLY]RL_]GNK ’l otd8 ’p 3 ’s 58.8.8.5 ’-splrt 48
’` YNE] ’-tl-slurio 288.5;8.289.34048
Iesl l emjgngstremlr quogre cezor l tretejontl ml NE] mo uje romo mo clrje jegs ros-
trgtgve, beste epones mongr es plrtes o ls prltlilfls ls quegs moso`e-so porjgtgr quo sues
rospoitgves iljungieëÿos so`ej tretemes pofe rokre mo NE] pere tor eiossl è gntornot. So`e
l oxojpfl mes plrtes 48, 558 o 5=290
gptebfos -t net -E XLY]RL_]GNK -s 58.8.8.8/53 -p 3 --splrt 48 --mplrt
582=03??9? -` YNE] ’-tl Y288.5.2.9
gptebfos -t net -E XLY]RL_]GNK -s 58.8.8.8/53 -p 3 --splrt 558
--mplrt 582=03??9? -` YNE] ’-tl 288.5.2.9
gptebfos -t net -E XLY]RL_]GNK -s 58.8.8.8/53 -p 3 --splrt 5=9
--mplrt 582=03??9? -` YNE] ’-tl 288.5.2.9
Xlmojls user l roiursl mo ‖juftgplrt‚ iljbgnenml tejbçj ilj ‖XLY]RL_]GNK‚.
Oxojpfl0
gptebfos -t net -E XLY]RL_]GNK -p 3 -s 58.8.8.8/53 -j
juftgplrt --splrt 582=03??9? -m 8/8 -j juftgplrt --mplrt
28,25,22,29,2?,48,558,5=9,==9 -` YNE] ’-tl 288.5.2.
]rebefdenml ilj romgroiglnejontl mo plrtes
L romgroiglnejontl mo plrtes plssgbgfgte jlmgier ilnoxÿos ilj mostgnl e uje plrte
mongme pere lutre plrte ne josje jåqugne. L roiursl mo ROMGROI] ç useml pere cezor l
romgroiglnejontl perejotrgzenml e plrte ilj lpëél ‖- - tl-plrt‚.
_j oxojpfl boj pråtgil mo utgfgzeëél mo romgroiglnejontl sorge pere ostebofoior uj
prlxy trensperonto, romgroiglnenml quefquor ilnoxél mostgneme e 48 pere e plrte ml Xrlxy.
So`e l oxojpfl e sokugr0
# gptebfos -t net -E XRORL_]GNK -g otd8 -p tip --mplrt 48 -`
ROMGROI] --tl-plrt 9524
Ionårgl NE] 50 uje jåqugne toj mues gntorceios mo romo otd8 o otd5. Osso Dlst ostå so
iljungienml ilj e romo gntorne (FEN) mo uje ojprose o ilj e gntornot el josjl tojpl,
sonml quo l onmoroël GX me gntorceio otd8 ç 572.534.288.9?, osse gntorceio so iljungie ilje romo gntorne, l onmoroël GX me gntorceio otd5 ç 288.28=.8.53= (GX våfgml) o osse gntorceio
ostå mgrotl ne gntornot. L lb`otgvl ç iljpertgfder e gntornot pere tlmes es jåqugnes me romo
572.534.288.8/2=. Ofeblro uj sirgpt quo oxoiuto osse teroce0
# vg net.sd
XC:$(wdgid gptebfos)
gc Q -z $XC Z 1 tdon
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 219/282
289
I e p ê t u f l
4 - Y o k u r e n ë e m o X o r ê j o t r l ’ X e r t o 2
oidl ‖Iljenml gptebfos nel onilntreml‚
oxgt
cg
cuni\net ()
{
$XC -t net -E XLY]RL_]GNK -s 572.534.288.8/2= -l otd5 -` YNE] ’-tl
288.28=.8.53=
}
cuni\net
# ./net.sd
Ionårgl NE] 20 oxojpfgienml l usl mo irgeëél mo idegn o l usl mo rokres ilj osteml
mo ilnoxél pere irger uje cunëél quo veg gnirojonter es plrtes e pertgr mo uj erqugvl
oxtornl, ilnsgmorenml ls peiltos lrgunmls ne romo gntorne ilj mostgnl è gntornot0
XC:$(wdgid gptebfos)
$XC -N EFFL[\]IX
NO]:‚8/8‚
JGNDENO]:‚572.534.288.8/2=‚
IFG:‚582=03??9?‚
$XC -E EFFL[\]IX -p 3 --syn -` EIIOX]
$XC -E EFFL[\]IX -p 3 -j steto --steto NO[,OY]EBFGYDOM,ROFE]OM -`
EIIOX]
$XC -E EFFL[\]IX -p 3 ! --syn -j steto --steto NO[ -` FLK --flk-
procgx ‖Now nlt syn0‚
$XC -E EFFL[\]IX -p 3 ! --syn -j steto --steto NO[ -` MRLX
clr XLR]E gn $(iet /oti/cw/plrtesifg.tip | krop -v ^#)
ml
$XC -E CLR[ERM -@ EFFL[\]IX -s $JGNDENO] -m 8/8 - -splrt $IFG - -
mplrt $XLR]
mlno
$XC -t net -E XLY]RL_]GNK -s $JGNDENO] -l otd5 -` YNE] ’-tl 288.28=.8.53=
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 220/282
28=
D e r m o n g n k o j F
g n u x
Jlngtlrejontl mes ilnoxÿos cogtes ne tebofe NE]
]lme e etgvgmemo mo tremuëél mo GXs ç rokgstreme nl erqugvl /prli/not/gp\ilnntreia , sonml
plssêvof ilnsufter osso rokgstrl. Xere vgsuefgzer l usl ml iljenml0
# iet /prli/not/gp\ilnntreia
Yorél fgstemes tlmes es ilnoxÿos quo ostél sonml tretemes pofl jùmufl NE]. Lutre clrje
gntorossento ç mogxer xeme e seême oj uj torjgnef quo nél ostå oj usl0
# tegf ’c /prli/not/gp\illntreia >> /mov/tty52 &.
_senml e ]ebofe Jenkfo
_j roiursl plmorlsl ml gptebfos ç e iepeigmemo mo roosirovor veflros mo iejpls osson-
igegs mo uj metekreje. Ç ov gmonto quo mogxejls mo sgjpfosjonto cezor uj rltoejontl
gntofgkonto e pertgr mo plfêtgies promongmes. Nosso nêvof mo tretejontl, l metekreje sorå
‖roilnstruêml/roosirgtl‚, lu so`e, roosirgtl, l quo, gngigefjonto, lbsorvenml mo uje clrje
jegs mgrote, ç uj ùtgjl roiursl, jes so vlià ç uje mequofes possles quo klste mo ros-
susigter jåqugnes ilj Fgnux, ontonme quo e jengpufeëél mo metekrejes mojenme jegsuj pluil mo prliossejontl. Moponmonml ml nêvof mo tråcokl, tefvoz nél so`e gntorossento
utgfgzer ls roiursls me tebofe Jenkfo1 lu, egnme, so e jåqugne oj quostél clr uj roweff
mo crlntogre1 plr lutrl feml, sor clr uj dermwero ilj ble iepeigmemo mo prliossejontl,
usucrue mosso roiursl. Xlmo-so utgfgzer ls roiursls me tebofe jenkfo ilj XRORL_]GNK,
CLR[ERM o L_]X_].
_j blj oxojpfl mo ut gfgzeëél me tebofe jenkfo ç e plssgbgfgmemo mo jengpufeëél ml
iejpl ]LY (]ypo lc Yorvgio) utgfgzenml e lpëél - -sot-tls ]LY, quo mono e nlve pr glrgmemo
mls peiltos tonml iljl beso l ]LY. Ls veflros eiogtls sél ls sokugntos pere ]LY0
5 Ospore Jêngje0 ç Jgngjgzo-Mofey, 53 lu 8x581
5 Jåxgjl Xrliossejontl0 ç Jexgjgzo-]drlukdput, 4 lu 8x841
5 Jåxgje Ilnenëe0 ç Jexgjgzo-Rofgebgfgty, = lu 8x8=1
5 Iustl Jêngjl0 ç Jgngjgzo-Ilst, 2 lu 8x821
5 Xrglrgmemo Nlrjef0 ç Nlrjef-Yorvgio, 8 lu 8x88.
_j metekreje ç mongml plr pemrél ilj l veflr ]LY e`usteml iljl prglrgmemo nlrjef
(bgts e`ustemls pere 8x88). Ilj l roiursl, plmojls jengpufer osso iejpl eujontenml e
prglrgmemo e sor meme el metekreje1 plr lutrl feml, osse jengpufeëél nél cez krenmo mgco-
ronëe ne gntornot, plgs nél ç plfêtgie mls rltoemlros mo crlntogre o jugtl jonls mo sgstojes
eutýnljls treteroj mosso iejpl. Xofl jonls nl sou ketowey osse plfêtgie cerå mgcoronëe.
Oxojpfgienml l usl ml jenkfo el mongr prglrgmemo jêngje pere ls rospoitgvls prltlilfls0
Xrltlilfl C]X0
Metekrejes jlntemls ne prùprge jåqugne C groweff0
# gptebfos -t jenkfo -E L_]X_] -l otd8 -p 3 --mplrt 25 -` ]LY --sot-
tls 8x58
Metekrejes quo etrevossej e jåqugne pere lutre romo0
# gptebfos -t jenkfo -E CLR[ERM -l otd8 -p 3 --mplrt 25 -` ]LY
--sot-tls 8x58
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 221/282
28?
I e p ê t u f l
4 - Y o k u r e n ë e m o X o r ê j o t r l ’ X e r t o 2
Metekrejes quo etrevossej e jåqugne segnml pere e gntornot0
# gptebfos ’t jenkfo ’E XLY]RL_]GNK ’l otd8 ’p 3 ’-mplrt 25 ’` ]LY
’-sot-tls 8x58
Xrltlilfl ]ofnot
Metekrejes jlntemls ne prùprge jåqugne roweff0
# gptebfos -t jenkfo -E L_]X_] -l otd8 -p 3 --mplrt 29 -` ]LY --sot-
tls 8x58
Metekrejes quo etrevossej e jåqugne pere lutre romo0
# gptebfos -t jenkfo -E CLR[ERM -l otd8 -p 3 --mplrt 29 -` ]LY
--sot-tls 8x58
Metekrejes quo etrevossej e jåqugne segnml pere e gntornot0
# gptebfos ’t jenkfo ’E XLY]RL_]GNK ’l otd8 ’p 3 ’-mplrt 29 ’` ]LY
’-sot-tls 8x58
Xrltlilfl MNY
Metekrejes jlntemls ne prùprge jåqugne roweff0
# gptebfos -t jenkfo -E L_]X_] -l otd8 -p 5; --mplrt ?9 -̀ ]LY
--sot-tls 8x58
Metekrejes quo etrevossej e jåqugne pere lutre romo0
# gptebfos -t jenkfo -E CLR[ERM -l otd8 -p 5; --mplrt ?9 -` ]LY
--sot-tls 8x58
Metekrejes quo etrevossej e jåqugne segnml pere e gntornot0
# gptebfos ’t jenkfo ’E XLY]RL_]GNK ’l otd8 ’p 5; ’-mplrt ?9 ’` ]LY
’-sot-tls 8x58
Xrltlilfl GRI
Metekrejes jlntemls ne prùprge jåqugne roweff0
# gptebfos -t jenkfo -E L_]X_] -l otd8 -p 3 --mplrt 3333-3334 -` ]LY
--sot-tls 53
Metekrejes quo etrevossej e jåqugne pere lutre romo0
# gptebfos -t jenkfo -E CLR[ERM -l otd8 -p 3 --mplrt 3333-3334 -`
]LY --sot-tls 53
Metekrejes quo etrevossej e jåqugne segnml pere e gntornot0
# gptebfos ’t jenkfo ’E XLY]RL_]GNK ’l otd8 ’p 3 ’-mplrt 3333-3334
’` ]LY ’-sot-tls 53
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 222/282
283
D e r m o n g n k o j F
g n u x
Xrltlilfl C]X-Mete
Metekrejes jlntemls ne prùprge jåqugne C groweff0
# gptebfos -t jenkfo -E L_]X_] -l otd8 -p 3 --mplrt 28 -` ]LY --sot-
tls 4
Metekrejes quo etrevossej e jåqugne pere lutre romo0
# gptebfos -t jenkfo -E CLR[ERM -l otd8 -p 3 --mplrt 28 -` ]LY
--sot-tls 4
Metekrejes quo etrevossej e jåqugne segnml pere e gntornot0
# gptebfos ’t jenkfo ’E XLY]RL_]GNK ’l otd8 ’p 3 ’-mplrt 28 ’` ]LY
’-sot-tls 4
Xrltlilfl GIU
Metekrejes jlntemls ne prùprge jåqugne roweff0
# gptebfos -t jenkfo -E L_]X_] -l otd8 -p 5; --mplrt =888 -` ]LY
--sot-tls 8
Metekrejes quo etrevossej e jåqugne pere lutre romo0
# gptebfos -t jenkfo -E CLR[ERM -l otd8 -p 5; --mplrt =888 -` ]LY
--sot-tls 8x58
Metekrejes quo etrevossej e jåqugne segnml pere e gntornot0
# gptebfos ’t jenkfo ’E XLY]RL_]GNK ’l otd8 ’p 5; ’-mplrt =8885 ’`
]LY ’-sot-tls 8x58
Xrltlilfl YYD
Metekrejes quo etrevossej e jåqugne pere lutre romo0
# gptebfos -t jenkfo -E CLR[ERM -l otd8 -p 3 --mplrt 22 -` ]LY
--sot-tls 53
Metekrejes quo etrevossej e jåqugne, segnml pere e gntornot0
# gptebfos ’t jenkfo ’E XLY]RL_]GNK ’l otd8 ’p 3 ’-mplrt 22 ’` ]LY
’-sot-tls 53
Xere fgster es plfêtgies mongmes ne tebofe jenkfo0
# gptebfos ’nF ’t jenkfo
Mongnml plfêtgies e pertgr ml Jei Emmross, oxojpfl lnmo ilncoro ilj e jåqugne l onmo-
roël otdornot gkuef e 8808I03O05;05E0O3.
# gptebfos -t cgftor -E GNX_] -j jei --jei-slurio 880480EM0B203808B
-` MRLX
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 223/282
28;
I e p ê t u f l
4 - Y o k u r e n ë e m o X o r ê j o t r l ’ X e r t o 2
Enefgsenml l ilntoðml mls metekrejes
L GXtebfos plssgbgfgte e vor gieëél ml ilntoðml mo uj metekreje etrevçs ml jùmufl Ytgnk
o e mongëél ml quo sorå cogtl ilj osso peilto, lu so`e, nosso ilntoxtl, l Gptebfos tlrne-so
uj roweff quo etue ne Iejeme ; (LYG/GYL).
Ojblre e prlplste so`e mo uje enåfgso råpgme, l tretejontl mojenme uje enåfgso ml iln-
toðml mo ieme peilto quo etonme è plfêtgie ostebofoigme. So`e l oxojpfl e sokugr0
Aezee
# gptebfos -E CLR[ERM -j strgnk --efkl bj --strgnk ‖T-Aezee‚ -̀
MRLX
# gptebfos -E CLR[ERM -j strgnk --efkl bj --strgnk ‖T-Aezee‚ -̀
FLK ’flk-procgx ‖AEPEE‚
Erqugvls .oxo
# gptebfos -E GNX_] -j strgnk --efkl bj --strgnk ! ‖.oxo‚ -` MRLX
# gptebfos -E GNX_] -j strgnk --efkl bj --strgnk ! ‖.oxo‚ -` FLK -
-flk-procgx ‖ERU .OTO‚
Erqugvls .oxo
# gptebfos -E GNX_] -j strgnk --efkl bj --strgnk ! ‖.oxo‚ -` MRLX
# gptebfos -E GNX_] -j strgnk --efkl bj --strgnk ! ‖.oxo‚ -` FLK -
-flk-procgx ‖ERU .OTO‚
Erqugvls .ilj
# gptebfos -E GNX_] -j strgnk --efkl bj --strgnk ! ‖.ilj‚ -` MRLX
# gptebfos -E GNX_] -j strgnk --efkl bj --strgnk ! ‖.ilj‚ -` FLK -
-flk-procgx ‖ERU .ILJ
Erqugvls .pgc
# gptebfos -E GNX_] -j strgnk --efkl bj --strgnk ! ‖.pgc‚ -` MRLX
# gptebfos -E GNX_] -j strgnk --efkl bj --strgnk ! ‖.pgc ‖ -` FLK -
-flk-procgx ‖ERU .XGC‚‚
Oxojpfl mo usl ml jùmufl ‖strgnk‚ pere bflquoer l Ceioblla0
gptebfos -G CLR[ERM -j strgnk --efkl bj --strgnk ‖ceioblla.ilj‚ -̀
MRLX
gptebfos -G L_]X_] -j strgnk --efkl bj --strgnk ‖ceioblla.ilj‚ -̀
MRLX
Ojblre so`e plssêvof bflquoer ossos tgpls mo erqugvls vge GX]ebfos, ne jeglrge mls iesls ç
roiljonmåvof roefgzer osso tgpl mo tretejontl ilj uj sorvgmlr Xrlxy wob iljl l squgm.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 224/282
284
D e r m o n g n k o j F
g n u x
]lmevge, tejbçj ç roiljonmeml gjpfojonter rokres rêkgmes nes osteëÿos mo trebefdl
pere prgjogrl gjplssgbgfgter gnstefeëÿos mo epfgietgvls pofl usuårgls o tejbçj fgjgter e
oxoiuëél mo bgnårgls. Oj suje, nél so movo mogxer ossos irgtçrgls mo sokurenëe oxifusgve-
jonto slbro e rosplnsebgfgmemo mls mgsplsgtgvls quo iugmej me sokurenëe nl porêjotrl
me romo, josjl plrquo dl`o, ilj ls mgsplsgtgvls jùvogs, l porêjotrl mo sokurenëe
tejbçj so ostonmo ès possles.
Xlrt Anliagnk ’ Ilniogtl o pråtgie
Ç uj jçtlml utgfgzeml pere, e pertgr mo uje soquànige mo peiltos ospoiêils, oxoiuter uje
rokre prç-mongme nl roweff pere plssgbgfgter e roefgzeëél mo uje ilnoxél quo etç ontél
osterge coideme. Nlrjefjonto, uj emjgngstremlr use osso roiursl pere plrtes mo sorvgëls
mo flkgn rojltl iljl YYD.
_j correjonte gntorossento pere e roefgzeëél mosse ilnkureëél ç l ANLIAM, sou erqugvl
mo ilnkureëél /oti/anliam.ilnc 0
QlptglnsZ
flkcgfo : /ver/flk/anliam.flk
QlponYYDZ
soquonio : ;888,4888,7888
soq\tgjolut : ?
iljjenm : /sbgn/gptebfos -E GNX_] -s %GX% -p tip --mplrt 22
-` EIIOX]
tipcfeks : syn
QiflsoYYDZ
soquonio : 7888,4888,;888
soq\tgjolut : ?
iljjenm : /sbgn/gptebfos -M GNX_] -s %GX% -p tip --mplrt 22
-` EIIOX]
tipcfeks : cgn
Gjplrtento fojbrer quo ç noiossårgl eftorer l veflr me vergåvofbllfoene Y]ER]\ANLIAM nl erqugvl mo ilncgkureëél /oti/moceuft/anliam .
################################################
## anliam‗s moceuft cgfo, clr konorgi sys ilncgk
################################################
# ilntrlf gc wo stert anliam et gngt lr nlt
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 225/282
287
I e p ê t u f l
4 - Y o k u r e n ë e m o X o r ê j o t r l ’ X e r t o 2
# 5 : stert
# enytdgnk ofso : mln‗t stert
Y]ER]\ANLIAM:5
# iljjenm fgno lptglns_tgfgzenml e plrte0
dpgnk -p ;888 -i 5 --syn 572.534.5.555
dpgnk -p 4888 -i 5 --syn 572.534.5.555
dpgnk -p 7888 -i 5 --syn 572.534.5.555
Mosetgvenml e plrte0
dpgnk -p 7888 -i 5 --cgn 572.534.5.555
dpgnk -p 4888 -i 5 --cgn 572.534.5.555
dpgnk -p ;888 -i 5 --cgn 572.534.5.555
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 226/282
258
D e r m o n g n k o j F
g n u x
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 227/282
255
I e p ê t u f l 4 - R l t o g r l m o E t g v g m e m o s 4
Rltogrl mo Etgvgmemos 4
Xråtgie mo iustljgzeëél mls irgtçrgls mo eutontgieëél o usl mo efkuns roiursls etrevçs mls
jùmufls mo Aornof o e correjonte GXtebfos. Yorå noiossårgl quo l efunl ut gfgzo e jåqugne
vgrtuef propereme iljl Sgrtueblx. Mosse clrje, sorå plssêvof epfgier tlmls ls ilndoig-jontls (tçingies o correjontes) mo Yokurenëe mo Xorêjotrl prlplstls etç l jljontl.
Etgvgmemo 4.5 ’ Dermongnk Fgnux ’ Cgroweff Fgnux
5. Ilnsgmorenml l feylut me romo me kure e sokugr, irgo uj sirgpt mo roweff pere l
Yorvgmlr Esfej, quo movorå sor gnstefeml nl /oti/gngt.m o cuniglner nl bllt me jåqugne
eutljetgiejonto nl Runfovof mongml, etontl ès rospoitgves plfêtgies0
Sgtùrge Cgfgef R@
EYFEJFgnux BLTCgroweff/SXNGMY / XrlxyKetowey282.5.2.2
282.5.2.9572.534.28.2?9
DoxebytoFgnux BLTSXN/CgroweffNGMY/DGMYXrlxyKetowey28?.8.8.2?=5?.8.8.2?=
Xyrl
Fgnux BLT
Yorvgmlr mo
Erqugvls
572.534.8.2?5
@ubgfou
Fgnux BLT
Yorvgmlr mo
Gjprossél
572.534.8.2?2
Nlrtunl
Yorvgmlr
MDIX
Gntrenot
572.534.8.2?9
Ngn`e
Fgnux BLT
Cgroweff
GMY / Xrlxy
Romo porgcçrgie 572.534.28.8/2=
Yorvgmlros Gntornls (FEN)
Osteëÿos
BefbleFgnux BLT
CgroweffDGMYYorvgmlr[obMNY 5
EplfflFgnux BLT
CgroweffDGMYYorvgmlrMNY 2N]X
RliayFgnux BLT
CgroweffDGMYYJ]X/XLX9GJEX=Entgvêrus[objegf
JgiaoyFgnux BLT
CgroweffGMY YnlrtNossusYorvgmlrNotsegnt
GX Såfgml
NE]
GX Gnvåfgml
Yorvgmlros FEN
Ywgtid
BerbevlroFgnux BLT
CgroweffNGMYXrlxyKetowey
Jlmoj EMYFRlutor
swgtid/dub
BgtPorl
Fgnux BLT
Yorvgmlr mo
Gjprossél
5?.8.8.2?5
BgtLno
Fgnux BLT
Yorvgmlr mo
Erqugvls
5?.8.8.2?8
Osteëÿos
swgtid/dub
Cgkure 4.2Irgeëél mo sirgpt
mo roweff pere lYorvgmlr Esfej.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 228/282
252
D e r m o n g n k o j F
g n u x
5 E Xlfêtgie beso sorå0 ‖]uml l quo nél clr moifereml iljl porjgtgml, `å ostå oxprosse-
jonto nokeml‚ (MRLX)1
5 ]lmes e ilnoxÿos iljl lrgkoj lu mostgnl ne Fllpbeia sél porjgtgmes1
5 Yù porjgtgrå tråcokl pere e gntornot lrgunml me romo 572.534.8.8/2=, quo sorå rltoeme
pofl Yorvgmlr Berbevlro ilj mostgnl è gntornot, tretenml l osteml mo ilnoxél oj tebofe
è perto (usenml l roiursl mo ‖idegns‚), ilj oxioëél mo ilnoxÿos mostgnemes els sorvgëls
D]]X, D]]XY o C]X1
5 Eiogte ilnoxél SXN GXYOI ontro ls sorvgmlros Esfej (GX 282.5.2.9) o Doxebyto
(28?.8.8.2?=), tretenml ED o OYX1
5 L sorvgmlr Esfej (GX 282.5.2.9) tejbçj sorå prlxy trensperonto pere ilnoxÿos ilj
mostgnl e sorv gëls D]]X, D]]XY o C]X, eiogtenml ilnoxÿos sljonto lrgunmes me romo
572.534.8.8/2=, quo sorél rltoemes pofl sor vgmlr Berbevlro1
5 Uuefquor etgvgmemo mo tontetgve mo ilnoxél iu`l mostgnl so`e l sorvgmlr Esfej movorå
sor rokgstreme, so`e ilj lrgkoj ne gntornot lu ne romo gntorne, ilj oxioëél ml sorvgmlr
Jgiaoy (572.534.28.=)1
5 Yljonto Yorvgmlr Eplffl roefgzerå sgnirlngzeëél ilj sorvgmlros N]X oxtornls. Ls mojegs
sorvgmlros me Romo Xorgcçrgie sgnirlngzerél sous rofùkgls e pertgr ml sorvgmlr Eplffl1
5 L Yorvgmlr Jgiaoy plmorå ostebofoior ilnoxÿos ilj sorvgmlr ml prl`otl Nossus o ml
Ngatl pere etuefgzeëÿos mls pfukgns1
5 Oj quegs etgvgmemos es plrtes emjgngstretgves (v gmo tebofe 5) movorél sor rokgstremes
(flks) o ro`ogtemes ilj ilntrlfo mo fgjgto, ilj oxioëél e ilnoxÿos gngigemes me pertgr ml
sorvgmlr Jgiaoy (572.534.28.=)1
Xlrte Xrltlilfl Ro`ogter ilj
?5= - Yysflk _MX GIJX 9/9
22 - YYD ]IX ]IX/RY]
29 - ]ofnot ]IX ]IX/RY]
4888 - Ntlp ]IX ]IX/RY]
58888 - [objgn ]IX ]IX/RY]
5 Yljonto eiogterå ilnoxÿos mo ifgontos lrgunmes me gntornot pere ls me Romo Xorgcçrgie
mostgneme ès sues rospoitgves plrtes mo sorvgël moiferemes (oxifusgvejonto) ne tebofe e
sokugr, tretenml osses ilnoxÿos ne tebofe mo Net.
Yorvgmlr GX Gntornl GX Oxtornl Xrltlilfl Xlrte mo Yorvgël
Befble 572.534.28.5 282.5.2.2 ]IX 48 - D]]X
==9 - D]]XY
_MX ?9 - MNY
Eplffl 572.534.28.2 282.5.2.9 _MX ?9 - MNY
Rliay 572.534.28.9 282.5.2.9 ]IX 2? - YJ]X
558 - XLX9
5=9 - GJEX
==9 - D]]XY
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 229/282
259
I e p ê t u f l 4 - R l t o g r l m o E t g v g m e m o s 4
2. Ofeblro uje ilnkureëél pere l sorvgmlr Berbervlro, essujgnml0
Uuo sljonto luvgrå ne Gntorceio otd8, torå l GX0 572.534.8.2?=, ne lutre gntor ceio otd5
ilj l GX0 572.534.28.2?= o sou ketowey moceuft sorå l sorvgmlr EYFEJ ne gntorceio otd8,
ilj l GX 572.534.28.2?91
9. Ilnsgmorenml l feylut me romo me kure 4.2, irgo uj sirgpt mo roweff pere l sorvgmlr Ber-
bervlro quo movorå sor gnstefeml nl /oti/gngt.m o cuniglner nl bllt me jåqugne eutljetg-iejonto nl Runfovof mongml, etonmonml ès rospoitgves plfêtgies0
=. Ilnkuro uj Xlrt Anliagnk pere plrte 22 nl sorvgmlr Berbervlro.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 230/282
25=
D e r m o n g n k o j F
g n u x
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 231/282
25?
I e p ê t u f l
7 - ] u n g n k m o A o r n o f
l b ` o t g v l s
i l n i o g t l s
7]ungnk mo Aornof
_ser e correjonte sysitf pere ]ungnk mo Aornof1 Ilndoior ]ungnk ne Xgfde ]IX/GX ilj
clil nl prltlilfl ]IX, GIJX o GX1 Ontonmor l Jlmofl JEI mo sokurenëe1 Ilndoior
es correjontes mo JEI pere Fgnux1 _ser ls jùmufls Weje o ]ljlyl mo Yokurenëe1
Epronmor e perejotrgzer l Aornof ml Fgnux ilj e correjonte sysitf, l Aornof ilj
clil ne Xgfde ]IX/GX o l erqugvl /oti/sysitf.ilnc1 Evefger prliomgjontls besoemls nl
jlmofl MEI o JEI mo sokurenëe1 Etgver efkuns ilntrlfos mo JEI besoemls nl Aornof
ml Fgnux.
]ungnk mo Aornof1 ]ungnk me pgfde ]IX/GX ilj clil nl prltlilfl ]IX1 ]ungnk me pgfde
]IX/GX ilj clil nl prltlilfl GIJX.
]ungnk mo Aornof
qCgroweff0
5 Gjplrtento oj uj prl`otl mo romo.
2 Jes movo oster sojpro iljbgneml ilj lutrls pere jofdlrer e sokurenëe.
]ungnk mo sgstoje Knu/Fgnux pere uj sorvgmlr roweff.
L emjgngstremlr mo Ygstoje Knu/Fgnux, el ponser oj gjpfojonter uj roweff ilj Fgnux,
toj mo tor oj jonto quo uj roweff ç cunmejontef oj uj prl`otl mo romo, jes ç uj ofo -
jontl quo epones iljbgneml ilj lutrls veg jofdlrer e sokurenëe prlplste. Mgento mgssl,
ç noiossårgl sebor quo pere jofdlr cuniglnejontl ml roweff, ç noiossårgl iljbgner
roiursls gjplrtentos ml Aornof ilj l quo clg mongml etrevçs ml iljenml Gptebfos.
L lb`otgvl mosto iepêtufl ç eprosonter uje prlplste mo ]ungnk mo uj sgstoje Knu/Fgnux
pere uj sorvgmlr roweff.
Osto iepêtufl ç mgrotejonto vgniufeml el iepêtufl mo roweff1 ontrotentl, plmo sor fgml sopere-
mejonto, plgs sonml l clil e`usto nls etrevçs correjonte sysitf, ofo tlrne-so uj iejgndl mo
epronmgzeml pere e utgfgzeëél mosso gjplrtento roiursl ml Ygstoje Lporeiglnef Knu/Fgnux.
Ilntoxtuefgzenml0 quenml cefe-so oj roefgzer uj ]ungnk, lu so`e, e`ustos nls, tojls quo
ontonmor quo l essuntl ç boj vestl, ontrotentl, e prlplste mosso iepêtufl ç sor uj ilj-
pfojontl el iepêtufl quo tretlu me plssgbgfgmemo mo gjpfojonteëél mo roweff ilj Fgnux.
Yorél eblrmemls prliomgjontls gjplrtentos pere e`ustos nls ml Ygstoje Lporeiglnef
Fgnux tonml oj jonto uj roweff iljl lb`otgvl. Ontrotentl, l prliossl iepeigte l emjgngs-
tremlr e jengpufer tlmes es iepeigmemos mgsplnêvogs ml Aornof quo plssgbgfgtej jlmgieëél
oj tojpl mo oxoiuëél.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 232/282
253
D e r m o n g n k o j F
g n u x
Xere torjls e cuniglnefgmemo pere jlmgieëél mo perâjotrls o vergåvogs mo Aornof oj
tojpl mo oxoiuëél, proigsejls mo ILNCGK\ YWYI]F mongml nl Aornof. Mosteiejls quo
osso roiursl ç pemrél oj uj Aornof 2.= lu suporglr.
Yonml l lb`otgvl l ]ungnk me Yteia ]IX/GX (Xgfde ]IX/GX), vejls jentor l clil oj tràs plntls0
5 ]ungnk ]IX0 mgrotrgzos gjplrtentos pere l tretejontl mo peilto ]IX1
5 ]ungnk GIJX0 mgrotrgzos gjplrtentos pere l tretejontl mo peilto GIJX1 5 ]ungnk GX0 mgrotrgzos gjplrtentos pere l tretejontl iereitorêstgies mo trlie mo
peiltos rofoventos.
E gjplrtânige ml ]ungnk ç jugtl krenmo, plgs uj roweff gjpfojonteml ilj Fgnux, efçj mes
plfêtgies lb`otgves quo sél mongmes ilj l Gptebfos, mojenme tejbçj mongr efkujes lpëÿos
mo tretejontl mls metekrejes ne Xgfde ]IX/GX mo sou Ygstoje Lporeiglnef pere jofdlrer
l mosojpondl ml roweff o e sokurenëe prlplste. Yo uj emjgngstremlr nél roefgze uj
]ungnk pere e gjpfojonteëél mo uj roweff, nél ostå usenml l jofdlr ml sgstoje.
]ungnk ]IX
qXrltlilfl mo ]IX0
5 ]oj iereitorêstgies poiufgeros quo movoj sor fojbremes murento l prliossl mo
]ungnk.
5 Ç iljplstl plr 28 bytos.
2 Xlssuoj gnclrjeëÿos cunmejontegs pere mgiufter lu ovgter etequos mo Nokeëél
mo Yorvgël o tçingies mo GX Ypllnk.
Movgml el osteml mo ilnoxél, l Xrltlilfl mo ]IX toj iereitorêstgies poiufgeros quo
movoj sor fojbremes murento l prliossl mo ]ungnk, plgs ls 28 bytos quo iljpÿo l iebo-
ëefdl tàj gnclrjeëÿos gntorossentos pere uj roweff mo osteml mo ilnoxél (stetocuff) quo
sél cunmejontegs pere mgiufter lu josjl oj jugtls iesls ovgter etequos iljl MLY(me sgkfe oj gnkfàs0 Mongef Lc Yorvgio ’ Nokeëél mo Yorvgël) o tçingies mo GX Ypllcgnk
(cefsgcgieëél mo ieboëefdl GX).
Uuenml ostejls ilnkurenml plfêtgies ilj Gptebfos usenml l jùmufl ‖steto‚, ostejls utg-
fgzenml es iepeigmemos mo tretejontl mo metekrejes vgniufemls ès prlprgomemos mo osteml
mo ilnoxél quo clrej gjpfojontemes nl Notftor.
L Aornof ml Fgnux plssgbgfgte-nls jengpufer efkujes lpëÿos ml Aornof vgniufemls el osteml
me ilnoxél.
Jengpufenml l veflr mo —]gjolut mo ]IX/CGN‗
Sorgienml l veflr pere e mgrotrgz ‖tip\n\tgjolut‚. Fojbrenml quo plmo verger mo eilrmlilj e mgstrgbugëél Fgnux o tejbçj oj rofeëél els lutrls Ygstojes Lporeiglnegs. Sorg-
ienml veflr etuef0
# sysitf -e | krop not.gpv=.tip\cgn\tgjolut
Ç roiljonmåvof jentor uj veflr prùxgjl el ml veflr pemrél, quo ç 38.
# sysitf -w not.gpv=.tip\cgn\tgjolut:?8
Yegbe jegs
Xere e jengpufeëél
ilnsigonto mosses
iepeigmemos, ç proigsl
ilndoior e ostruture
ml sgstoje mo erqugvls
prli. Ls perâjotrls
mo Aornof plmoj soreftoremls etrevçs ml
sgstoje mo erqugvls /
prli lu utgfgzenml e
correjonte sysitf.
f
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 233/282
25;
I e p ê t u f l
7 - ] u n g n k m o A o r n o f
Xere quo osse mgrotrgz so`e mongtgve, ç noiossårgl gnsorg-fe nl erqugvl /oti/sysitf.ilnc .
Sorgquo so e mongëél `å oxgsto.
# iet /oti/sysitf.ilnc | krop -v ^# | krop .
Iesl nél, gnsgre0
# oidl ‖not.gpv=.gtip\cgn\tgjolut :?8‚ >> /oti/sysitf.ilnc
Etgvenml e nlves lpëÿos ilj lpëél ‖-p‚ ml sysitf.
# sysitf -p
Jengpufenml l veflr ml —Aoop Efgvo ]IX‗
E lpëél not.gpv=.tip\aoopefgvo\tgjo plssgbgfgte jengpufer l veflr, quo plr pemrél nl Aornof
2.3 ç mo ;.288 sokunmls, lu so`e, 2d. Jegs uj veflr gjplrtento pere rokres ofeblremes
usenml l roiursl ‖YtetoCuff‚ ml Gptebfos.
Sorgquo l veflr pere e mgrotrgz ‖gp\moceuft\ttf ‚, fojbrenml quo plmo verger mo eilrml ilj e mgs-
trgbugëél Fgnux o tejbçj oj rofeëél els lutrls Ygstojes Lporeiglnegs. Sorgienml veflr etuef0
# sysitf -e | krop not.gpv=.tip\aoopefgvo
L roiljonmåvof ç jentor l veflr konçrgil mo sgstojes, quo ç mo ;.288 sokunmls. Mosse
clrje, vejls etonmor jofdlr l tretejontl mo ilnoxÿos ostebofoigmes. Oj jljontls
irêtgils lnmo l roweff osto`e trebefdenml ilj uje quentgmemo jugtl krenmo mo ilnoxÿos
o l proël pere jentor es gnclrjeëÿos ml osteml mo ilnoxél osto`e jltgvenml quome ne
porclrjenio, l emjgngstremlr plmo mgjgnugr osso tojpl mo clrje e jentor plr uj tojpl
jêngjl es gnclrjeëÿos mo osteml mo ilnoxél. Mgento mosso ionårgl, ç sukorgml iljl veflr
jêngjl eiogtl 5.488 sokunmls. ]lmevge, osse jengpufeëél movo sor cogte ilj ieutofe.
# sysitf -w not.gpv=.tip\aoopefgvo:;288
Xere quo osse mgrotrgz so`e mongtgve, ç noiossårgl gnsorg-fe nl erqugvl /oti/sysitf.ilnc .
Sorgquo so e mongëél `å oxgsto0
# iet /oti/sysitf.ilnc | krop -v ^# | krop .
Iesl nél, gnsgre0
# oidl ‖not.gpv=.tip\aoopefgvo:;288:8‚ >> /oti/sysitf.ilnc
Etgvenml e nlves lpëÿos ilj lpëél ‖-p‚ ml sysitf.
# sysitf -p
Mosfgkenml l —tip\wgnmlw\siefgnk‗
Sorgquo l veflr pere e mgrotrgz ‖tip\wgnmlw\siefgnk‚, quo ç bllfoenl. Roiljonme-so mose-
bgfgter pere mgiufter tçingies mo nkorprgnt.
Seflr pemrél0 not.gpv=.tip\wgnmlw\siefgnk:8. Sorgienml veflr etuef0
# sysitf -e | krop tip\wgnmlw\siefgnk
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 234/282
254
D e r m o n g n k o j F
g n u x
L roiljonmåvof ç jentor l veflr mo 8 (zorl).
# sysitf -w not.gpv=.tip\wgnmlw\siefgnk:8
Xere quo osse mgrotrgz so`e mongtgve, ç noiossårgl gnsorg-fe nl erqugvl /oti/sysitf.ilnc .
Sorgquo so e mongëél `å oxgsto0
# iet /oti/sysitf.ilnc | krop -v ^# | krop .
Iesl nél, gnsgre0
# oidl ‖not.gpv=.tip\wgnmlw\siefgnk:8‚ >> /oti/sysitf.ilnc
Etgvenml e nlves lpëÿos ilj lpëél ‖-p‚ ml sysitf.
# sysitf -p
Mosfgkenml —tip\seia‗
Sorgquo l veflr pere e mgrotrgz ‖tip\seia‚, quo tejbçj plssug veflr bllfoenl, o pere uj
Cgroweff ’ roiljonme-so l veflr 8. Ç gntorossento pere roclrëer e quostél mo tretejontl
mo denmsdeaos.
Sorgienml veflr etuef0
# sysitf -e | krop tip\seia
L roiljonmåvof ç jentor l veflr 8 (zorl)0
# sysitf -w not.gpv=.tip\seia:8
Xere quo osse mgrotrgz so`e mongtgve, ç noiossårgl gnsorg-fe nl erqugvl /oti/sysitf.ilnc .
Sorgquo so e mongëél `å oxgsto0
# iet /oti/sysitf.ilnc | krop -v ^# | krop .
Iesl nél, gnsgre0
# oidl ‖not.gpv=.tip\seia:8‚ >> /oti/sysitf.ilnc
Etgvenml e nlves lpëÿos ilj lpëél ‖-p‚ ml sysitf.
# sysitf -p
Mosfgkenml e lpëél ‖tip\tgjostejps‚0
Sorgquo l veflr pere e mgrotrgz ‖tip\tgjostejps‚, quo toj veflr bllfoenl o movo oster mose -
bgfgteme oj uj Cgroweff Gntorossento pere ovgter nkorprgnt pessgvl.
# sysitf -e | krop tip\tgjostejps
L roiljonmåvof ç jentor l veflr konçrgil mo sgstojes _ngx fgao etuento iljl roweff, quo
movo sor 8 (zorl).
# sysitf -w not.gpv=.tip\tgjostejps:8
Xere quo osse mgrotrgz so`e mongtgve, ç noiossårgl gnsorg-fe nl erqugvl /oti/sysitf.ilnc .
Sorgquo so e mongëél `å oxgsto0
# iet /oti/sysitf.ilnc | krop -v ^# | krop .
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 235/282
257
I e p ê t u f l
7 - ] u n g n k m o A o r n o f
Iesl nél, gnsgre0
# oidl ‖not.gpv=.tip\tgjostejps:8‚ >> /oti/sysitf.ilnc
Etgvenml e nlves lpëÿos ilj lpëél ‖-p‚ ml sysitf.
# sysitf -p
Mosebgfgtenml l veflr mo OIN
L OIN mgz rospogtl e Nltgieëél Oxpfêigte ml Ilnkostgln (OIN), ç mosirgtl ne RCI 9534 o ç
uj pemrél prlplstl me gntornot. ]lmevge, tojls lbsorveml prlbfojes ostrendls sonml
rofetemls oj fgstes mo mgsiussél slbro l usl mosse lpëél pere eiossl e efkuns wobsgtos
ilj rltoemlros quo nél clrnoioj osso tgpl mo gnclrjeëél.
Sorgquo l veflr pere e mgrotrgz ‖tip\oin‚, fojbrenml quo sél veflros quo plmoj sor pes-
semls vge sysitf0
5 80 mosetgve suplrto el OIN1
5 50 mosetgve suplrto el OIN1
5 20 sù enuniger eplgl OIN quenml slfgigteml.
Sorgienml l veflr etuef0
# sysitf -e | krop tip\oin
Jlmgienml l veflr0
# sysitf -w not.gpv=.tip\oin :8
Xere quo osse mgrotrgz so`e mongtgve, ç noiossårgl gnsorg-fe nl erqugvl /oti/sysitf.ilnc .
Sorgquo so e mongëél `å oxgsto0
# iet /oti/sysitf.ilnc | krop -v ^# | krop .
Iesl nél, gnsgre0
# oidl ‖not.gpv=.tip\oin:8‚ >> /oti/sysitf.ilnc
Etgvenml e nlves lpëÿos ilj lpëél ‖-p‚ ml sysitf0
# sysitf -p
Jofdlrenml l tretejontl pere gnêigl mo ilnoxél
Jugtls emjgngstremlros sél vêtgjes mo etequos mo gnunmeëél mo peiltos mo gnêigl mo
ilnoxél, toingiejonto ilndoigmls ilj Yynllm, uje ietoklrge mo etequo mo Nokeëél mo
Yorvgël quo sutgfjonto so eprlvogte me iereitorêstgie mo iljl ls Ygstojes Lporeiglnegs
roefgzej l DenmYdeao ]IX/GX.
Xere iljbetor osso tgpl mo etequo oj sgstoje Fgnux oj jugtls ionårgls, ç proigsl user l
roiursl monljgneml Yynillagos, quo plmo sor etgveml nl Aornof ml F gnux etrevçs me mgrotrgz
‖synillagos‚ o movo sor iljbgneml ilj es mgrotrgzos ‖tip\jex\syn\beiaflk‚, ‖tip\syneia\
rotrgos‚ o ‖tip\eblrt\ln\lvorlw‚.
E lpëél ‖tip\synillagos‚ ç mo veflr bllfoenl o quenml etgveme plssgbgfgte etgver l roiursl
synillagos pere ]IX, uje voz quo oj mgstrgbugëÿos Fgnux ç iljuj quo l Aornof vonde ilj-
pgfeml ilj ILNCGK\YWN\ILLAGOY etgvl, l quo porjgto quo l roiursl synillagos so`e useml
pofl Ygstoje Lporeiglnef tlme voz quo e fe mo syn oxiome l veflr jåxgjl.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 236/282
228
D e r m o n g n k o j F
g n u x
Sorgquo l veflr pere e mgrotrgz ‖tip\synillagos‚ vorgienml l veflr etuef0
# sysitf -e | krop tip\synillagos
L roiljonmåvof ç jentor l veflr 51 mosse clrje, ç etgveml jegs uj joiengsjl quo e`ume
l Ygstoje Lporeiglnef, plmonml sor ðtgf oj jugtes sgtueëÿos mo etequos mo Gnunmeëél mo
peiltos mo Gnêigl mo Ilnoxél (Yynllm).
# sysitf -w not.gpv=.tip\synillagos :5
Xere quo osse mgrotrgz so`e mongtgve, ç noiossårgl gnsorg-fe nl erqugvl /oti/sysitf.ilnc .
Sorgquo so e mongëél `å oxgsto0
# iet /oti/sysitf.ilnc | krop -v ^# | krop .
Iesl nél, gnsgre0
# oidl ‖not.gpv=.tip\synillagos :5‚ >> /oti/sysitf.ilnc
Etgvenml e nlves lpëÿos ilj lpëél ‖-p‚ ml sysitf.
# sysitf -p
Mongnml ‖tip\eblrt\ln\lvorlw ‚0 plssgbgfgte l ieniofejontl mo ilnoxÿos so ls sorvgëls
etgvls clroj mojesgemejonto fontls o gniepezos mo prlssokugr o eiogter e ilnoxél. Foj-
brenml quo osso iljplrtejontl nél ç porjgtgml plr pemrél. Ygkngie quo so l oxiossl
lilrror movgml e uj ostlurl (lvorlw), e ilnoxél plmorå sor rotljeme.
Sorgquo l veflr pere e mgrotrgz ‖tip\eblrt\ln\lvorlw‚ vorgienml l veflr etuef0
# sysitf -e | krop tip\eblrt\ln\lvorcflw
L roiljonmåvof ç jentor l veflr 51 mosse clrje, ç etgveml jegs uj joiengsjl quo e`ume
l Ygstoje Lporeiglnef, plmonml sor ðtgf oj jugtes sgtueëÿos mo etequos mo Gnunmeëél mo
peiltos quo busiej Nokeëél mo Yorvgël (MLY).
# sysitf -w not.gpv=. tip\eblrt\ln\lvorcflw :5
Xere quo osse mgrotrgz so`e mongtgve, ç noiossårgl gnsorg-fe nl erqugvl /oti/sysitf.ilnc .
Sorgquo so e mongëél `å oxgsto0
# iet /oti/sysitf.ilnc | krop -v ^# | krop .
Iesl nél, gnsgre0
# oidl ‖not.gpv=. tip\eblrt\ln\lvorcflw :5‚ >> /oti/sysitf.ilnc
Etgvenml e nlves lpëÿos ilj lpëél ‖-p‚ ml sysitf.
# sysitf -p
Jengpufenml e lpëél —tip\syneia\rotrgos‗
Nðjorl jåxgjl mo tojpl pere quo uj sokjontl mo YWN/EIA pere uje ilnoxél pessgve
ml ]IX so`e rotrensjgtgml. Osso nðjorl nél movo sor jegs ofoveml quo 2??. L veflr mo
pemrél nlrjefjonto debgfgteml nl Aornof ml Fgnux ç ?, quo ilrrosplnmo e 548 sokunmls.
Sorgquo l veflr pere mgrotrgz ‖tip\syneia\ rotrgos‚, idoienml l veflr etuef0
# sysitf -e | krop tip\syneia\rotrgos
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 237/282
225
I e p ê t u f l
7 - ] u n g n k m o A o r n o f
L roiljonmåvof ç jentor l veflr pemrél mo ?.
# sysitf -w not.gpv=. tip\syneia\rotrgos:?
Xere quo osse mgrotrgz so`e mongtgve, ç noiossårgl gnsorg-fe nl erqugvl /oti/sysitf.ilnc .
Sorgquo so e mongëél `å oxgsto0
# iet /oti/sysitf.ilnc | krop -v ^# | krop .
Iesl nél, gnsgre0
# oidl ‖not.gpv=. tip\syneia\rotrgos :?‚ >> /oti/sysitf.ilnc
Etgvenml e nlves lpëÿos ilj lpëél ‖-p‚ ml sysitf.
# sysitf -p
Jengpufenml —tip\jex\syn\beiaflk‗
L nðjorl jåxgjl mls pomgmls mo ilnoxél onfogremls quo nél tàj roiobgml egnme uj
roilndoigjontl ml ifgonto ilnoitenml. Yo osso nðjorl clr oxiomgml, l Aornof iljoëerå e
mogxer mo etonmor pomgmls mo ilnoxél.
L veflr pemrél ç mo 2?3 o ç eujonteml pere 582= quenml e jojùrge etuef nl sgstoje
ç emoqueme, lu so`e, jeglr lu gkuef e 524Jb, o romuzgml pere 524 quenml l sgstoje toj
jojùrge jugtl begxe, lu so`e, jonlr lu gkuef e 92Jb.
Osso tgpl mo gnclrjeëél rojoto l emjgngstremlr e uje moigsél mo jofdlr mgjonsglnejontl
me jojùrge ml sorvgmlr quo etuerå iljl roweff.
Sorgquo l veflr pere e mgrotrgz ‖tip\jex\syn\beiaflk‚, vorgienml veflr etuef0
# sysitf -e | krop tip\jex\syn\beiaflk
L roiljonmåvof ç jentor l veflr pemrél mo ?.
# sysitf -w not.gpv=. tip\jex\syn\beiaflk: 582=
Xere quo osse mgrotrgz so`e mongtgve, ç noiossårgl gnsorg-fe nl erqugvl /oti/sysitf.ilnc .
Sorgquo so e mongëél `å oxgsto0
# iet /oti/sysitf.ilnc | krop -v ^# | krop .
Iesl nél, gnsgre0
# oidl ‖not.gpv=. tip\jex\syn\beiaflk:582=‚ >> /oti/sysitf.ilnc
Etgvenml e nlves lpëÿos ilj lpëél ‖-p‚ ml sysitf.
# sysitf -p
Jengpufenml e lpëél —tip\jex\tw\buiaots‗
L nðjorl jåxgjl mo ‖sliaots‚ nl osteml mo ]GJO\[EG] porjgtgml nl sgstoje. Osso fgjgto
oxgsto pere busier gjpomgr sgjpfos mo etequos mo Nokeëél mo Yorvgëls (MLY).
Sorgquo l veflr pere e mgrotrgz ‖tip\jex\tw\ buiaots‚ pemrél ml sgstoje, quo korefjonto ç
548888. ]lmevge, mgjgnugr osso veflr plmo gjpfgier oj prlbfoje mo por clrjenio oj sorvg-
mlros mo krenmo quentgmemo mo eiossl. Sorgienml l veflr etuef0
# sysitf -e | krop tip\jex\tw\buiaots
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 238/282
222
D e r m o n g n k o j F
g n u x
L roiljonmåvof ç jentor l veflr pemrél.
# sysitf -w not.gpv=.tip\jex\tw\buiaots :548888
Xere quo osse mgrotrgz so`e mongtgve, ç noiossårgl gnsorg-fe nl erqugvl /oti/sysitf.ilnc .
Sorgquo so e mongëél `å oxgsto0
# iet /oti/sysitf.ilnc | krop -v ^# | krop .
Iesl nél, gnsgre0
# oidl ‖not.gpv=.gp\moceuft\ttf:2??:8‚ >> /oti/sysitf.ilnc
Etgvenml e nlves lpëÿos ilj lpëél ‖-p‚ ml sysitf.
# sysitf -p
]ungnk GIJX
Mocgngml rosplste e Xgnk
Ç plssêvof, debgfgtenml e lpëél ‖gijp\oidl\gknlro\eff‚, quo trebefdeve mo clrje ‖bllfoene‚,
lu so`e, ilflienml 5 (uj) etgve e lpëél, 8 (zorl) mosetgve. Ilj l veflr 5 (uj), mongr ilj
quo l Aornof KN_/Fgnux gknlro tlmes es jonsekons Gntornot Ilntrlf Josseko Xrltlilf
(GIJX) ml tgpl 4 (Oidl Roquost) , nél rotlrnenml e jonsekoj GIJX tgpl 8 (Oidl Ropfy) pere
l slfgigtento. Oj suje, ilj l bgt etgvl 5 (uj) nosse lpëél, cerojls ilj quo nonduje gntor-
ceio mo romo (O]D*), o tejbçj e prùprge gntorceio Fllpbeia, rosplnme el iljenml pgnk .
_je ble jltgveëél pere gssl ç quo uj peilto mo GX ierrokenml uje jonsekoj GIJX plmo
ilntor uj peyflem ilj gnclrjeëÿos mgcorontos ml pemrél lu josjl plmo sor utgfgzeml ilj
l prlpùsgtl mo Cgnkorprgnt rojltl vge ]]F.
Xlr pemrél, l veflr mosse lpëél ç 8 (zorl), lu so`e, ç mosetgveml quenml l Aornof ç gngigeml.Jugtls emjgngstremlros nél klstej mo utgfgzer osse lpëél ilj bgt 5, plgs uje voz etgve, nél
ç plssêvof mongr oxioëÿos. Ygjpfosjonto e dlst nél rosplnmo jegs e pgnk.
Ne jeglrge mes sgtueëÿos mo uje FEN, ç roiljonmåvof quo so`e mogxeml l veflr pemrél quo
etç l jljontl voj mongml iljl 8 (zorl) o vge Xlfêtgie mo Cgroweff so`e rostrgtgvl, mongml
pere quegs dlsts e rospoitgve jåqugne rosplnmorå e slfgigteëÿos mo GIJX 4. Xlgs pere ls
emjgngstremlros quo usej l pgnk iljl uje correjonte mo mgeknùstgil, l roiursl ilntg-
nuerå mgsplnêvof. Ontrotentl, nél då jltgvl pere quo uje slfgigteëél mo clre mo uj dlst
quefquor ne gntornot, plr oxojpfl, noiossgto mo rosplste el iljenml pgnk .
Movojls vorgier l veflr pere e mgrotrgz ‖gijp\oidl\gknlro\eff‚ ilj l iljenml sysitf 0
# sysitf -e | krop gknlro\eff
L veflr gmoef pere uj roweff ç 8 (mosebgfgteml), plgs uje voz debgfgteml, tlmes es jonse-
kons GIJX Oidl Roquost sorél gknlremes. Iesl so`e noiossårgl jlmgier l veflr ç plssêvof
oj tojpl oxoiuëél.
# sysitf -w not.gpv=.gijp\oidl\gknlro\eff:8
Xere quo osse mgrotrgz so`e mongtgve, ç noiossårgl gnsorg-fe nl erqugvl /oti/sysitf.ilnc .
Sorgquo so e mongëél `å oxgsto.
# iet /oti/sysitf.ilnc | krop -v ^# | krop .
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 239/282
229
I e p ê t u f l
7 - ] u n g n k m o A o r n o f
Iesl nél, gnsgre0
# oidl‖not.gpv=. not.gpv=.gijp\oidl\gknlro\eff :8‚ >> /oti/sysitf.ilnc
Epùs gnsorgr uje nlve mgrotrgz nl erqugvl /oti/sysitf.ilnc , uso e lpëél ‖-p‚ pere etgvå-fe.
# sysitf -p
Mosfgkenml rosplste mo brlemiest
Xlr sor uj prltlilfl mo tosto GIJX, neturefjonto suplrte tråcokl brlemiest. Gssl sgkngie
quo ç plssêvof sor oniejgndeme uje slfgigteëél mo GIJX tgpl 4 (Oidl Roquost) tentl pere
onmoroël brlemiest iljl pere juftgiest mo uje romo. Nl iesl me slfgigteëél oniejgndeme
pere onmoroël mo brlemiest ç sebgml quo tlmls ls dlsts quo ostgvoroj etgvls rosplnmorél.
Xlmojls utgfgzer e lpëél ‖gijp\oidl\gknlro\brlemiests‚, ilj l iljenml sysitf , l quo pls-
sgbgfgte mosebgfgter rosplste brlemiests mo GIJX, l quo pere uj roweff, rltoemlr, ketowey o
josjl dlsts quo so onilntrej oj uje MJP ç oxtrojejonto roiljonmåvof.
Osse roiljonmeëél voj mls prgjùrmgls me gntornot, lnmo uj etequo sutgf quo so eprlvog-
teve mosse iereitorêstgie mo rosplste mo brlemiest tlrnlu-jo jugtl iljuj0 l etequo ilu
ilndoigml iljl Yjurc Etteia.
Sorgquo l veflr pere e mgrotrgz ‖gijp\oidl\gknlro\ brlemiests‚, fojbrenml quo l veflr pere
uj roweff movo sor 5.
# sysitf -e | krop gknlro\brlemiests
L veflr gmoef pere uj roweff ç 8 (mosebgfgteml), plgs uje voz debgfgteml, tlmes es jonse-
kons GIJX Oidl Roquost sorél gknlremes. Iesl so`e noiossårgl jlmgier l veflr ç plssêvof
oj tojpl oxoiuëél.
# sysitf -w not.gpv=.gijp\oidl\gknlro\brlemiests:5
Xere quo osse mgrotrgz so`e mongtgve, ç noiossårgl gnsorg-fe nl erqugvl /oti/sysitf.ilnc .
Sorgquo so e mongëél ̀ å oxgsto.
# iet /oti/sysitf.ilnc | krop -v ^# | krop .
Iesl nél, gnsgre0
# oidl ‖not.gpv=.gijp\oidl\gknlro\eff:5‚ >> /oti/sysitf.ilnc
Epùs gnsorgr uje nlve mgrotrgz nl erqugvl /oti/sysitf.ilnc utgfgzo e lpëél ‖-p‚ pere etgvå-fe.
# sysitf -p
Mocgngml fgjgtos nl tretejontl mo rosplste e metekrejes GIJX
Xertgnml ml prgniêpgl mo quo uj sorvgmlr rosplnmorå e pgnk (GIJX), ç roiljonmåvof mongr
quentls peiltos nl jåxgjl sorél tretemls pofl Aornof etrevçs me lpëél ‖gijp\retofgjgt‚.
Ilj osse lpëél, plmo-so mongr e quentgmemo mo peiltos quo sorél tretemls ne rospoitgve
`enofe mo tojpl. Osse lpëél trebefde oj iln`untl ilj e lpëél ‖gijp\retojesa‚, quo plssg-
bgfgte perejotrgzer quegs ls tgpls mo GIJX quo movorél sor tretemls plr osso ir gtçrgl.
Sorgquo l veflr pere e mgrotrgz ‖gijp\retofgjgt‚0
# sysitf -e | krop gijp\retofgjgt
Yegbe jegs
_j ‖Yjurc Etteia‚ilnsgstge oj uj etequo
onvger mo peiltosGIJX mgroiglnemls el
brlemiest mo uje romo
lu vårges romos, lnmo
l eteiento utgfgzenml
‖GX Ypllnk‚ clr`e lonmoroël mo lrgkoj ml
metekreje ilflienml
l onmoroël me dlsts
efvl, ilj l lb`otgvl mo
liesglner uj plssêvof
MLY (Mony lc Yorvgio’ Nokeëél mo Yorvgël),
mokremenml l ienef mo
iljungieëél ml dlst
efvl, uje voz quo l
dlst efvl grge roiobor
tlmes es rosplstes
mo GIJX tgpl 8 (Oidl
Ropfey) vgnmes mes
dlsts portoniontos èromo quo l eteiento
onvglu es jonsekons
GIJX tgpl 4 (Oidl
Rosquost).
f
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 240/282
22=
D e r m o n g n k o j F
g n u x
L veflr gmoef pere uj roweff ç 588 `gos (5 `gy:5/588 si), o uje voz debgfgteml, tlmes es
jonsekons GIJX sorél fgjgtemes. Iesl so`e noiossårgl jlmgier l veflr, ç plssêvof oj
tojpl oxoiuëél.
# sysitf -w not.gpv=.gijp\retofgjgt:288
Xere quo osse mgrotrgz so`e mongtgve, ç noiossårgl gnsorgr osse mongëél nl erqugvl /oti/
sysitf.ilnc . Sorgquo so e mongëél `å oxgsto.
# iet /oti/sysitf.ilnc | krop -v ^# | krop .
Iesl nél, gnsgre0
# oidl ‖not.gpv=.gijp\retofgjgt:588‚ >> /oti/sysitf.ilnc
Epùs gnsorgr uje nlve mgrotrgz nl erqugvl /oti/sysitf.ilnc , utgfgzo e lpëél ‖-p‚ pere etgvå-fe.
# sysitf -p
Sorgquo l veflr pere mgrotrgz ‖gijp\retojesa‚0
# sysitf -e | krop gijp\retojesa
L veflr pemrél ‖gijp\retojesa‚ ç 3534, rosuftento ml veflr 2 ofoveml e ‖n‚ pere ieme tgpl
GIJX, lu so`e0
gijp\retojesa:(2^9 + 2^= + 2^55 + 2^52):3534
Essgj, sljonto ls metekrejes GIJX ml tgpl 9, =, 55, 52 sorél fgjgtemls pofl veflr me mgrotrgz
‖gijp\retofgjgt‚.
Mosse clrje, so qugsorjls fgjgter GIJX Oidl-ropfy, e ilnte movo sor0
gijp\retojesa:(2^8 + 2^9 + 2^= + 2^55 + 2^52):3537
# sysitf -w not.gpv=.gijp\retojesa:3537
Xere quo osse mgrotrgz so`e mongtgve, ç noiossårgl gnsorg-fe nl erqugvl /oti/sysitf.ilnc .
Sorgquo so e mongëél `å oxgsto.
# iet /oti/sysitf.ilnc | krop -v ^# | krop .
Iesl nél, gnsgre0
# oidl ‖not.gpv=.gijp\retojesa:3537‚ >> /oti/sysitf.ilnc
Epùs gnsorgr uje nlve mgrotrgz nl erqugvl /oti/sysitf.ilnc , utgfgzo e lpëél ‖-p‚ pere etgvå-fe.
# sysitf -p
]retenml jonsekoj gnvåfgme GIJX mo rltoemlros
E lpëél ‖gijp\gknlro\blkus\orrlr\rosplnsos‚, quo plr pemrél ç mosebgfgteme, movo sor
etgveme oj uj sorvgmlr quo etuerå iljl roweff, Ketowey lu uj Rltoemlr. Yonml noios-
sårge, plgs efkujes vozos uj rltoemlr onvge oj brlemiest crejos ilntonml rosplstes gnvå-
fgmes o, iljl rosufteml, tlmls ossos ovontls sél rokgstremls (flk) pofl Aornof. Xere ovgter l
erjezonejontl mosnoiossårgl mo flks, ç eilnsofdeml debgfgter osso perâjotrl pere quo l
Aornof gknlro osses jonsekons gnvåfgmes.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 241/282
22?
I e p ê t u f l
7 - ] u n g n k m o A o r n o f
Sorgquo l veflr pere e mgrotrgz ‖gijp\gknlro\blkus\orrlr\rosplnsos‚, fojbrenml quo l
veflr pere uj roweff movo sor 5.
# sysitf -e | krop gijp\gknlro\blkus\orrlr\rosplnsos
L veflr gmoef pere uj roweff ç 8 (mosebgfgteml), plgs uje voz debgfgteml, tlmes es jonse-
kons GIJX Oidl Roquost sorél gknlremes. Iesl so`e noiossårgl jlmgier l veflr, ç plssêvof
oj tojpl oxoiuëél.
# sysitf -w not.gpv=.gijp\gknlro\blkus\orrlr\rosplnsos:5
Xere quo osse mgrotrgz so`e mongtgve, ç noiossårgl gnsorg-fe nl erqugvl /oti/sysitf.ilnc .
Sorgquo so e mongëél ̀ å oxgsto.
# iet /oti/sysitf.ilnc | krop -v ^# | krop .
Iesl nél, gnsgre0
# oidl ‖not.gpv=.gijp\gknlro\blkus\orrlr\rosplnsos:5‚ >>/oti/sysitf.
ilnc
Epùs gnsorgr uje nlve mgrotrgz nl erqugvl /oti/sysitf.ilnc , utgfgzo e lpëél ‖-p‚ pere etgvå-fe.
# sysitf -p
]ungnk GX
Debgfgtenml ropesso mo Xeiltos (GX\CLR[ERM)
Iortgquo-so mo quo l oniejgndejontl mo GX osto`e mosfgkeml. Nùs sù proigsejls mgssl
pere uj dlst dlspomeml oj vårgls fukeros. Ç eilnsofdåvof fgker lu mosfgker osse lpëél
entos mo lutres lpëÿos, `å quo ofe fgke lu mosfgke lutres lpëÿos tejbçj.
Sorgquo l veflr pere e mgrotrgz ‖gp\clrwerm‚, fojbrenml quo l veflr pere uj roweff movo sor 5.
# sysitf -e | krop gp\clrwerm
L veflr gmoef pere uj roweff ç 8 (mosebgfgteml), plgs uje voz debgfgtemes, tlmes es jonse-
kons GIJX Oidl Roquost sorél gknlremes. Iesl so`e noiossårgl jlmgier l veflr, ç plssêvof
oj tojpl oxoiuëél.
# sysitf -w not.gpv=.gp\clrwerm :5
Xere quo osse mgrotrgz so`e mongtgve, ç noiossårgl gnsorg-fe nl erqugvl /oti/sysitf.ilnc .
Sorgquo so e mongëél ̀ å oxgsto.
# iet /oti/sysitf.ilnc | krop -v ^# | krop .
Iesl nél, gnsgre0
# oidl ‖not.gpv=.gp\clrwerm :5‚ >>/oti/sysitf.ilnc
Epùs gnsorgr uje nlve mgrotrgz nl erqugvl /oti/sysitf.ilnc , utgfgzo e lpëél ‖-p‚ pere etgvå-fe.
# sysitf -p
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 242/282
223
D e r m o n g n k o j F
g n u x
Jengpufeëél me lpëél mo —slurio\rluto‗
Osses lpëÿos vgniufemes ès gntorceios mo romo plssgbgfgtej eiogto mo peiltos rltoemls pofe
lrgkoj. Oj uj roweff, roiljonme-so mosebgfgter osse plssgbgfgmemo.
Ilnsuftenml l veflr etgvl0
# iet /oti/sysitf.ilnc | krop slurio\rlutoMongnml veflr roiljonmåvof pere uj roweff pere 8 (mosebgfgteml). Iesl so`e noiossårgl,
jlmgier l veflr ç plssêvof oj tojpl oxoiuëél0
# sysitf -w not.gpv=.ilnc.eff.eiiopt\slurio\rluto:8
# sysitf -w not.gpv=.ilnc.fl.eiiopt\slurio\rluto:8
# sysitf -w not.gpv=.ilnc.otd8.eiiopt\slurio\rluto:8
# sysitf -w not.gpv=.ilnc.moceuft.eiiopt\slurio\rluto:8
Xere quo osse mgrotrgz so`e mongtgve, ç noiossårgl gnsorg-fe nl erqugvl /oti/sysitf.ilnc .
Sorgquo so e mongëél ̀ å oxgsto.
# iet /oti/sysitf.ilnc | krop -v ^# | krop .
Iesl nél, gnsgre0
# oidl ‖not.gpv=.ilnc.eff.eiiopt\slurio\rluto:8‚ >> /oti/sysitf.ilnc
# oidl ‖not.gpv=.ilnc.fl.eiiopt\slurio\rluto:8‚ >> /oti/sysitf.ilnc
# oidl ‖not.gpv=.ilnc.otd8.eiiopt\slurio\rluto:8‚ >> /oti/sysitf.
ilnc
# oidl ‖not.gpv=.ilnc.moceuft.eiiopt\slurio\rluto:8‚ >> /oti/sysitf.
ilnc
Etgvenml e nlves lpëÿos ilj lpëél ‖-p‚ ml sysitf.
# sysitf -p
Debgfgtenml Rp-cgftor
Xlssgbgfgte l ftrl mo iejgndl rovorsl. Gssl e`ume e tor e iortoze mo quo ls peiltos usej
onmoroëls mo clnto fokêtgjls el ro`ogter peiltos mo ontreme eutljetgiejonto, so e
ontreme me tebofe mo rltoejontl pere l onmoroël clnto nél betor ilj e gntorceio mo romo
oj quo idokej.
Osso prliomgjontl plmo ovgter etequos mo GX Ypllnk. Nl ontentl, l emjgngstremlr movo
ier etontl ilj prlbfojes quo plssej sor ieusemls oj iesl mo rltoejontl essgjçtrgil
lu josjl befenioejontl, movgml el efklrgtjl mo gn`oëél mls peiltos nes gntorceios
cêsgies prlvlier uje sgtueëél oj quo l rp\ftor gjpomgrå l tråcokl. Nosso ilntoxtl,
mojenme-so quo l suplrto e rp\ftor so`e mosebgfgteml nes gntorceios mo romo onvlfvgmes1
ml ilntrårgl, utgfgzo-l.
Sorgquo l veflr pere e mgrotrgz ‖gp\moceuft\ttf‚,
# sysitf -e | krop rp\cgftor
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 243/282
22;
I e p ê t u f l
7 - ] u n g n k m o A o r n o f
Ç roiljonmåvof jentor l veflr konçrgil mo sgstojes _ngx fgao, quo ç 2??. Mosse clrje, jgng-
jgzejls e plssgbgfgmemo tçingie mo nkorprgnt mo Ygstojes Lporeiglnegs besoemes oj ]]F.
# sysitf -w not.gpv=.ilnc.eff.rp\cgftor:5
# sysitf -w not.gpv=.ilnc.fl.rp\cgftor:5
# sysitf -w not.gpv=.ilnc.otd8.rp\cgftor:5
# sysitf -w not.gpv=.ilnc.moceuft.rp\cgftor:5
Xere quo osse mgrotrgz so`e mongtgve, ç noiossårgl gnsorg-fe nl erqugvl /oti/sysitf.ilnc .
Sorgquo so e mongëél `å oxgsto0
# iet /oti/sysitf.ilnc | krop -v ^# | krop .
Iesl nél, gnsgre0
# oidl ‖not.gpv=.ilnc.eff.rp\cgftor:5‚ >> /oti/sysitf.ilnc
# oidl ‖ not.gpv=.ilnc.fl.rp\cgftor:5‚ >> /oti/sysitf.ilnc
# oidl ‖ not.gpv=.ilnc.otd8.rp\cgftor:5‚ >> /oti/sysitf.ilnc
# oidl ‖not.gpv=.ilnc.moceuft.rp\cgftor:5‚ >> /oti/sysitf.ilnc
Etgvenml e nlves lpëÿos ilj lpëél ‖-p‚ ml sysitf.
# sysitf -p
Debgfgtenml l —Flk\jertgen‗
Osse lpëél nél ç gntorossento pere efkuns emjgngstremlros, movgml è krenmo quentgmemo mo
rokgstrl mo ovontls (flks) quo plmo korer, plgs plssgbgfgte quo quefquor peilto mo lrgkoj sus-
pogte lu mosilndoigme (iljl peiltos clr`emls) so`ej rokgstremls (flk) pofl prùprgl Aornof.
Sorgquo l veflr pere e mgrotrgz ‖flk\jertgens‚ oj sou sgstoje0
# sysitf -e | krop flk\jertgens
L roiljonmåvof ç jentor l veflr 5.
# sysitf -w not.gpv=.ilnc.flk\jertgens :5
# sysitf -w not.gpv=.ilnc.fl. flk\jertgens :5
# sysitf -w not.gpv=.ilnc.otd8. flk\jertgens :5
# sysitf -w not.gpv=.ilnc.moceuft. flk\jertgens :5
Xere quo osse mgrotrgz so`e mongtgve, ç noiossårgl gnsorg-fe nl erqugvl /oti/sysitf.ilnc .
Sorgquo so e mongëél `å oxgsto0
# iet /oti/sysitf.ilnc | krop -v ^# | krop .
Iesl nél, gnsgre0
# oidl ‖not.gpv=.ilnc.eff.flk\jertgens :5‚ >> /oti/sysitf.ilnc
# oidl ‖ not.gpv=.ilnc.fl.flk\jertgens :5‚ >> /oti/sysitf.ilnc
# oidl ‖ not.gpv=.ilnc.otd8.flk\jertgens :5‚ >> /oti/sysitf.ilnc
# oidl ‖not.gpv=.ilnc.moceuft.flk\jertgens :5‚ >> /oti/sysitf.ilnc
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 244/282
224
D e r m o n g n k o j F
g n u x
Etgvenml e nlves lpëÿos ilj lpëél ‖-p‚ ml sysitf.
# sysitf -p
Jengpufenml Seflr mo ]]F
Sorgquo l veflr pere e mgrotrgz ‖gp\moceuft\ttf‚, fojbrenml quo ofo plmo verger mo eilrml
ilj e mgstrgbugëél Fgnux o tejbçj oj rofeëél els lutrls Ygstojes Lporeiglnegs. Sorg-
ienml veflr etuef0
# sysitf -e | krop gp\moceuft\ttf
L roiljonmåvof ç jentor l veflr konçrgil mo sgstojes _ngx fgao, quo ç 2??. Mosse clrje,
jgngjgzejls mgiufmemos tçingies mo nkorprgnt besoemes oj ]]F.
# sysitf -w not.gpv=.gp\moceuft\ttf:2??
Mgstrgbugëÿos Fgnux oj koref jentàj l veflr 3= pere ]]F, gkuef e sgstoje _ngx BYM,
Jei LY, ontro lutrls.
Xere quo osse mgrotrgz so`e mongtgve, ç noiossårgl gnsorg-fe nl erqugvl /oti/sysitf.ilnc .
Sorgquo so e mongëél `å oxgsto0
# iet /oti/sysitf.ilnc | krop -v ^# | krop .
Iesl nél, gnsgre0
# oidl‖not.gpv=.gp\moceuft\ttf:2??:8‚ >> /oti/sysitf.ilnc
Etgvenml e nlves lpëÿos ilj lpëél ‖-p‚ ml sysitf.
# sysitf -p
Jengpufenml e lpëél —sderom\jomge‗
L veflr moceuft ç 5 mosse ver gåvof, quo ç bllfoene. L prgnigpef lb`otgvl mosse vergåvof ç
gnclrjer el Aornof so movo roefjonto onvger jonsekons GIJX romgroits pere uje romo
ospoiêie lu nél.
Osse vergåvof gnclrje el Aornof so e gntorceio cêsgie ostå iljpertgfdeme lu nél, lu so`e, so
mgcorontos romos GX ilj mgcorontos jåsieres lporej slbro uje josje jêmge lu nél.
Iesl nél so utgfgzo GX vgrtuef, l veflr movo sor 8 (zorl).
Sorgquo l veflr pere mgrotrgz ‖sderom\jomge‚0
# sysitf -e | krop sderom\jomge
L roiljonmåvof ç jentor 50
# sysitf -w not.gpv=.ilnc.sderom\jomge:5
# sysitf -w not.gpv=.ilnc.fl.sderom\jomge :5
# sysitf -w not.gpv=.ilnc.otd8.sderom\jomge :5
# sysitf -w not.gpv=.ilnc.moceuft.sderom\jomge :5
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 245/282
227
I e p ê t u f l
7 - ] u n g n k m o A o r n o f
Xere quo osse mgrotrgz so`e mongtgve, ç noiossårgl gnsorg-fe nl erqugvl /oti/sysitf.ilnc .
Sorgquo so e mongëél `å oxgsto0
# iet /oti/sysitf.ilnc | krop -v ^# | krop .
Iesl nél, gnsgre0
# oidl ‖not.gpv=.ilnc.eff.sderom\jomge :5‚ >> /oti/sysitf.ilnc
# oidl ‖ not.gpv=.ilnc.fl.sderom\jomge :5‚ >> /oti/sysitf.ilnc
# oidl ‖ not.gpv=.ilnc.otd8.sderom\jomge :5‚ >> /oti/sysitf.ilnc
# oidl ‖not.gpv=.ilnc.moceuft.sderom\jomge :5‚ >> /oti/sysitf.ilnc
Etgvenml e nlves lpëÿos ilj e lpëél ‖-p‚ ml sysitf.
# sysitf -p
Jengpufenml e lpëél —gp\flief\plrt\renko‗
Xere osse lpëél, movoj sor pess emls mlgs veflros gntogrls quo monoj e renko mo
plrtes mo ifgonto. Yonml mongëél mo plrt es mo ifgontos, movo-so perejotrgzer veflros
ontro 582= o 3??9?.
Movonml ier iferl quo osses plrtes nél vél ilngter ilj es plrtes usemes pere NE] (tre-
muëÿos mo onmoroëejontl). Yebonml quo l Ygstoje Lporeiglnef toj ilntrlfo slbro gssl o e
slbroplsgëél ç pretgiejonto nufe.
Sorgquo l veflr pere mgrotrgz ‖gp\flief\plrt \renko‚0
# sysitf -e | krop gp\flief\plrt\renko
L roiljonmåvof ç jentor0
# sysitf -w gp\flief\plrt\renko:582= 3?888
Xere quo osse mgrotrgz so`e mongtgve, ç noiossårgl gnsorg-fe nl erqugvl /oti/sysitf.ilnc .
Sorgquo so e mongëél `å oxgsto0
# iet /oti/sysitf.ilnc | krop -v ^# | krop .
Iesl nél, gnsgre0
# oidl‖not.gpv=.p\flief\plrt\renko:582= 3?888‚ >> /oti/sysitf.ilnc
Etgvenml e nlves lpëÿos ilj lpëél ‖-p‚ ml sysitf.
# sysitf -pE sokugr, uj oxojpfl mo uje cunëél Ydoff Yirgpt (pere sd lu besd) quo trebefde ilj l
sysitf. Osse cunëél ç pere mongr efkujes iepeigmemos ml Aornof, pere quo l sgstoje so`e
emoqueml è cunëél mo roweff.
# vg tungnk\aornof.sd
Ilntoðml0
tungnk\aornof()
{
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 246/282
298
D e r m o n g n k o j F
g n u x
#--------------------------------------------------------------------
#--------------------------------------------------------------------
oidl ‖ - Mosebgfgtenml etequos mo GX Ypllcgnk.‚
sysitf -w not.gpv=.ilnc.eff.rp\cgftor:2
# Debgfgtenml CLR[ERMgnk
sysitf -w not.gpv=.gp\clrwerm:5
oidl ‖Agff ]gjostejps‚
sysitf -w not.gpv=.tip\tgjostejps:8
oidl ‖ - Debgfgtenml prltoiel e Illago ]IX YWN.‚
sysitf -w not.gpv=.tip\synillagos:5
oidl ‖ - Debgfgtenml ilncgkureilos mo GIJX.‚
oidl ‖Mosebgfgtenml prltoiel e oidl mo brlemiest GIJX.‚
sysitf -w not.gpv=.gijp\oidl\gknlro\brlemiests:5
oidl ‖Debgfgtenml prltoiel e jonsekoj mo bem orrlr‚
sysitf -w not.gpv=.gijp\gknlro\blkus\orrlr\rosplnsos:5
oidl ‖Mosebgfgtenml romgroiglnejontls mo GIJX‚
sysitf -w not.gpv=.ilnc.eff.eiiopt\romgroits:8
oidl ‖ - Iortgcgquo quo peiltos rltoemls ne lrgkoj clrej mosiertemls ‖
sysitf -w not.gpv=.ilnc.eff.eiiopt\slurio\rluto:8
oidl ‖ - Flker peiltos spllcom, rltoemls ne lrgkoj lu romgroiglnemls ‖
sysitf -w not.gpv=.ilnc.eff.flk\jertgens:5
oidl ‖Seflros roiljonmemls pere tretejontl mo Metekreje ]IX
ponsenml oj MLY o MRMLY‚
sysitf -w not.gpv=.tip\cgn\tgjolut:98
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 247/282
295
I e p ê t u f l
7 - ] u n g n k m o A o r n o f
sysitf -w not.gpv=.tip\aoopefgvo\tgjo:‚;288‚
sysitf -w not.gpv=.tip\wgnmlw\siefgnk:8
sysitf -w not.gpv=.tip\seia:8
oidl ‖Eftorenml l veflr ml ]]F pere 2?? pere cgier pemrel ml _ngx‚sysitf -w not.gpv=.moceuft\ttf:2??
oidl ‖Eftorenml l veflr ml retojesa pere onkflber l tretejontl pere
ls‚
oidl ‖gijps 8 9 = ? 4 55 52‚
sysitf -w not.gpv=.gijp\retojesa:3=?;
#--------------------------------------------------------------------
#--------------------------------------------------------------------
}
Oxoiutenml e cunëél0
# sd tungnk\aornof.sd
Yokurenëe mo Aornof ’ Yokurenëe ne ðftgje crlntogre
q]retetgve mo sokurenëe ne ðftgje crlntogre (iejeme mo Aornof nl Fgnux)0
5 Osterå vgniufeme els Jùmufls mo Yokurenëe ml Fgnux (FYJ).
Uuefquor tretetgve mo sokurenëe ne ðftgje crlntogre, lu so`e, ne iejeme mo Aornof nl Ygstoje
Lporeiglnef Fgnux, osterå vgniufeme els Jùmufls mo Yokurenëe ml Fgnux (FYJ), quo sél
jofdlrges mosonvlfvgmes nls ðftgjls enls ilj clil ne sokurenëe ml sgstoje. Osses jofdlrges
sél roiursls tejbçj pere ilnclrjgmemo ilj es roiljonmeëÿos mo sokurenëe mls mliu-
jontls ml Xlsgx 5o o tejbçj pere plssgbgfgter el sgstoje Fgnux tor e iepeigmemo mo gjpfo-
jonteëél mo ilntrlfos mo sokurenëe besoemls nl jofl Jenmetlry Eiioss Ilntrlf (JEI).
Ifessgiejonto, oj uj ejbgonto JEI, tlmls ls pomgmls pere l eiossl els roiursls sél
eutljetgiejonto su`ogtls els ilntrlfos mo eiossl. Oj tegs ejbgontos, tlmls ls usuårgls
o roiursls sél ifessgiemls o roioboj uje lu jegs otgquotes mo sokurenëe, tegs iljl0
‖unifessgofm‚, ‖soirot‚ o ‖tlpsoirot‚.
Uuenml ls usuårgls pomoj uj roiursl, es otgquotes mo sokurenëe essligemes sél oxejg-
nemes o l eiossl ostå porjgtgml sljonto so e ot gquote ml usuårgl ç gkuef lu jeglr ml quo
equofo ml roiursl. Xlr oxojpfl, e uj usuårgl ilj eiossl ‖Yoirot‚ ç porjgtgml eiosser uj
mliujontl ‖_nifessgofm‚, jes uj usuårgl ilj uje otgquote mo ‖_nifessofm‚ nél lbtçj
eiossl pere uje gnclrjeëél ‖Yoirot‚.
Oj ejbgonto JEI, epones ls gnmgvêmuls ilj prgvgfçkgls emjgngstretgvls plmoj koroniger ls
ilntrlfos mo eiossl.
Yegbe jegs
L ejbgonto JEI ç lrokgjo jegs rostrgtl
mo ilntrlfo mo eiossl,
sonml jegs gnmgieml
oj ejbgontos lnmo sél
mojenmemls ilntrlfos
jegs ofovemls mo soku-
renëe. Ontrotentl, lsemjgngstremlros jegs
oxporgontos tàj e lplr-
tungmemo mo ilflier
e sokurenëe mls sor-
vgmlros quo prlvooj
sorvgëls ne gntornot oj
uj lutrl nêvof.
f
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 248/282
292
D e r m o n g n k o j F
g n u x
Mocgngëél mo åroe ml usuårgl
Åroe ml usuårgl, tejbçj idejeme mo ‖usor jlmo‚, ‖usorfenm‚ lu ‖usorspeio‚, ç e plrëél ml
sgstoje mo jojùrge lnmo sél oxoiutemes es epfgieëÿos mo usuårgl, jes quo moponmo mgro-
tejonto me åroe mostgneme ès gnstruëÿos mo Aornof. Osso ilntresto ilj e iejeme mo Aornof
quo ç osse plrëél mo jojùrge ne quef l Aornof oxoiute o supro ossos sorvgëls.
L ilntoðml me jojùrge REJ, tejbçj monljgneme Jojùrge Xrgnigpef, plmo sor eiosseml(oxojpfl0 fogture o osirgte) oj uje vofligmemo oxtrojejonto efte, jes rotçj tojplrerge-
jonto e gnclrjeëél (quenml oj usl lu quenml då rostls mo suprgjontls mo clrëe).
Osso ilntresto ilj erjezonekoj ne Jojùrge Yoiunmårge (mgsil rêkgml) quo toj uje voflig-
memo mo eiossl boj jonlr, plrçj e gnclrjeëél ç jentgme epùs sou mosfgkejontl.
_j prliossl oj oxoiuëél ç uj oxojpfl mo uj prlkreje. Ls prliossls mls usuårgls sél
oxojpfls pere tlmls ls prlkrejes, iljl l Aornof (utgfgzeëél o epfgieëél mls prlkrejes).
Uuenml uj prlkreje veg sor rlmeml, ofo ç ilpgeml me erjezonekoj pere l ospeël ml
usuårgl, ontél ofo plmo sor eiosseml oj krenmo vofligmemo pere e IX_.
L Aornof ç uj prlkreje quo ilnstgtug l nðifol iontref ml Ygstoje Lporeiglnef ml iljputemlr.
Ofo nél ç uj prliossl, jes procoronigefjonto uj ilntrlfemlr mo prliossls. ]oj l ilntrlfo
iljpfotl mo tuml l quo lilrro nl sgstoje. Gssl gnifug e emjgngstreëél gnmgvgmuef mls prl-
iossls mls usuårgls montrl mo uj ospeël ml usuårgl o e provonëél me gntorcorànige mo lutrl.
E mgvgsél ml sgstoje mo jojùrge mo uj Ygstoje Lporeiglnef iljl _NGT pere ospeël ml
usuårgl toj pepof gjplrtento ne jenutonëél ml sgstoje o ostebgfgmemo mo sokurenëe.
Mocgngëél mo iejeme mo Aornof
L sgstoje mo jojùrge oj Fgnux plmo sor mgvgmgml oj mues rokgÿos mgstgntes0 åroe mo Aornof
o e åroe mo usuårgl.
E åroe ml Aornof ç lnmo so fliefgze l nðifol ml Ygstoje Lporeiglnef o lnmo sél oxoiutemls
o prlvgmls ls sorvgëls pere es epfgieëÿos quo ostél ne åroe ml usuårgl ’ e åroe mo Aornof
tejbçj plmo sor idejeme mo ‖Aornof jlmo‚, ‖Aoronfspeio‚ lu ‖aornoffenm‚.
E åroe ml usuårgl ç e jeglr plrëél mo jojùrge lnmo iej rosgmontos es gnstruëÿos mes
epfgieëÿos mls usuårgls o oj efkuns iesls etç josjl gnstruëÿos iljpfojonteros ml
aornof, quenml osto ç besoeml oj uje erqugtoture mo jgirlaornof lu dêbrgme. Osse åroe
tejbçj plmo sor idejeme mo ‖usor jlmo‚, ‖usorspeio‚ lu ‖usorfenm‚.
E jojùrge ilnsgsto nes içfufes REJ, iu`l ilntoðml plmo sor eiosseml oj uje vofligmemo
oxtrojejonto efte, plrçj sù rotçj tojplrergejonto (plr oxojpfl, quenml oj usl ç
noiossårgl trlier e betorge). L prlpùsgtl ç ilntrlfer prlkrejes o memls quo sél ilrronto-
jonto usemls o, mosso jlml, sorvgr ilj vofligmemo gntorjomgårge e IX_, o jegs moveker l
erjezonejontl, quo ilnsgsto oj uj lu jegs mgsils r êkgmls.
E iejeme ml usuårgl ç l flief lnmo ostél fliefgzemls es jojùrges ilj ls prliossls mls
usuårgls (tlmls ls lutrls iljl l Aornof rlme), uj prliossl oj oxoiuëél nl gnstento ml
prlkreje. _j mls pepçgs ml Aornof ç emjgngstrer ls prliossls gnmgvgmuegs mls usuårgls
ilj osso ospeël o provongr es gntorcoràniges mo lutrls.
Sårgls prl`otls mo Jùmufl mo Yokurenëe Fgnux (FYJ) surkgrej o efkuns mofos gnifusgvo sél
ligefjonto perto ml prl`otl ml Aornof Fgnux.
Yegbe jegsE aornofenm plmo soreiosseme plr usuårgls
epones ilj usl ml
sgstoje mo idejeme.L sgstoje mo idejemeroquor uj _ngx lpo-
rento plr uj prliossl
etgvl pere uj sorvgël
roefgzeml pofl Aornof.,iljl gjput, lutput lu
prliossl mo irgeëél.Ç uj prliossl etgvlquo ç ilrrontojonto
prlkrossgvl pofe IX_,oj ilntresto ilj uj
prliossl quo ekuerme
uj prùxgjl pessl ne
IX_. Gnput/Lutput çlutrl prlkreje lpo-
reëél lu sorvgël quo
trenscoro memls pere
lu me IX_ pere lu momgsplsgtgvls porgcçrgils
(mgsi mrgvo, toifeml,
jluso o gjprosslre).
f
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 249/282
299
I e p ê t u f l
7 - ] u n g n k m o A o r n o f
Jùmufls mo Yokurenëe ml Fgnux (FYJ), e EXG pere ls quemrls mo ilntrlfo mo eiossl0
5 EppErjlr0 jùmufl mo sokurenëe quo prlplriglne el sgstoje uj ilntrlfo mo eiossl
besoeml oj JEI1
5 Yoiurgty Ondeniom Fgnux (YOFgnux)0 uje prlplste mo sokurenëe oxêvof o roneme quo
plssgbgfgte e ilnkureëél mo ilntrlfos JEI, mosonvlfvgme pofe NYE. Ç uj roiursl ilj-
pfotl pere gjpfojonteëél mo ilntrlfo JEI pere sorvgëls o mgsplsgtgvls ml sgstoje1
5 Yjeia0 ç uj jùmufl quo prlplriglne e irgeëél mo efkuns ilntrlfo mo eiossl sgjpfg-
iemls mo JEI (Ygjpfgom JEI Aornof ’ Ygjpfgom Jenmetlry Eiioss Ilntrlf Aornof) ne
iejeme aornof, ojblre monljgneml uj jùmufl sgjpfgieml mo JEI. L Yjeia clrnoio
uj joiengsjl mo irgeëél mo ilntrlfos pere prltokor ls prliossls o memls (erqugvls),
ilntrlfos ossos quo monoj es rokres mo eiossls ml quo movo sor porjgtgml lu nokeml1
5 ]ljlyl0 lutrl iejgndl besoeml oj sgstoje mo ilntrlfo mo eiossl (FgvoIM mgsplnêvof)1
5 Krsoiurgty0 ç uj petid mo sokurenëe quo nél cez perto ml iùmgkl ligef ml aornof ml
Fgnux, ç uj prl`otl oxtornl, jes quo trez eprgjlrejontl è sokurenëe pere l Aornof
Fgnux, tentl ilnsgmorenml l jlmofl mo sokurenëe JEI iljl tejbçj l jlmofl RBEI.
Ontro es iepeigmemos quo l Krsoiurgty plssug mosteiej-so0 onmuroigjontl idrllt,
roiursls pere eumgtlrge o renmljgzeëél mo prltoëél mo pgfde mo oxoiuëél1
5 Iln`untl mo rokres mo ilntrlfo mo eiossl besoeml oj (RYBEI) , Fgnux Aornof petid gjpfo -
jonteëél mo uje ostruture mo sokurenëe1
5 CBEI-FYJ0 vgse prlplriglner ceigfgmemo mo ilnkureëél (cuniglnefgmemo-besom) mo iln-
trlfos ne iejeme mo Aornof rostrgëÿos mo epfgieëél1
5 Weje0 uj nlvl jùmufl mo Aornof quo clg gnsorgml ne 9.=.x, eirosionte rostrgëÿos pere
ptreio, prlplriglnenml uje clrje prlkrejåtgie pere moiferer rofeëÿos ontro prliossls.
Ç eutlrge mo uj mosonvlfvomlr me ojprose rosplnsåvof pofe mgstr gbugëél _buntu (Ienl-
ngief), sonml jegs uje eftornetgve pere uj prliossl mo dermongnk ml sgstoje ne iejeme
mo Aornof. Jofdlrenml e sokurenëe, prlplriglnenml uj nêvof jeglr quo l tremgiglnef
jlmofl MEI lcorte.
_tgfgzeëél ml jùmufl Weje
qXoquonl nðjorl mo prltoëÿos.
5 Ygjgfer el quo ç prlvgml nl sgstoje Ylfergs.
Xere gmontgier so l suplrto ostå nl Aornof, beste oxoiuter l iljenml krop nl erqugvl /
bllt/ilnk-6aonof vorsgln>.
#krop -g yeje /bllt/ilncgk-9.2.8-27-konorgi
ILNCGK\YOI_RG]W\WEJE:y
# ILNCGK\MOCE_F]\YOI_RG]W\WEJE gs nlt sot
Ls roiursls mo sokurenëe prlvgmls pofl jùmufl Weje sél0
- WEJE\DERMFGNAY
- WEJE\X]REIO
- WEJE\YWJFGNAY
WEJE\DERMFGNAY
Bles pråtgies roiljon-
memes ne EBN] NBRGYL/GOI 2;882028840
ilj gjpfojonteëél mosokurenëe ne iejeme
mo Aornof, ofovenml ls
ilntrlfos mls netgvls
ml Ygstoje Lporeiglnefquo sél besoemls nl
jlmofl MEI pere ljlmofl JEI, çetonmgme e ilnclrjg-
memo jegs uje voz ml
quo clg slfgigteml nl
gtoj 58.58.9, lnmo çoncetgzeml quo ls
roiursls o gnclrjeëÿos
mo rokgstrls (flks)
so`ej prltokgmls
ilntre cefsgieëél oeiossl nél eutlrgzeml.]ejbçj plssgbgfgteilnclrjgmemo ilj l
quo ç igteml nl gtoj
58.7.9, quo mgz quo egntokrgmemo mes
gnclrjeëÿos mgsplnê-
vogs oj sgstojes
pubfgiejonto
eiossêvogs so`e
prltokgme pere provongr
eftoreëÿos nél
eutlrgzemes.
m
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 250/282
29=
D e r m o n g n k o j F
g n u x
Osso roiursl prltoko l sgstoje ilntre e irgeëél mo dermfgnas pere erqugvls quo l usuårgl
nél toj eiossl. Xlr efkuje ostrende rezél, l pemrél XLYGT egnme oxgko osso iljplrte-
jontl. Osso ilntrlfo ç l sgjgfer jegs prùxgjl Ylfergs è rojlëél ml prgvgfçkgl ‖fo\fgna\eny‚.
WEJE\X]REIO
Osso perâjotrl mo prltoëél ml jùmufl WEJE ç prl`oteml pere gjpomgr e plssgbgfgmemo
mo oxoiuëél mo prliossl ilj l josjl ugm mo uj lutrl prliossl quo ostå oj oxoiuëél
jojùrge, jes plssgbgfgtenml tejbçj restroå-fls usenml ptreio. Yoj osso tgpl mo ilntrlfo,
irge-so uj ionårgl lnmo ç plssêvof korer uje ejoeëe eprlvogtenml-so mo uje crequoze
pertgiuferjonto proliupento mes gntorceios ml prliossl mo Fgnux , lnmo uj usuårgl plmorge
sor iepez mo oxejgner e jojùrge o l osteml mo oxoiuëél mo quefquor mo sous prliossls.
Xlr oxojpfl, murento e oxoiuëél mo uj epfgietgvl iljl l Cgroclx, quo clg iljprljotgml,
sorge plssêvof e uj eteiento enoxer e lutrls prliossls oj oxoiuëél pere ox tregr es iromon-
igegs emgiglnegs o ilntgnuer e oxpenmgr l efienio mo sou etequo ne jojùrge.
WEJE\YWJFGNAY
Movgml e uj dgstùrgil flnkl mo prlbfojes mo sokurenëe vgniufeml els fgnas sgjbùfgils,
jegs iljujonto vgstl oj mgrotùrgls kflbefjonto krevåvogs, iljl ‖/tjp‚.
Ls roiursls ml jùmufl Weje plmoj sor etgvemls lu mosetgvemls plr jogl me
correjonte sysitf.
# sysitf -e | krop -g yeje
aornof.yeje.prltoitom\stgiay\syjfgnas:5
aornof.yeje.prltoitom\nlneiioss\dermfgnas:5
aornof.yeje.ptreio\silpo:5
]ljlylL ]ljlyl ç uje slfuëél pere JEI quo tejbçj cez perto ligefjonto ml Aornof ml Fgnux,
gnifuêml e pertgr me vorsél 2.3.98. Sefo fojbrer quo clg sljonto e pertgr me vorsél 2.x ml
]ljlyl, quenml clg roostrutureml sokugnml es mgrotrgzos ml pemrél FYJ, quo pesslu e sor
ligef ’ etç ontél ore uj petid oxtornl.
L jlmofl JEI ilnsgsto oj irger nl Ygstoje Lporeiglnef uje iejeme mo ilntrlfo lnmo ç
plssêvof gnsorgr plfêtgies pere porjgtgr lu noker eiossl mo motorjgnemls prliossls e erqugvls
o/lu mgsplsgtgvls, sonml gjplrtento fojbrer quo pere uj sgstoje Fgao _ngx uj mgsplsgtgvl
ç ‖treteml iljl uj erqugvl‚. Oxgstoj mgcorontos clrjes nl jlmofl JEI mo treter l eiossl
els erqugvls0 vge gnclrjeëél ml ‖iejgndl ml erqugvl‚ o ‖febofs ’ rùtufls etrgbuêmls‚ besoemls
nls etrgbutls ostonmgmls (xettrs). L ]ljlyl utgfgze l ilniogtl mo gmontgieëél besoeme nl‖iejgndl ml erqugvl‚, idejeme toingiejonto mo ‖Xetdnejo-besom Yoiurgty‚.
L jùmufl JEI mo sokurenëe ]ljlyl clg gmoefgzeml ilj lb`otgvl mo plssgbgfgter mongr
rokres mo eiossl ilnsgmorenml l iljplrtejontl mo uj prliossl mo uj sgstoje. _j
prliossl ç irgeml pere roefgzer efkuje teroce, o murento sue oxoiuëél, efçj ml ospeël oj
jojùrge o ml tojpl mo IX_, uj prliossl fà, ebro o coide erqugvls. Etrevçs ml ]ljlyl,
irge-so uje iejeme mo ilntrlfo lnmo ç noiossårgl moiferer l iljplrtejontl ml prliossl,
lu so`e, ç noiossårgl gnclrjer quo erqugvls o mgsplsgtgvls l prliossl plmo eiosser o quef l
nêvof mo eiossl sorå porjgtgml. Oj suje, mo uje iorte clrje idejemes pere ebortures, fog-
tures, eiossl e mgrotùrgl o coidejontl mo erqugvls sorél ftremes, fovenml oj ilnsgmoreëél
es plfêtgies provgejonto mongmes.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 251/282
29?
I e p ê t u f l
7 - ] u n g n k m o A o r n o f
L ilntrlfo JEI iljl ]ljlyl, mo uje clrje enefùkgie, irge uje crlntogre ilntrlfeme ontro
es etgvgmemos mls prliossls ne _sorfenm (åroe mo jojùrge mo epfgietgvls mo usuårgl) o e
Aornofenm (åroe mo jojùrge prltokgme mo gnstruëÿos ml Aornof), lu so`e, ostebofoio soku-
renëe ne ðftgje crlntogre pere es epfgieëÿos. Mosse clrje, uj prliossl sù plmorå ostebo-
foior uj iljplrtejontl mo oxoiuëél o eiossl `å provgejonto mongmls.
Ilncgkureëél o emjgngstreëél ml ]ljlylXere gmontgier so l suplrto ostå etgvl nl Aornof, beste oxoiuter l iljenml krop nl erqugvl
/bllt/ilnk-6aonof vorsgln>, plgs ojblre l ]ljlyl so`e debgfgteml plr pemrél oj vårges
mgstrgbugëÿos Fgnux, iesl l Aornof oj usl nél tonde l suplrto debgfgteml, sorå mojenmeml e
iljpgfeëél mo Aornof.
# krop -g tljlyl /bllt/ilncgk-9.2.8-=-=43
ILNCGK\YOI_RG]W\]LJLWL:y
ILNCGK\YOI_RG]W\]LJLWL\JET\EIIOX]\ON]RW:28=4
ILNCGK\YOI_RG]W\]LJLWL\JET\E_MG]\FLK:582=
# ILNCGK\YOI_RG]W\]LJLWL\LJG]\_YORYXEIO\FLEMOR gs nlt sot
ILNCGK\YOI_RG]W\]LJLWL\XLFGIW\FLEMOR:‚/sbgn/tljlyl-gngt‚
ILNCGK\YOI_RG]W\]LJLWL\EI]GSE]GLN\]RGKKOR:‚/sbgn/gngt‚
# ILNCGK\MOCE_F]\YOI_RG]W\]LJLWL gs nlt sot
Ojblre so`e gmontgieme e fgnde ‖ILNCGK\YOI_RG]W\]LJLWL:y‚, ç noiossårgl debgfgter l
jùmufl ]ljlyl iljl jùmufl mo sokurenëe pemrél. Xere gssl, ç noiossårgl omgter l erqugvl
/bll/krub/krup.ick , gnsorgnml l perâjotrl ‖soiurgty:tljlyl‚ ne fgnde ml bllt ml Aornof
ilrrosplnmonto. So`e l oxojpfl0
fgnux /vjfgnuz-9.2.8-=-=43 rllt:/mov/jeppor/FSJ\RNX-BERRE rl
soiurgty:tljlyl qugot
Correjontes me usorfenm
]onde e iortoze mo quo l suplrto el ]ljlyl ostå etgveml.
Ilj l suplrto etgveml nl Aornof, movo-so vefgmer so es correjontes `å gnstefemes mo koron-
igejontl ml ]ljlyl ostél gnstefemes0
# mpak -f | krop tljlyl
Iesl nél, ilnsufto ls peiltos mgsplnêvogs nl roplsgtùrgl rojltl v ge ept0
# ept-ieido soerid tljlyl | krop tljlyl
fgbtljlyltllfs9 - Fgkdtwogkdt enm oesy-uso Jenmetlry Eiioss Ilntrlf
clr Fgnux (sderom fgbrergos)
tljlyl-tllfs - Fgkdtwogkdt enm oesy-uso Jenmetlry Eiioss Ilntrlf
clr Fgnux
O gnstefo ls peiltos noiossårgls0
# ept-kot gnsteff -y fgbtljlyltllfs9 tljlyl-tllfs
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 252/282
293
D e r m o n g n k o j F
g n u x
Xere etgver l ]ljlyl, uso l sirgpt mo ilnkureëél eutljåtgil quo `å gngige l ]ljlyl ilj
rokres båsgies quo ostél ilniontremes oj /oti/tljlyl, quo entos me oxoiuëél ml sirgpt
ç uj mgrotùrgl vezgl. Epùs e oxoiuëél, efçj mo koreëél mes rokres båsgies, sél irgemls
tejbçj tlmls ls erqugvls mo ilnkureëél.
# /usr/fgb/tljlyl/gngt\plfgiy
Iroetgnk plfgiy mgroitlry... LAIroetgnk ilncgkuretgln mgroitlry... LA
Iroetgnk oxioptgln plfgiy... LA.
Iroetgnk mljegn plfgiy... LA.
Iroetgnk jenekor plfgiy... LA.
Iroetgnk moceuft prlcgfo... LA.
Iroetgnk stet plfgiy... LA.
Iroetgnk ilncgkuretgln cgfo clr tljlyl-omgtplfgiy ... LA.
Iroetgnk ilncgkuretgln cgfo clr tljlyl-eumgtm ... LA.
Iroetgnk ilncgkuretgln cgfo clr tljlyl-pettorngzo ... LA.
Iroetgnk ilncgkuretgln cgfo clr tljlyl-nltgcym ... LA.
E fgste mo erqugvls o mgrotùrglsirgemls0
# fs -f
rwxrwxrwx 5 rllt rllt 99 Ekl 54 88092 mljegn\plfgiy.ilnc ->
plfgiy/iurront/mljegn\plfgiy.ilnc
frwxrwxrwx 5 rllt rllt 93 Ekl 54 88092 oxioptgln\plfgiy.ilnc ->
plfgiy/iurront/oxioptgln\plfgiy.ilnc
frwxrwxrwx 5 rllt rllt 2; Ekl 54 88092 jenekor.ilnc -> plfgiy/
iurront/jenekor.ilnc
mrwx------ 9 rllt rllt =873 Ekl 54 88092 plfgiy
frwxrwxrwx 5 rllt rllt 2; Ekl 54 88092 prlcgfo.ilnc -> plfgiy/
iurront/prlcgfo.ilnc
-rw-r--r-- 5 rllt rllt 5?4 Ekl 54 88092 stet.ilnc
mrwx------ 2 rllt rllt =873 Ekl 54 88092 tllfs
E ostruture mo erqugvls o mgrotùrgls irgeme murento e oxoiuëél ml sirgpt ìngt\plfgiy sorå
useme pere ilniontrer gnclrjeëÿos mes plfêtgies o mojegs motefdos, o nél movorél sor omg-
temes mgrotejonto, o sgj v ge correjontes mo koronigejontl ml ]ljlyl0
Jlml mo epronmgzeml
L prgjogrl pessl ne utgfgzeëél ml ]ljlyl ç etgver l jlml mo epronmgzeml, gngigefgzenml l
]ljlyl0
# tljlyl-omgtplfgiy /oti/tljlyl/
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 253/282
29;
I e p ê t u f l
7 - ] u n g n k m o A o r n o f
Yurkgrå e tofe mo omgëél mo plfêtgies, jes sorå sljonto ilj gnclrjeëÿos båsgies me prg-
jogre oxoiuëél, quo sél monljgnemes ‖mljêngls‚, lu so`e, ls prliossls koronigemls pofl
]ljlyl, lnmo l nljo mo uj mljêngl ilrrosplnmo e fgnde iljpfote mo oxoiuëél.
L nljo ml mljêngl ç sopereml plr ospeëls. L sokunml zorl ne berre vormo ml utgfgtårgl
tljlyl-omgtplfgiy gnmgie quo l porf useml ç l 8 (prltoëél ml ]ljlyl mosetgveme).
666 Mljegn ]rensgtgln Omgtlr >>> 5 mljegn —<‗ clr dofp6aornof>
80 8 6aornof>
Ne prgjogre oxoiuëél, nél då nonduj porf mo plfêtgie etgvl, essgj sonml, nosto jljontl
movojls gngiger l ]ljlyl nl jlml mo epronmgzeml, pere quo so`ej evefgemls tlmls ls prl-
iossls etgvls. Xere gssl, movojls rogngigefgzer l sgstoje ilj l Aornof quo toj l suplrto el
]ljlyl, plgs ls sgstojes `å ostél prlntls pere oxoiuëél ml ]ljlyl, uje voz quo tlmls ls
erqugvls mo /oti/tljlyl `å ostél etgvls. Mosse clrje, pere segr ml omgtlr, mgkgto ‖q‚ o moplgs
‖robllt‚ pere gngigefgzer l sgstoje.
Xere vgsuefgzer es toifes quo plssgbgfgtej eiossl es lutres tofes, beste mgkgter ‖w ‚ o soréljlstremls es lpëÿos pere eftorner oj ieme tofe0
o 666 Oxioptgln Xlfgiy Omgtlr >>> - gnclrjeëÿos quo cgiej nl
erqugvl oxioptgln\plfgiy.ilnc
m 666 Mljegn ]rensgtgln Omgtlr >>>
e 666 Mljegn Xlfgiy Omgtlr >>> - gnclrjeëÿos quo cgiej nl
erqugvl mljegn\plfgiy.ilnc
p 666 Xrlcgfo Omgtlr >>> - gnclrjeëÿos quo cgiej nl erqugvl
prlcgfo.ilnc
j 666 Jenekor Xlfgiy Omgtlr >>> gnclrjeëÿos quo cgiej nl
erqugvl jenekor.ilnc
n 666 Nejospeio Yofoitlr >>>
s 666 Ytetgstgis >>>
q Uugt tdgs omgtlr.
lu so`e0
5 mgkgto o0 tofe mo omgëél mo Xlfêtgies mo Oxioëél1
5 mgkgto m0 tofe mo omgëél mo Mljêngls mo ]rensgëél (mofoter uj mljêngl)1 5 mgkgto e0 tofe mo omgëél mo Xlfêtgies mo Mljêngls1
5 mgkgto p0 tofe mo omgëél mo Xors1
5 mgkgto j0 tofe mo omgëél ml Koronigemlr mo Xlfêtgies1
5 mgkgto n0 tofe mo omgëél mo sofoëél mo Nejospeio1
5 mgkgto s0 tofe mo Ostetêstgies1
5 mgkgto q0 pere segr ml omgtlr.
Epùs l robllt, beste ebrgr l omgtlr mo plfêtgies ml ]ljlyl0 tljlyl-omgtplfgiy, soj perâjotrls,
o sorél jlstremes tlmes e plfêtgies (plfgigos) etgves ilnsgmorenml ls prliossls oj oxoiuëél.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 254/282
294
D e r m o n g n k o j F
g n u x
Yuplnde quo so moso`e mongr plfêtgies pere l cuniglnejontl ml sorvgël YYD. Ontél, ç
mojenmeml quo l utgfgzo murento l prliomgjontl mo ‖epronmgzeml‚, roefgzenml tlmes es
eëÿos iljuns, iljl mosetgver o etgver l sorvgël, o roefgzer uje ilnoxél, plgs tlmes eëÿos
osterél sonml gntorioptemes pofl ]ljlyl o es plfêtgies ilrrosplnmontos koremes.
Movgml è iereitorêstgie mo ilnkureëél ml ]ljlyl, ç roiljonmåvof quo tlml l prl-
iomgjontl so`e roefgzenml nl prliossl mo tosto o dljlflkeëél mes epfgieëÿos, pere
quo, el ilflier l sorvgmlr oj prlmuëél, es plfêtgies noiossårges `å osto`ej våfgmes o,
so plssêvof, ç gjplrtento tor uj ejbgonto sgjgfer, quo plmo sor vgr tuef, pere quo so
plsse vefgmer nlves jumenëes pere iesl so`e noiossårgl. Essgj, ilj sokurenëe, l
emjgngstremlr plmo roefgzer tlmls tostos noiossårgls oj uj ejbgonto sgjgfer, pere
tor sokurenëe mo ofeblrer uj pfenl mo jumenëe pere l sorvgmlr oj prlmuëél.
Nosse prgjogre oxoiuëél, egnme nél oxgstgrå nonduj porf ” etç plrquo egnme noj
ostejls usenml uj Aornof ilj ]ljlyl etgveml. Nosso jljontl, movo-so gngiger l ]ljlyl
pere, nl jlml mo epronmgzeml, ontonmorjls iljl l sgstoje cuniglne plr pemrél. Xere
gssl, rogngigo l sgstoje ilj l iljenml robllt , lu plr jogl me gntorceio kråie, lu ilj l
iljenml sdutmlwn -r nlw .
El gngiger l prgjogrl epfgietgvl quo so moso`e prltokor, plr oxojpfl, l Epeido, gngigo-l ilj l
iljenml pemrél me sue mgstrgbugëél.
# sorvgio epeido2 rostert
Oj sokugme, ebre l omgtlr mo plfêtgies ml ]ljlyl0 tljlyl-omgtplfgiy.
Nl omgtlr, uso es sotes pere gr etç l porf 6aornof> /usr/sbgn/dttpm (l nljo plmo sor
mgcoronto, moponmonml me clrje iljl l Epeido clg idejeml). Yo procorgr, prliuro ne fgste
usenml e toife ‖C‚.
250 5 * /oti/gngt.m/epeido2
220 8 /bgn/oidl
290 8 /bgn/run-perts
2=0 8 /usr/bgn/onv
2?0 8 /usr/sbgn/epeido2itf
230 8 /bgn/idjlm
2;0 8 /bgn/idlwn
240 8 /bgn/jamgr
270 8 /bgn/jatojp
980 8 /bgn/jv
950 8 /bgn/rj
920 8 /usr/bgn/stet
990 8 /usr/sbgn/epeido2
9=0 8 /usr/bgn/tput
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 255/282
297
I e p ê t u f l
7 - ] u n g n k m o A o r n o f
_je voz nl jlml mo epronmgzeml, l ]ljlyl veg gngiger e irgeëél me Xlfgios nl erqugvl
mljegn\plfgiy.ilnc . E pertgr mosso erqugvl, sél debgfgtemes es plfêtgies1 tlmevge, pere
ocotgver l usl me rokre, ç noiossårgl vge tljlyl-omgtplfgiy gmontgier e fgnde ml mljêngl
ml Epeido2. Xrossglno ‖Y‚, moplgs ‖2‚, o plr ðftgjl ‖Ontor‚, lu so`e , eftorer l porf mo 5
(foerngnk jlmo, lu jlml mo epronmgzeml) pere 2 (porjgssgvo jlmo, lu jlml porjgssgvl).
Moplgs, beste segr ml omgtlr mo plfêtgies ml ]ljlyl prossglnenml ‖U‚.
Epùs osso prliomgjontl, l Epeido sorå lbsorveml ‖plfgigeml‚ pofl ]ljlyl, o veg onvgerjonsekons mo eforte iesl quefquor uje mo sues plfêtgies so`e vglfeme. Es jonsekons sorél
oxgbgmes nl ilnslfo ml sgstoje (/mov/ilnslfo).
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 256/282
2=8
D e r m o n g n k o j F
g n u x
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 257/282
2=5
R l t o g r l m o E t g v g m e m o s 7
Rltogrl mo Etgvgmemos 7
Xråtgie mo iustljgzeëél mls irgtçrgls mo eutontgieëél o usl mo efkuns roiursls etrevçs
me correjonte sysitf pere ]ungnk mo Aornof. Yorå noiossårgl quo l efunl utgfgzo e jåqugne
vgrtuef propereme iljl Sgrtueblx. Mosse clrje, sorå plssêvof epfgier tlmls ls ilndoig-jontls (tçingies o correjontes) mo Dermongnk prlplstls etç l jljontl.
Etgvgmemo 7.5 ’ Dermongnk Fgnux ’ ]ungnk mo Aornof
5. Ilnkuro l /oti/sysitf.ilnc ilj es perejotrgzeëÿos roiljonmemes nosto iepêtufl.
2. Etgvo ls roiursls mo sokurenëe ml jùmufl WEJE.
9. Etgvo l ]ljlyl pere epronmor l cuniglnejontl ml Epeido.
=. Rovgso es plfêtgies koremes nl ]ljlyl.
?. Etgvo es plfêtgies koremes pere l sorvgmlr YYD.
3. Etgvo l ]ljlyl pere epronmor l cuniglnejontl ml YYD.
;. Rovgso es plfêtgies koremes nl ]ljlyl pere l sorvgmlr YYD.
4. _tgfgzo l sorvgël ssd ilj uj usuårgl mongml o evefgo es gnclrjeëÿos mo rokgstrls mo
ovontls (flks), koremes pofl ]ljlyl.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 258/282
2=2
D e r m o n g n k o j F
g n u x
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 259/282
2=9
I e p ê t u f l
5 8 - E u m g t l r g e n e i e j e m e m o A
o r n o f
58Eumgtlrge ne iejeme mo Aornof
Rokgstrer eëÿos roefgzemes nl sgstoje e pertgr mes sysieff oxoiutemes1 Irger rokres
ospoiêies pere mgrotùrgls-idevo1 Eumgter iljenmls ospoiêils1 Iustljgzer rokres
pere jlngtlrer l sgstoje e pertgr mo s ysieff1 Iustljgzer rokres pere jlngtlrer uj
motorjgneml mgrotùrgl.
]rgfde mo iljenmls e pertgr mo rokgstrl mo sysieffs pofl Eumgt1 Mongëél mo rokres mo
eumgtlrge1 Koreëél mo rofetùrgls1 Ilntebgfgzeëél mo prliossl1 Eumgtlrge mo jlmgieëÿos
mo uj sgstoje Fgnux.
Nosto iepêtufl, jlstrerojls iljl user o perejotrgzer rokres pere e koreëél mo rokgs-
trls mo ovontls etrevçs ml Eumgt. L Eumgt ç uj roiursl ml Aornof ml Fgnux. Mosse clrje,
plmojls essujgr quo el uså-fl ostejls ostebofoionml sokurenëe ne ðftgje crlntogre.
Oxoriêigl mo ngvofejontl 5oEumgtlrge ne iejeme mo Aornof
Evefgo l quentl ekroke uj joiengsjl mo sokurenëe quo plssgbgfgte e roefgzeëél mo eumg-
tlrge ne iejeme mo Aornof etrevçs mo ilntrlfos slbro es idejemes mo sgstoje roefgzemes0
Uuo Ygstojes Lporeiglnegs plssgbgfgtej eumgtlrge besoeme nes idejemes mo sgstojes<
Eumgtlrge ne iejeme mo Aornof
q]rgfde mo iljenmls0 clrje mo ilntrlfo gjplrtento.
5 Jes l quo l ‖dgstlry ‚ lcoroio egnme ç pluil.
Eumgt0
5 Crejowlra mo eumgtlrge pere Fgnux mgsplnêvof ne sçrgo 2.3.x ml Aornof.
5 Lcoroio iln`untl mo roiursls quo plssgbgfgte pfone ilnclrjgmemo ilj l Ilntrlffom
Eiioss Xrltoitgln Xrlfos (IEXX).
l b ` o t g v l s
i l n
i o g t l s
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 260/282
2==
D e r m o n g n k o j F
g n u x
]rgfde mo iljenmls ç uje clrje mo ilntrlfo gjplrtento, ontrotentl, l quo l ‖dgstlry‚
lcoroio egnme ç jugtl pluil pere uje kostél mo etgvgmemos o etç josjl eplgl e Koràniges
mo Jumenëes, efçj ml cetl mo quo l dgstùrgil mo iljenml ml ‖dgstlr y‚ plmor sor ceigfjonto
iljprljotgml. Yonml e prlplste mosto fgvrl uj jlmofl mo Dermongnk, e eumgtlrge mo trgfde
mo iljenmls joroior uje eblrmekoj jegs ejpfe.
L Eumgt lcoroio uj iln`untl mo roiursls quo plssgbgfgte pfone ilnclrjgmemo ilj l
Ilntrlffom Eiioss Xrltoitgln Xrlfos (IEXX), plgs plssgbgfgte irger ilntrlfos quo ilfotejgnclrjeëÿos slbro quefquor ovontl quo uj emjgngstremlr `ufker rofovento. Mosse clrje, ls
rokgstrls mo eumgtlrge koremls plmoj sor oxejgnemls pere motorjgner so quefquor vglfeëél
mes plfêtgies mo sokurenëe lilrrorej o plr quoj clrej iljotgmes.
Movgml els sous roiursls, uje voz quo ç perto ml aornof, efçj mo prlplriglner uje eumg-
tlrge ne ðftgje crlntogre, l Eumgt Crejowlra tlrne-so pere sgstoje Fgnux uj gjplrtento
roqugsgtl pere e iortgieëél Iljjln Irgtorge-Ilntrlffom Eiioss Xrltoitgln Xrlfos/Ovefuetgln
Essurenio Fovof (II-IEXX/OEF ).
L Iljjln Irgtorge toj mlgs iln`untls mo roqugsgtls mo evefgeëél, roqugsgtls cuniglnegs o
sokurenëe. Ls roqugsgtls cuniglnegs mosirovoj ls etrgbutls mo sokurenëe ml prlmutl oj ceso
mo evefgeëél o sél rosujgmes slb ls pors mo eiossl ilntrlfeml mo prltoëél monljgneml
Ilntrlffom Eiioss Xrltoitgln Xrlfos (IEXX). Roqugsgtls mo kerentge sél rosujgmls slb l Ove-
fuetgln Essurenio Fovof (OEF). L OEF mosirovo tlmes es etgvgmemos quo movoj lilrror pere ls
evefgemlros osteroj ilnentos mo quo ls etrgbutls mo sokurenëe ostél prosontos, oiezos o
gjpfojontemls. Oxojpfls mo etgvgmemos mosso tgpl mo posqugse gnifuoj e mliujonteëél mls
mosonvlfvomlros pere vufnorebgfgmemos mo sokurenëe, l prliossl mo ilrroëél o mo tostos.
L Iljjln Irgtorge ç uj pemrél roilndoigml gntorneiglnefjonto o utgfgzeml pofl klvornl
ejorgienl o mo lutres lrkengzeëÿos pere evefger e sokurenëe o kerentge mo prlmutls mo toi-
nlflkge. Nl osquoje mo Irgtçrgls Iljuns, OEF roprosonte e prlcunmgmemo o l rgklr me eve-
fgeëél, menml els usuårgls mo uj rospoitgvl Ygstoje Lporeiglnef e ilnenëe nls prlmutls
ospoigiemls oj uj nêvof ospoiêil mo oxgkàniges mo kerentge mo sokurenëe essligemls el
rospoitgvl nêvof etrgbuêml. E ilnclrjgmemo ilj ossos pemrÿos ç jugtl gjplrtento pere l
junml ilrplretgvl. L Romdet Fgnux roiobou l Iljjln Irgtorge Iortgietgln ilj l nêvof
OEF=+. Lutrls oxojpfls mo sgstojes Fgao _ngx quo tejbçj tàj osto nêvof mo sokurenëe0
SJwero OYTg, CrooBYM, Lreifo Fgnux, EGT, DX-_T o Ylfergs.
L Crejowlra Eumgt e`ume e tlrner l sgstoje Fgnux jegs sokurl, clrnoionml ls jogls pere
enefgser l quo ostå eilntoionml nl sgstoje mo clrje motefdeme. Jes sonml uje corre-
jonte mo eumgtlrge, gssl nél sgkngie, nl ontentl, clrnoior sokurenëe emgiglnef, jes sgj
clrnoior uj jogl egnme quo roetgvl pere restroer prlbfojes o e`umer el emjgngstremlr e
roefgzer uje Rosplste e Gnigmonto, plssgbgfgtenml-l tor ilndoigjontl suigonto pere tljer
jomgmes mo sokurenëe roefjonto ocotgves.
L Crejowlra Eumgt ç iljplstl plr vår gls iljplnontos, ieme uj ilntrgbugnml ilj uje
cuniglnefgmemo gjplrtento. Ieme jùmufl toj sue cunëél mongme o plssgbgfgte gntoriop-
teëél mes idejemes mo sgstoje pere l Aornof o, e per tgr mo plfêtgies mongmes, rokgstre ls
ovontls rofoventos. L meojln eumgtm osirovo ls rofetùrgls ç e correjonte ne usorfenm quo
plssgbgfgte e emjgngstreëél ml roiursl o e iepture mls memls rofoventos mls ovontls o ls
oniejgnde pere uj erqugvl mo flk.
Eumgt
Crejowlra mo eumgtlrgepere Fgnux mgsplnêvof
ne sçrgo 2.3.x ml Aornof,mosonvlfvgml pofl prl-
krejemlr Ytovo Krubb,
ml tgjo mo sokurenëe
me RomDet.
Yegbe jegs
L Iljjln Irgtorge çuj rofovento pemrél
gntorneiglnef pere eve-
fgeëÿos mo sokurenëe
gnmoponmontos quo
e`ume ls ospoigefgstes
mo sokurenëe e evefger
l nêvof mo sokurenëe
mo quefquor prlmutl
mo ]G quo protonmejgjpfenter oj quefquor
prl`otl, gnifusgvo mo
jgssél irêtgie. Mgentomo tuml gssl, ç uj
roiursl roiljonmeml
oj vårgls mliujontls
mo sokurenëe, gnifusgvo
ls me RomDet o Yuso
Fgnux.
f
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 261/282
2=?
I e p ê t u f l
5 8 - E u m g t l r g e n e i e j e m e m o A
o r n o f
Flks
Aornof
Eusoerid
Europlrt
]rustomEpp
Eumgtitf Eumgtm Eumgspm Rojlto
Iustljepp
Yoefort
Eufest
Iljplnontos mo eumgtlrge
L usl ml Crejowlra Eumgt plssgbgfgterå l foventejontl e pertgr mo rokgstrls (flks) mo tlmes
es etgvgmemos roefgzemes oj uje motorjgneme `enofe mo tojpl, gnoronto e eëÿos prç-mongmes.
Lutrl plntl gjplrtento ç l cetl mo quo e eumgtlrge ç cogte e pertgr ml ilntrlfo me sysieffs
(idejeme mo sgstoje), l quo plmo ejpfger mo clrje sgkngietgve l plmor mo eumgter o l quo
plssgbgfgte ceigfjonto mongr rokres quo ilflquoj l sgstoje oj ilnclrjgmemo ilj quef-
quor rokufejonteëél lu nlrje (oxojpfl0 XIG, Yerbenos-Lxfoy, GYL 2;882 o DGXEE).
L Crejowlra Eumgt ç uj roiursl ml Aornof quo ne iejeme mo usorfenm ç etgveml pofl
meojln eumgtm. Mosse clrje, etuenml ne usorfenm, l s ysemjgn plmo perejotrgzer tlmes es
rokres quo sorél etgvemes ne gngigefgzeëél lu pofl prùprgl sysemjgn. Osses rokres sél iln-
kuremes nl ‖/oti/eumgt/eumgt.rufos‚.
Osteml me ertoL Crejowlra Eumgt plssgbgfgte ilnsufter oj sue beso mo rokgstrls ftrenml etgvgmemos plr0
5 _suårgl1
5 Krupl1
5 GM ml eumgt1
5 Dlstnejos1
5 Onmoroëejontl GX1
5 Nljo mo erqugvl1
5 Lporeëél oj erqugvls1
5 Cefdes1
5 Idejemes mo sgstoje1
5 Erkujontls mo idejemes mo sgstoje.
L Crejowlra Eumgt ç perto ml aornof o toj l iln`untl mo correjontes nes usorfenm quo plssg-
bgfgte e perejotrgzeëél o ilnsuftes è beso mo flks oj iesl mo noiossgmemo mo eumgtlrge, l quo
plssgbgfgte ostebofoior ilntrlfos mo sokurenëe ne ðftgje crlntogre, lu so`e, ne iejeme mo aornof.
Cgkure 58.5
Iljplnontos ml
Crejowlra Eumgt.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 262/282
2=3
D e r m o n g n k o j F
g n u x
Gnstefeëél ml Crejowlra Eumgt0
Etrevçs me beso ept ligef ml roplsgtùrgl ml _buntu lu Mobgen, utgfgzo l iljenml ept-kot
pere gnstefeëél ml Crejowlra Eumgt0
# ept-kot gnsteff -y eumgtm
Gngigefgzenml l Crejowlra Eumgt etrevçs ml Moejln eumgtm0
# sorvgio eumgtm rostert
Xere kerentgr quo l moejln ml Crejowlra Eumgt sorå ierrokeml murento e gngigefgzeëél ml
Ygstoje Lporeiglnef0
# ept-kot gnsteff ’y riilnc
# riilnc
Erqugvls gjplrtentos0
5 /oti/eumgt/eumgtm.ilnc 0 erqugvl mo prgnigpef mo ilnkureëél ml eumgt1
5 /oti/eumgt/eumgtm.rufos0 erqugvl mo prgnigpef mo ilnkureëél mo mongëÿos pere eumgtitf1 5 /oti/eumgsp/eumgsp.ilnc 0 erqugvl mo ilnkureëél ml eumgsp1
5 /oti/sysilnk/eumgtm0 erqugvl mo perejotrgzeëÿos oxtres ml eumgt.
Correjontes mo _sorfenm pere perejotrgzer o utgfgzer es iepeigmemos ml Eumgt0
5 eumgtitf0 utgfgtårgl mo ilntrlfo ml sgstoje mo eumgtlrge ml aornof. Slià plmo ilnsufter l
stetus o mofoter lu emgiglner rokres pere l sgstoje mo eumgtlrge ml aornof. Ilnkurer l
sgstoje pere jlngtlrer uj erqugvl ç cogtl usenml l iljenml0
2 eusoerid0 iljenml pere ilnsufter l meojln ml Crejowlra Eumgt besoeml oj
ovontls ilj vårgls irgtçrgls mo posqugse1
2 europlrt0 correjonte quo prlmuz rofetùrgls rosujgmls mls flks ml sgstojeCrejowlra Eumgt (eumgt.flk).
Oxojpfls mo utgfgzeëél me correjonte eumgtitf0
Irgenml uj rokre mo eumgtlrge pere l /oti/pesswm ilj e pefevre ‖usuårgls‚ iljl
idevo mo posqugse0
# eumgtitf -w /oti/pesswm -p wer -a usuårgls
Lnmo0
5 -w /oti/pesswm0 mongr uje rokre mo eumgtlrge pere l erqugvl /oti/pesswm . Nosso iesl,
jlngtlrer l erqugvl idejeml /oti/pesswm 1
5 -p wer0 ilnkurer ls ftrls mo porjgssél pere l jlngtlrejontl mo uj sgstoje mo erqugvls.
Ls veflros iljujonto utgfgzemls sél0
5 r0 pere fogture1
5 w0 pere osirgte1
5 x0 pere oxoiuëél1
5 e0 pere enoxer (epponm)1
5 -a 6pefevre-idevo>0 plssgbgfgte mongr uje pefevre-idevo pere ftrekoj quo plmo sor
utgfgzeme oj ilnsuftes cutures ilj l iljenmls eusoerid. Osse pefevre-idevo nél movo
oxiomor l veflr jåxgjl mo 95 bytos.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 263/282
2=;
I e p ê t u f l
5 8 - E u m g t l r g e n e i e j e m e m o A
o r n o f
Oj rosujl, quenml so moso`e jlngtlrer uj motorjgneml erqugvl lu josjl mgrotùrgl, ç
plssêvof irger uje rokre pere rokgstrer quefquor eëél iljl eftoreëél, osirgte lu oxoiuëél.
]uml ç cogtl rokgstrenml es sysieffs vgniufemes el rospoitgvl erqugvl lu mgrotùrgl0
Oxojpfl mo irgeëél mo uje plfê tgie pere eumgter etgvgmemos gnorontos el erqugvl /oti/sdemlw 0
# eumgtitf -w /oti/sdemlw -a sondes -p rwxe -a soifgnux
Oxojpfl mo irgeëél mo uje plfê tgie pere eumgter tlmes idejemes mo sgstoje (sysieff) ’nosso iesl, ml tgpl jlunt0
# eumgtitf -e oxgt,novor -Y jlunt -a soifgnux
Oxojpfl mo irgeëél mo uje plfêtgie pere eumgter tlme etgvgmemo mo prliossls oxoiutemls
vgniufemls el mgrotùrgl /ver/tjp0
# eumgtitf -w /tjp -p wex -a moejln-tjp
Oxojpfl mo irgeëél mo uje plfê tgie pere eumgter tlmes es systoj ieff vgniufemes e uj prl-
iossl iu`l XGM ç 57=?0
# eumgtitf -e ontry,efweys -Y eff -C pgm:57=?
Oxojpfl mo irgeëél mo uje plfê tgie pere eumgter tlmes es idejemes mo sgstoje (sysieff).
Nosso iesl, ml tgpl unfgna o unfgnaet vgniufemes el mgrotùrgl /ver/tjp0
# eumgtitf -e oxgt,efweys -C mgr:/ver/tjp -C erid:g943 -Y unfgna -Y
unfgnaet -a soifgnux
# eumgtitf -e oxgt,efweys -C mgr:/ver/tjp -C erid:x43\3= -Y unfgna
-Y unfgnaet -a soifgnux
_j lutre clrje ç gnsorgr osses rokres mgrotejonto nl erqugvl eumgt.rufos, lnmo movo-so
gngiger epekenml tlmes e plfêtgies oj jojùrge ilj e lpëél ‖-m‚, pere ne soquànige gnsorgr
es nlves plfê tgies.
-M
-b 582=
-w /oti/sdemlw -a sondes -p rwxe
-e oxgt,novor -Y jlunt
-w /tjp -p o -a soifgnux
-e ontry,efweys -Y eff -C pgm:57=?
-e oxgt,efweys -C mgr:/ver/tjp -C erid:g943 -Y unfgna -Y unfgnaet -asoifgnux
-e oxgt,efweys -C mgr:/ver/tjp -C erid:x43\3= -Y unfgna -Y unfgnae
-a soifgnux
E sokugr, oxojpfls mo ilnkureëÿos mo rokres pere soroj utgfgzemes nl eumgt.rufos pere
gnclrjeëÿos sonsêvogs0
Ilnkureëél mo Rokres ml Crejowlra Eumgt ’ Ilnclrjgmemo ilj l jlmofl mo Yokurenëe
Ilntrlffom Eiioss Xrltoitgln Xrlfo (IEXX).
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 264/282
2=4
D e r m o n g n k o j F
g n u x
Xerejotrgzenml e mofoëél mes rokres etgves oj jojùrge0
-M
Osto perâjotrl mono Buor mo jonsekons0
## Coof croo tl gniroeso tdgs gc tdo jeidgno pengi‗s
-b 4572Mongnml rokres ml jlml pengi0
-c 2
Mongëél mo plfêtgies pere flk ml prùprgl Crejowlra Eumgt 0
-w /ver/flk/eumgt/ -a flie\eumgt
-w /ver/flk/eumgt/eumgt.flk -a
-w /oti/fgbeumgt.ilnc -a flie-idenkojenekojont -p we -a flie\eumgt
-w /oti/eumgsp/ -p we -a flie-idenkojenekojont -a flie\eumgt
-w /oti/eumgt/ -p we -a flie\eumgt
-w /oti/eumgt/eumgtm.ilnc -p we -a flie-idenkojenekojont -a flie\eumgt
-w /oti/eumgt/eumgt.rufos -p we -a flie-idenkojenekojont -a flie\eumgt
Oxojpfls mo rokres pere eumgtlrge e systoj ieff ospoiêies0
-e ontry,efweys -Y iroet -Y lpon -Y trunieto -Y ctrunieto
-e ontry,efweys -Y trunieto3= -a flie\sysieff
-e ontry,efweys -Y ctrunieto3= -a flie\sysieff
Oxojpfl mo iln`untl mo rokres pere Eumgtlrge mo Yystoj Ieff vgniufemes e IDJLM o IDL[N0
-e ontry,efweys -C erid:b92 -Y idjlm -Y cidjlm -Y cidjlmet -a flie\
sysieff
-e ontry,efweys -C erid:b3= -Y idjlm -Y cidjlm -Y cidjlmet -a flie\
sysieff
-e ontry,efweys -C erid:b92 -Y idlwn -Y cidlwn -Y cidlwnet -Y
fidlwn -a flie\sysieff
-e ontry,efweys -C erid:b3= -Y idlwn -Y cidlwn -Y cidlwnet -Y
fidlwn -a flie\sysieff
-e ontry,efweys -C erid:b92 -Y cidlwn92 -Y idlwn92 -Y fidlwn92 -a
flie\sysieff
-e ontry,efweys -Y unfgna -Y ronejo -Y fgna -Y syjfgna -a flie\
sysieff
-e ontry,efweys -Y janlm -a flie\sysieff
-e ontry,efweys -Y jlunt -a flie\sysieff
-e ontry,efweys -Y iflno -a flie\sysieff
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 265/282
2=7
I e p ê t u f l
5 8 - E u m g t l r g e n e i e j e m e m o A
o r n o f
-e ontry,efweys -Y clra -a flie\sysieff
-e ontry,efweys -Y vclra -a flie\sysieff
-e ontry,efweys -Y iflno2 -a flie\sysieff
-e ontry,efweys -Y ujesa -a flie\sysieff
-e ontry,efweys -Y em`tgjox -Y sottgjolcmey -a flie\sysieff
Oxojpfl mo rokres pere eumgtlrge mo Yystoj Ieffs vgniufemes e lporeëÿos mo ‖jlvo, rojlvor
o fgna‚ mo erqugvl0
-e ontry,efweys -C erid:b92 -Y unfgna -Y unfgnaet -Y ronejo -Y
ronejoet -a flie\sysieff
-e ontry,efweys -C erid:b3= -Y unfgna -Y unfgnaet -Y ronejo -Y
ronejoet -a flie\sysieff
-e ontry,efweys -C erid:b92 -Y fgna -Y fgnaet -Y syjfgna -Y syjfgnaet
-a flie\sysieff
-e ontry,efweys -C erid:b3= -Y fgna -Y fgnaet -Y syjfgna -Y syjfgnaet
-a flie\sysieff
Oxojpfl mo rokres pere eumgtlrge mo Yystoj Ieffs vgniufemes e lporeëÿos mo Jengpufeëél mo
etrgbutls mo erqugvls0
-e ontry,efweys -C erid:b92 -Y sotxettr -Y fsotxettr -Y csotxettr -Y
rojlvoxettr -Y frojlvoxettr -Y crojlvoxettr -a flie\sysieff
-e ontry,efweys -C erid:b3= -Y sotxettr -Y fsotxettr -Y csotxettr -Y
rojlvoxettr -Y frojlvoxettr -Y crojlvoxettr -a flie\sysieff
Oxojpfl mo rokres pere eumgtlrge mo Yystoj Ieffs vgniufemes e lporeëÿos ilj erqugvls
mo mgsplsgtgvls0
-e ontry,efweys -C erid:b92 -Y janlm -Y janlmet -a flie\sysieff
-e ontry,efweys -C erid:b3= -Y janlm -Y janlmet -a flie\sysieff
Oxojpfl mo rokres pere eumgtlrge mo Yystoj Ieffs v gniufemes e lporeëÿos ilj mgrotùrgls0
-e ontry,efweys -C erid:b92 -Y jamgr -Y jamgret -Y rjmgr -a flie\
sysieff
-e ontry,efweys -C erid:b3= -Y jamgr -Y jamgret -Y rjmgr -a flie\
sysieff
Oxojpfl mo rokres pere eumgtlrge mo Yystoj Ieffs vgniufemes e lporeëÿos mo jlntekoj0
-e ontry,efweys -Y ujlunt-a flie\sysieff -a flie\sysieff
-e ontry,efweys -Y ujlunt2 -a flie\sysieff -a flie\sysieff
-e ontry,efweys -C erid:b92 -Y jlunt -Y ujlunt -Y ujlunt2 -a flie\
sysieff
-e ontry,efweys -C erid:b3= -Y jlunt -Y ujlunt -Y ujlunt2 -a flie\
sysieff
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 266/282
2?8
D e r m o n g n k o j F
g n u x
Oxojpfl mo rokres pere eumgtlrge mo Yystoj Ieffs vgniufemes e GXI YWYS (fes mo jonsekons
ontro iljplnontos ml aornof)0
-e ontry,efweys -Y gpi -C e8:5= -a flie\sysieff
-e ontry,efweys -Y gpi -C e8:59 -a flie\sysieff
Oxojpfl mo rokres pere eumgtlrge mo Yystoj Ieffs vgniufemes e GXI YWYS sojepdlros0
-e ontry,efweys -Y gpi -C e8:9 -a flie\sysieff
-e ontry,efweys -Y gpi -C e8:2 -a flie\sysieff
-e ontry,efweys -Y gpi -C e8:5 -a flie\sysieff
-e ontry,efweys -Y gpi -C e8:= -a flie\sysieff
Oxojpfl mo rokres pere eumgtlrge mo Yystoj Ieffs vgniufemes è GXI YWYS sderom jojlry0
-e ontry,efweys -Y gpi -C e8:2= -a flie\sysieff
-e ontry,efweys -Y gpi -C e8:29 -a flie\sysieff
Oxojpfl mo rokres pere eumgtlrge mo Yystoj Ieffs vgniufemes è irgeëél mo prliossls (clra) lu
mo tdroem (iflno), pere usl jugtl ospoiêil0
-e ontry,efweys -C erid:b92 -Y iflno -a flie\sysieff
-e ontry,efweys -C erid:b3= -Y iflno -a flie\sysieff
-e ontry,efweys -C erid:b92 -Y clra -Y vclra -a flie\sysieff
-e ontry,efweys -C erid:b3= -Y clra -Y vclra -a flie\sysieff
Oxojpfl mo rokres pere eumgtlrge mo Yystoj Ieffs vgniufemes e _JEYA0
-e ontry,efweys -C erid:b92 -Y ujesa -a flie\sysieff
-e ontry,efweys -C erid:b3= -Y ujesa -a flie\sysieff
Oxojpfl mo rokres pere eumgtlrge mo Yystoj Ieffs vgniufemes è jlmgieëél mo dlrårgl
nl sgstoje0
-e ontry,efweys -C erid:b92 -Y em`tgjox -Y sottgjolcmey -Y iflia\
sottgjo -a flie\sysieff
-e ontry,efweys -C erid:b3= -Y em`tgjox -Y sottgjolcmey -Y iflia\
sottgjo -a flie\sysieff
Oxojpfl mo rokres pere eumgtlrge mo Yystoj Ieffs vgniufemes e X]R EIO0
-e ontry,efweys -C erid:b92 -Y ptreio -a flie\sysieff
Oxojpfl mo rokres pere eumgtlrge mo Yystoj Ieffs0
-e oxgt,efweys -C erid:b92 -Y porslnefgty -a flie\sysieff
Oxojpfl mo rokres pere eumgtlrge mo korànige mo etgvgmemos mo IRLN / E] / ENEIRLN‚
-w /ver/spllf/et
-w /oti/et.efflw -p we -a flie-idenkojenekojont -a flie\irln
-w /oti/et.mony -p we -a flie-idenkojenekojont -a flie\irln
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 267/282
2?5
I e p ê t u f l
5 8 - E u m g t l r g e n e i e j e m e m o A
o r n o f
-w /oti/irln.efflw -p we -a flie-idenkojenekojont -a flie\irln
-w /oti/irln.mony -p we -a flie-idenkojenekojont -a flie\irln
-w /oti/irln.m/ -p we -a flie-idenkojenekojont -a flie\irln
-w /oti/irln.megfy/ -p we -a flie-idenkojenekojont -a flie\irln
-w /oti/irln.dlurfy/ -p we -a flie-idenkojenekojont -a flie\irln
-w /oti/irln.jlntdfy/ -p we -a flie-idenkojenekojont -a flie\irln
-w /oti/irln.wooafy/ -p we -a flie-idenkojenekojont -a flie\irln
-w /oti/irlnteb -p we -a flie-idenkojenekojont -a flie\irln
-w /ver/spllf/irln/rllt -p we -a flie-idenkojenekojont -a flie\irln
-w /oti/eneirlnteb -p we -a flie-idenkojenekojont -a flie\irln
Oxojpfl mo rokres pere eumgtlrge mo ilnkureëÿos koregs gnorontos è eutontgieëél mo usuårgls0
-w /oti/krlup -a flie\eutontgieiel -a flie-idenkojenekojont
-w /oti/pesswm -a flie\eutontgieiel -a flie-idenkojenekojont
-w /oti/pesswm- -a flie\eutontgieiel -a flie-idenkojenekojont
-w /oti/ksdemlw -a flie\eutontgieiel -a flie-idenkojenekojont
-w /oti/sdemlw -a flie\eutontgieiel -a flie-idenkojenekojont
-w /oti/sdemlw- -a flie\eutontgieiel -a flie-idenkojenekojont
-w /oti/flkgn.mocs -p we -a flie\eutontgieiel -a flie-
idenkojenekojont
Oxojpfl mo rokres pere eumgtlrge mo ilnkureëÿos ilj roiursls mo eutontgieëél0
-w /oti/sumlors -p we -a flie\eutontgieiel
-w /oti/soiurotty -p we -a flie-idenkojenekojont
-w /ver/flk/cegfflk -p we -a flie-idenkojenekojont
-w /ver/flk/festflk -p we -a flie-idenkojenekojont
-w /oti/sdoffs -p we -a flie-idenkojenekojont
-w /oti/prlcgfo -a -p wex flie-idenkojenekojont
-w /oti/besdri -p we -a flie-idenkojenekojont
-w /oti/isd.isdri -p we -a flie-idenkojenekojont
-w /oti/isd.flkgn -p we -a flie-idenkojenekojont
-w /oti/sysilncgk/ -p we -a flie-idenkojenekojont
Oxojpfl mo rokres pere eumgtlrge mo ilnkureëél ml /oti0
-w /oti/gngtteb -p we -a flie-idenkojenekojont
-w /oti/ri.flief -p we -a flie-idenkojenekojont
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 268/282
2?2
D e r m o n g n k o j F
g n u x
-w /oti/ri.sysgngt -p we -a flie-idenkojenekojont
-w /oti/fm.sl.ilnc -p we -a flie-idenkojenekojont
-w /oti/fm.sl.ilnc.m/ -p we -a flie-idenkojenekojont
-w /oti/flieftgjo -p we -a flie-idenkojenekojont
-w /oti/sysitf.ilnc -p we -a flie-idenkojenekojont
-w /oti/jlmprlbo.ilnc -p we -a flie-idenkojenekojont
-w /oti/gssuo -p we -a flie-idenkojenekojont
-w /oti/gssuo.not -p we -a flie-idenkojenekojont
-w /ot/jltm -p we -a flie-idenkojenekojont
-w /oti/pej\sjb.ilnc -p we -a flie-idenkojenekojont
Oxojpfl mo rokres pere eumgtlrge mo ilnkureëÿos XEJ0
-w /oti/pej.m/ -p we -a flie-idenkojenekojont -p pej
-w /oti/soiurgty/fgjgts.ilnc -p we -a flie-idenkojenekojont -p pej
-w /oti/soiurgty/pej\onv.ilnc -p we -a flie-idenkojenekojont -p pej
-w /oti/soiurgty/nejospeio.ilnc -p we -a flie-idenkojenekojont -p
pej
-w /oti/soiurgty/nejospeio.gngt -p we -a flie-idenkojenekojont -p
pej
Oxojpfl mo rokres pere eumgtlrge mo ilnkureëél pere eumgtlrge mo sorv gëls mo romo0
-w /oti/dlsts -p we -a flie-idenkojenekojont -a flie-notwlra
-w /oti/sysilncgk/notwlra-sirgpts/ -p we -a flie-idenkojenekojont
-a flie-notwlra
-w /oti/mdipm.ilnc -p we -a flie-idenkojenekojont -a flie-notwlra
-w /oti/mdifgont-otd8.ilnc -p we -a flie-idenkojenekojont -a flie-
notwlra
-w /oti/xgnotm.ilnc -p we -a flie-idenkojenekojont -a flie-notwlra
-w /oti/xgnotm.m/ -p we -a flie-idenkojenekojont -a flie-notwlra
-w /oti/dlsts.efflw -p we -a flie-idenkojenekojont -a flie-notwlra
-w /oti/dlsts.mony -p we -a flie-idenkojenekojont -a flie-notwlra
-w /oti/dlsts -p we -a flie-idenkojenekojont -a flie-notwlra t
-w /oti/roslfv.ilnc -p we -a flie-idenkojenekojont -a flie-notwlra
-w /oti/nsswgtid.ilnc -p we -a flie-idenkojenekojont -a flie-notwlra
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 269/282
2?9
I e p ê t u f l
5 8 - E u m g t l r g e n e i e j e m e m o A
o r n o f
Oxojpfl mo rokres pere eumgtlrge mo ilnkureëÿos mo romo ml sorvgël NCY / E_]LJL_N]0
-w /oti/eutl.jestor -p we -a flie-idenkojenekojont -a ncs
-w /oti/eutl.jgsi -p we -a flie-idenkojenekojont -a ncs
-w /oti/oxplrts -p we -a flie-idenkojenekojont -a ncs
Oxojpfl mo rokres pere eumgtlrge mo ilnkureëÿos mo romo ml sorvgël Xlstx0
-w /oti/plstcgx/ -p we -a flie-idenkojenekojont -a plstcgx
Oxojpfl mo rokres pere eumgtlrge mo ilnkureëÿos mo romo ml sorvgël N]X0
-w /oti/ntp.ilnc -a idenko\jenekojont -a ntp
# Rokres pere Eumgtlrge oj ilnkureëÿos mo romo ml sor vgël YYD0
-w /oti/ssd/ssdm\ilncgk -p we -a flie-idenkojenekojont -a ssd
Oxojpfl mo rokres pere eumgtlrge ml sorvgël Y]_NNOF0
-w /oti/stunnof/stunnof.ilnc -p we -a flie-idenkojenekojont -a stunnof
-w /oti/stunnof/stunnof.poj -p we -a flie-idenkojenekojont -a stunnof
Oxojpfl mo rokres pere eumgtlrge mo ilnkureëÿos mo romo ml sorvgël C]X / SYC]X0
-w /oti/vsctpm.ctpusors -p we -a flie-idenkojenekojont -a ctpusors
-w /oti/vsctpm/vsctpm.ilnc -p we -a flie-idenkojenekojont -a vsctpm
Oxojpfl mo rokres pere eumgtlrge mo ilnkureëÿos mo romo ml sorvgël D]]X / EXEIDO0
-w /oti/dttpm/ilnc/ -p we -a flie-idenkojenekojont -a epeido
-w /oti/dttpm/ilnc.m/ -p we -a flie-idenkojenekojont -a epeido
Oxojpfl mo rokres pere eumgtlrge mo ilnkureëÿos mo romo ml sorvgël YEJBE0
-w /oti/sejbe/sjb.ilnc -p we -a flie-idenkojenekojont -a sejbe
-w /oti/sejbe/sjbpesswm -p we -a flie-idenkojenekojont -a sejbe
-w /oti/sejbe/soirots.tmb -p we -a flie-idenkojenekojont -a sejbe
-w /oti/jy.ilnc -p we -a flie-idenkojenekojont -a sejbe
Oxojpfl mo rokres pere eumgtlrge mo ilnkureëÿos koregs mo o-jegf pere l sonmjegf0
-w /oti/efgesos -p we -a flie-idenkojenekojont -a sonmjegf -a plstgcx
-w /oti/jegf/eiioss -p we -a flie-idenkojenekojont -a sonmjegf
-w /oti/jegf/eiioss.mb -p we -a flie-idenkojenekojont -a sonmjegf
-w /oti/jegf/efgesos -p we -a flie-idenkojenekojont -a sonmjegf
-w /oti/jegf/mljegntebfo -p we -a flie-idenkojenekojont -a sonmjegf
-w /oti/jegf/mljegntebfo.mb -p we -a flie-idenkojenekojont -a sonmjegf
-w /oti/jegf/dofpcgfo -p we -a flie-idenkojenekojont -a sonmjegf
-w /oti/jegf/flief-dlst-nejos -p we -a flie-idenkojenekojont -a sonmjegf
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 270/282
2?=
D e r m o n g n k o j F
g n u x
-w /oti/jegf/jegfortebfo -p we -a flie-idenkojenekojont -a sonmjegf
-w /oti/jegf/jegfortebfo.mb -p we -a flie-idenkojenekojont -a sonmjegf
-w /oti/jegf/Jeaocgfo -p we -a flie-idenkojenekojont -a sonmjegf
-w /oti/jegf/sonmjegf.ic -p we -a flie-idenkojenekojont -a sonmjegf
-w /oti/jegf/sonmjegf.ji -p we -a flie-idenkojenekojont -a sonmjegf
-w /oti/jegf/subjgt.ic -p we -a flie-idenkojenekojont -a sonmjegf
-w /oti/jegf/subjgt.ji -p we -a flie-idenkojenekojont -a sonmjegf
-w /oti/jegf/trustom-usors -p we -a flie-idenkojenekojont -a sonmjegf
-w /oti/jegf/vgrtusortebfo -p we -a flie-idenkojenekojont -a sonmjegf
-w /oti/jegf/vgrtusortebfo.mb -p we -a flie-idenkojenekojont -a
sonmjegf
Oxojpfl mo rokres pere eumgtlrge mo ilnkureëÿos mo romo ml sorvgël FLK / YNJX0
-w /oti/sysflk.ilnc -p we -a flie-idenkojenekojont -a sysflk
-w /oti/snjp/snjpm.ilnc -p we -a flie-idenkojenekojont -a snjp
Oxojpfl mo rokres pere eumgtlrge mo ilnkureëÿos mo romo ml sorvgël NGY0
-w /oti/yp.ilnc -a flie-idenkojenekojont -a ngs
-w /ver/yp/bgnmgnkv -a flie-idenkojenekojont -a ngs
Oxojpfl mo rokres pere eumgtlrge mo ilnkureëÿos mo romo ml sorvgël fmep0
-w /oti/fmep.ilnc -a flie-idenkojenekojont -a fmep
Oxojpfl mo rokres pere eumgtlrge mo ilnkureëÿos mo romo ml sorvgël aorborls0
-w /oti/arb?.ilnc -p we -a flie-idenkojenekojont -a aorborls
-w /oti/arb.ilnc -p we -a flie-idenkojenekojont -a aorborls
-w /oti/arb.roefjs -p we -a flie-idenkojenekojont -a aorborls
-w /oti/gngtflk.ilnc -p we -a flie-idenkojenekojont
-w /oti/moceuft/ -p we -a flie-idenkojenekojont
-w /oti/cgrjwero/jgirlilmo.met -p we -a flie-idenkojenekojont
-w /oti/csteb -p we -a flie-idenkojenekojont
]lrnenml gjutåvof es rokres ml Crejowlra Eumgt0
-o 2
Roefgzeëél mo eumgtlrge pere gmontgieëél mo eftoreëÿos eiossl el erqugvl /oti/pesswm ilj l
iljenml eusoerid.
]ràs oxojpfgieëÿos mo iljl user l iljenml eusoerid0
# eusoerid -c /oti/pesswm
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 271/282
2??
I e p ê t u f l
5 8 - E u m g t l r g e n e i e j e m e m o A
o r n o f
# eusoerid -c /oti/pesswm | foss
# eusoerid -c /oti/pesswm -g | foss
Lnmo0
5 * -c /oti/pesswm0 epones prliure plr osso erqugvl1
5 * -g0 gntorprote ontgmemos nujçrgies nl toxtl. Xlr oxojpfl, _GMs sél ilnvortgmls perenljos mo usuårgl.
Yeême0
typo:XE]D jsk:eumgt(89/53/288; 5=0?20?7.74?0??) 0 nejo:/oti/pesswm
cfeks:clfflw,lpon
gnlmo:2984;9=3 mov:84082 jlmo:cgfo,3== lugm:rllt lkgm:rllt rmov:88088
typo:I[M jsk:eumgt(89/53/288; 5=0?20?7.74?0??) 0 iwm:/wobrllt/dljo/
fgkdttpm
typo:CY\GNLMO jsk:eumgt(89/53/288; 5=0?20?7.74?0??) 0 gnlmo:2984;9=3
gnlmo\ugm:rllt
gnlmo\kgm:rllt gnlmo\mov:84082 gnlmo\rmov:88088
typo:CY\[E]ID jsk:eumgt(89/53/288; 5=0?20?7.74?0??) 0 wetid\
gnlmo:2984;9=3 wetid:pesswm
cgftoraoy:pesswlrm-cgfo porj:roem,wrgto,epponm porj\jesa:roem
typo:YWYIEFF jsk:eumgt(89/53/288; 5=0?20?7.74?0??) 0 erid:x43\3=
sysieff:lpon suiioss:yos
oxgt:9 e8:;cbccccib= e5:8 e2:2 e9:35;5m8 gtojs:5 pgm:52??5
eugm:unanlwn(=27=73;27?)
ugm:fgkdttpm kgm:fgkdttpm ougm:fgkdttpm sugm:fgkdttpm csugm:fgkdttpm
okgm:fgkdttpm
skgm:fgkdttpm cskgm:fgkdttpm iljj:krop oxo:/bgn/krop
Iljl movo-so enefgser e seême0
5 * eumgt(89/53/288; 5=0?20?7.74?0??)0 mete ml rokgstrl me eumgtlrge1
5 * ugm:fgkdttpm kgm:fgkdttpm0 _GMs o KGMs ilnvortgmls pere clrjetl mo toxtl. Xessenml
e lpëél ’g, queso tlmls ls memls nujçrgils sél ilnvortgmls pere memls dujenejonto
fokêvogs. Nl oxojpfl, l usuårgl fgkdttpm uslu l iljenml krop pere ebrgr l erqugvl1 5 * oxo:‚/bgn/krop‚0 iljenml utgfgzeml pere eiosser l erqugvl /oti/pesswm 1
5 * porj\jesa:roem0 l erqugvl clg ebortl pere fogture1
Sorgie-so quo e pert gr mls erqugvls mo flk ml Crejowlra Eumgt plmojls restroer quoj
ilnsuftlu uj erqugvl ilj krop lu krevlu eftoreëÿos utgfgzenml l omgtlr vg/v gj. Ls flks
prlvooj krenmo quentgmemo mo gnclrjeëÿos. Xroigsejls for es påkgnes mo jenuef (jen
pekos) o mojegs mliujonteëÿos pere ontonmor l clrjetl mo flk ‖iru‚.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 272/282
2?3
D e r m o n g n k o j F
g n u x
Lutrls oxojpfls ðtogs
Xosqugser ovontls ilj mete o dlre ospoiêie. Yo e mete clr ljgtgme, e mete mo dl`o ç essu-
jgme. Yo e dlre clr ljgtgme, ‖eklre‚ ç essujgml plr pemrél. _so e nlteëél mo 2= dlres oj
voz me nlteëél EJ/XJ pere ospoigier e dlre. Oxojpfl0 mete 2=/28/8?, dlre 54088088.
# eusoerid -ts tlmey -a pesswlrm-cgfo
# eusoerid -ts 9/52/8; -a pesswlrm-cgfo
Xosqugser plr uj ovontl iesenml ilj l utgfgtårgl ospoigieml utgfgzenml e lpëél -x.
Xlr oxojpfl, vorgier quoj eiosslu l erqugvl /oti/pesswm usenml rj.
# eusoerid -ts tlmey -a pesswlrm-cgfo -x rj
# eusoerid -ts 9/52/8; -a pesswlrm-cgfo -x rj
Xosqugser plr uj ovontl mo motorjgneml usuårgl pofl _GM. Sorgier so l usuårgl nol
(_GM 4;3) tontlu eiosser l erqugvl /oti/pesswm 0
# eusoerid -ts tlmey -a pesswlrm-cgfo -x rj -ug 4;3
# eusoerid -a pesswlrm-cgfo -ug ?83
Koreëél mo rofetùrgls ilj e correjonte E_ROXLR].
Oxojpfls mo ilnsuftes è beso mo rokgstrls ml Crejowlra Eumgt ilj europlrt, mo oxtreëél
mo gnclrjeëÿos slbro e ilntebgfgzeëél0
# europlrt -gc /ver/flk/eumgt/eumgt.flk
Yujjery Roplrt
::::::::::::::::::::::
Renko lc tgjo gn flks0 2;-87-2858 5502=0=3.?73 - 24-87-2858
5905308=.378
Yofoitom tgjo clr roplrt0 2;-87-2858 5502=0=3 - 24-87-2858
5905308=.378
Nujbor lc idenkos gn ilncgkuretgln0 8
Nujbor lc idenkos tl eiilunts, krlups, lr rlfos0 ?2?=
Nujbor lc flkgns0 8
Nujbor lc cegfom flkgns0 8
Nujbor lc eutdontgietglns0 52
Nujbor lc cegfom eutdontgietglns0 ;27
Nujbor lc usors0 52
Nujbor lc torjgnefs0 ?
Nujbor lc dlst nejos0 25
Nujbor lc oxoiutebfos0 ;
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 273/282
2?;
I e p ê t u f l
5 8 - E u m g t l r g e n e i e j e m e m o A
o r n o f
Nujbor lc cgfos0 8
Nujbor lc ESI‗s0 8
Nujbor lc JEI ovonts0 8
Nujbor lc cegfom sysieffs0 8
Nujbor lc enljefy ovonts0 8
Nujbor lc rosplnsos tl enljefy ovonts0 8
Nujbor lc iryptl ovonts0 8
Nujbor lc aoys0 8
Nujbor lc prlioss GMs0 ;35;
Nujbor lc ovonts0 5;335
# europlrt --cegfom
Cegfom Yujjery Roplrt
::::::::::::::::::::::
Renko lc tgjo gn flks0 29-87-2887 8?0=50??.=94 - 24-87-2887 590280?3.338
Yofoitom tgjo clr roplrt0 29-87-2887 8?0=50?? - 24-87-2887 590280?3.338
Nujbor lc idenkos gn ilncgkuretgln0 8
Nujbor lc idenkos tl eiilunts, krlups, lr rlfos0 2?47?
Nujbor lc flkgns0 8
Nujbor lc cegfom flkgns0 8
Nujbor lc eutdontgietglns0 8
Nujbor lc cegfom eutdontgietglns0 3244
Nujbor lc usors0 8
Nujbor lc torjgnefs0 ?
Nujbor lc dlst nejos0 =?Nujbor lc oxoiutebfos0 9
Nujbor lc cgfos0 8
Nujbor lc ESI‗s0 8
Nujbor lc JEI ovonts0 8
Nujbor lc cegfom sysieffs0 8
Nujbor lc enljefy ovonts0 8
Nujbor lc rosplnsos tl enljefy ovonts0 8
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 274/282
2?4
D e r m o n g n k o j F
g n u x
Nujbor lc iryptl ovonts0 8
Nujbor lc aoys0 8
Nujbor lc prlioss GMs0 28345
Nujbor lc ovonts0 92252
# europlrt --suiioss
Yuiioss Yujjery Roplrt
::::::::::::::::::::::
Renko lc tgjo gn flks0 29-87-2887 8?0=50??.=94 - 24-87-2887
5902709=.=29
Yofoitom tgjo clr roplrt0 29-87-2887 8?0=50?? - 24-87-2887
5902709=.=29
Nujbor lc idenkos gn ilncgkuretgln0 8
Nujbor lc idenkos tl eiilunts, krlups, lr rlfos0 399
Nujbor lc flkgns0 8
Nujbor lc cegfom flkgns0 8
Nujbor lc eutdontgietglns0 524
Nujbor lc cegfom eutdontgietglns0 8
Nujbor lc usors0 59
Nujbor lc torjgnefs0 58
Nujbor lc dlst nejos0 =4
Nujbor lc oxoiutebfos0 4
Nujbor lc cgfos0 8
Nujbor lc ESI‗s0 8
Nujbor lc JEI ovonts0 8
Nujbor lc cegfom sysieffs0 8
Nujbor lc enljefy ovonts0 8
Nujbor lc rosplnsos tl enljefy ovonts0 8
Nujbor lc iryptl ovonts0 8
Nujbor lc aoys0 8
Nujbor lc prlioss GMs0 55578
Nujbor lc ovonts0 ?4272
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 275/282
2?7
I e p ê t u f l
5 8 - E u m g t l r g e n e i e j e m e m o A
o r n o f
europlrt -u --sujjery
_sor Yujjery Roplrt
:::::::::::::::::::::::::::
tltef eugm
:::::::::::::::::::::::::::
55?38 8
388 9888
48 9287
28 ?8?9;
52 9?47
58 ?8?=7
58 ?8?8;
58 ?8?=8
58 9?;2
58 92=3
58 987;
58 92;8
2 95?=
Yeême perigef0
europlrt -o
Ovont Roplrt
:::::::::::::::::::::::::::::::::::
# meto tgjo ovont typo eugm suiioss
:::::::::::::::::::::::::::::::::::5. 29-87-2887 8?0=50?? =5=9337 IROM\EIU -5 yos
2. 29-87-2887 8?0=50?? =5=93;8 _YOR\Y]ER] -5 yos
9. 29-87-2887 8?0=50?? =5=93;5 _YOR\ONM -5 yos
=. 29-87-2887 8?0=50?? =5=93;2 _YOR\IJM -5 yos
?. 29-87-2887 8?0=20?3 =5=93;9 IROM\EIU -5 yos
3. 29-87-2887 8?0=20?3 =5=93;= _YOR\Y]ER] -5 yos
;. 29-87-2887 8?0=20?3 =5=93;? _YOR\ONM -5 yos
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 276/282
238
D e r m o n g n k o j F
g n u x
4. 29-87-2887 8?0=20?3 =5=93;3 _YOR\IJM -5 yos
7. 29-87-2887 8?0=909= =5=93;; IROM\EIU -5 yos
58. 29-87-2887 8?0=909= =5=93;4 _YOR\Y]ER] -5 yos
55. 29-87-2887 8?0=909= =5=93;7 _YOR\ONM -5 yos
52. 29-87-2887 8?0=909= =5=9348 _YOR\IJM -5 yos
59. 29-87-2887 8?0=909= =5=9345 IROM\EIU -5 yos
5=. 29-87-2887 8?0=909= =5=9342 _YOR\Y]ER] -5 yos
5?. 29-87-2887 8?0=909= =5=9349 _YOR\ONM -5 yos
Xerigef0
# europlrt -p
Xrlioss GM Roplrt
::::::::::::::::::::::::::::::::::::::
# meto tgjo pgm oxo sysieff eugm ovont
::::::::::::::::::::::::::::::::::::::
5. 29-87-2887 8?0=50?? 5=97; /usr/bgn/suml 8 -5 =5=9337
2. 29-87-2887 8?0=50?? 5=97; /usr/bgn/suml 8 -5 =5=93;8
9. 29-87-2887 8?0=50?? 5=97; /usr/bgn/suml 8 -5 =5=93;5
=. 29-87-2887 8?0=50?? 5=97; < 8 -5 =5=93;2
?. 29-87-2887 8?0=20?3 5=?89 /usr/bgn/suml 8 -5 =5=93;9
3. 29-87-2887 8?0=20?3 5=?89 /usr/bgn/suml 8 -5 =5=93;=
;. 29-87-2887 8?0=20?3 5=?89 /usr/bgn/suml 8 -5 =5=93;?
4. 29-87-2887 8?0=20?3 5=?89 < 8 -5 =5=93;3
7. 29-87-2887 8?0=909= 5=?;2 /usr/bgn/suml 8 -5 =5=93;;
58. 29-87-2887 8?0=909= 5=?;2 /usr/bgn/suml 8 -5 =5=93;4
55. 29-87-2887 8?0=909= 5=?;2 /usr/bgn/suml 8 -5 =5=93;752. 29-87-2887 8?0=909= 5=?;2 < 8 -5 =5=9348
59. 29-87-2887 8?0=909= 5=?;= /usr/bgn/suml 8 -5 =5=9345
5=. 29-87-2887 8?0=909= 5=?;= /usr/bgn/suml 8 -5 =5=9342
5?. 29-87-2887 8?0=909= 5=?;= /usr/bgn/suml 8 -5 =5=9349
#europlrt -x | doem -n 2?
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 277/282
235
I e p ê t u f l
5 8 - E u m g t l r g e n e i e j e m e m o A
o r n o f
Oxoiutebfo Roplrt
::::::::::::::::::::::::::::::::::::
# meto tgjo oxo torj dlst eugm ovont
::::::::::::::::::::::::::::::::::::
5. 29-87-2887 8?0=50?? /usr/bgn/suml < dj5284 -5 =5=9337
2. 29-87-2887 8?0=50?? /usr/bgn/suml < dj5284 -5 =5=93;8
9. 29-87-2887 8?0=50?? /usr/bgn/suml < dj5284 -5 =5=93;5
=. 29-87-2887 8?0=20?3 /usr/bgn/suml < dj5284 -5 =5=93;9
?. 29-87-2887 8?0=20?3 /usr/bgn/suml < dj5284 -5 =5=93;=
3. 29-87-2887 8?0=20?3 /usr/bgn/suml < dj5284 -5 =5=93;?
;. 29-87-2887 8?0=909= /usr/bgn/suml < dj5284 -5 =5=93;;
4. 29-87-2887 8?0=909= /usr/bgn/suml < dj5284 -5 =5=93;4
7. 29-87-2887 8?0=909= /usr/bgn/suml < dj5284 -5 =5=93;7
58. 29-87-2887 8?0=909= /usr/bgn/suml < dj5284 -5 =5=9345
55. 29-87-2887 8?0=909= /usr/bgn/suml < dj5284 -5 =5=9342
52. 29-87-2887 8?0=909= /usr/bgn/suml < dj5284 -5 =5=9349
59. 29-87-2887 8?0=90?4 /usr/bgn/suml < dj5284 -5 =5=934?
5=. 29-87-2887 8?0=90?4 /usr/bgn/suml < dj5284 -5 =5=9343
5?. 29-87-2887 8?0=90?4 /usr/bgn/suml < dj5284 -5 =5=934;
53. 29-87-2887 8?0==0?4 /usr/bgn/suml < dj5284 -5 =5=9347
5;. 29-87-2887 8?0==0?4 /usr/bgn/suml < dj5284 -5 =5=9378
54. 29-87-2887 8?0==0?4 /usr/bgn/suml < dj5284 -5 =5=9375
57. 29-87-2887 8?0=?085 /usr/sbgn/irlnm irln < -5 =5=9379
28. 29-87-2887 8?0=?085 /usr/sbgn/irlnm irln < -5 =5=937=
# europlrt -u | tegf
/sbgn/eumgspm porjgssglns sdlufm bo 8;?8
4=. 87/29/2887 5=0=4095 -5 < < < 9
4?. 87/29/2887 5=0?9088 -5 (nlno) < /usr/fgb/vgrtuefblx/SgrtuefBlx =
43. 87/29/2887 5=0?3022 -5 < < < ?
4;. 87/29/2887 5=0?30?5 -5 (nlno) < /usr/fgb/vgrtuefblx/SgrtuefBlx 3
44. 87/29/2887 5?053029 -5 (nlno) < /usr/fgb/vgrtuefblx/SgrtuefBlx ;
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 278/282
232
D e r m o n g n k o j F
g n u x
47. 87/29/2887 5?0=90?= -5 < < < 4
78. 87/2=/2887 5?05;0=; -5 pts4 < /usr/sbgn/tipmujp 7
75. 87/2=/2887 5?054089 -5 pts4 < /usr/sbgn/tipmujp 58
72. 87/24/2887 580=3085 -5 pts3 < /usr/sbgn/tipmujp 55
79. 87/24/2887 580?50?5 -5 pts3 < /usr/sbgn/tipmujp 52
Flk ]gjo Renko Roplrt
:::::::::::::::::::::
/ver/flk/eumgt/eumgt.flk.90 29-87-2887 8?0=50??.=94 - 2=-87-2887
5;0=5083.44?
/ver/flk/eumgt/eumgt.flk.20 2=-87-2887 5;0=5083.793 - 23-87-2887
8905809;.;9;
/ver/flk/eumgt/eumgt.flk.50 23-87-2887 8905809;.;;5 - 2;-87-2887
5502=0=3.?73
/ver/flk/eumgt/eumgt.flk0 2;-87-2887 5502=0=3.?73 - 24-87-2887
5=05?02?.394
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 279/282
239
I e p ê t u f l 5 8 - R l t o g r l m o E t g v g m e m o s 5 8
Rltogrl mo Etgvgmemos 58
Etgvgmemo 58.5 ’ Dermongnk oj Ygstoje Fgnux
Ne pråtgie mo iustljgzeëél, rokres mo rokgstrl mo ovontls e pertgr me sysieffs ilj l CrejowlraEumgt. Yorå noiossårgl quo l efunl utgfgzo e jåqugne vgrtuef propereme iljl Sgrtueblx. Mosse
clrje, sorå plssêvof epfgier tlmls ls ilndoigjontls (tçingies o correjontes) mo Dermongnk
prlplstls etç l jljontl.
Etgvgmemo 58.2 ’ Dermongnk Fgnux ’ Rokgstrl mo Ovontls (flks) o Eumgtlrge
5. Gnstefo o ilnkuro l moejln ml Eumgt.
2. Irgo rokre nl /oti/eumgt/eumgt.ilnc pere eumgtlrge ml /tjp, rokgstreml quefquor eëél ml
tgpl0 ‖osirgte, oxoiuëél o eftoreëél‚.
9. Irgo rokre nl /oti/eumgt/eumgt.ilnc pere eumgtlrge ml /rllt, rokgstrenml quefquor eëél mltgpl0 ‖osirgte, oxoiuëél o eftoreëél‚.
=. Irgo rokre nl /oti/eumgt/eumgt.ilnc pere eumgtlrge pere rokgstrer eëél ml tgpl0 ‖osirgte,
oxoiuëél o eftoreëél‚ nl rospoitgvls mgrotùrgls0 /oti/flkrlteto / , /oti/dlsts.efflw /oti/dlsts.
mony , /oti/dlsts, /oti/xgnotm.m/ , /oti/pesswm o /oti/sdemlw .
?. Irgo uje rokre nl /oti/eumgt/eumgt.ilnc pere jlngtlrer oxoiuëél mls iljenmls0 sdutmlwn,
robllt , deft , sdrom , ni , tipmujp o njep.
3. Ilnkuro l Crejowlra Eumgt pere onvger flks pere l Yysflk.
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 280/282
23=
D e r m o n g n k o j F
g n u x
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 281/282
Mlutlrenml nl ]GMM-X_I/YX, Jostro
oj Onkonderge me Iljputeëél nl
GX]/_YX, Jostro oj Onkonderge mo
Romos pofl GX]/_YX1 Xùs-kremueml oj
Emjgngstreëél mo Romos Fgnux pofe
_CFE-JK1 Xùs-kremueml oj Enåfgso mo
Ygstojes o Kremueëél oj Xrliosse-
jontl mo Memls pofe _ngvorsgmemo Jeiaonzgo, etue ne
åroe mo ]G mosmo mo 577;, roefgzenml nosto porêlml vårgls
prl`otls mo gjpfenteëél mo sorvgëls mo romo o sokurenëe.
Etuefjonto etue iljl Illrmonemlr ml Iursl mo Romos
mo Iljputemlros ne BENM]OI rosplnsåvof pofe iemogre
mo Ygstojes Lporeiglnegs, Iljputeëél Mgstrgbuême o
Iontrefgzeme o Yokurenëe o Eumgtlrge. Ç uj ovenkofgste ml
Ylctwero Fgvro, sonml ojbegxemlr Comlre, Xrlitlr BYME
o FXG, tejbçj etue iljl prlcosslr ilnvgmeml rospln-
såvof plr iåtomres gnorontos e Yokurenëe o Iljputeëél
Clronso oj sgstoje Fgnux, `å tonml e lplrtungmemo mo
etuer ne _CFE/ERF (JK), GB]E (Iejpgnes), _NGYEFOY (OY),
Ceiufmemo Xgtåklres (Kuereperg-OY, ]ogxogre mo Crogtes-BE),
_ngvorsgmemo Xltgkuer (RN), G]E (YX), GOEYEJ (XE), _ngrln
(RL), CEER(RL), CEIGM (XG) ontro lutres. Yonml gmoefgzemlr
o illrmonemlr mls iursls mo Xùs Kremueëél Yokurenëe
o Iljputeëél Clronso nes ontgmemos0 _ngvorsgmemo
Jeurêigl mo Nesseu (EF) , Ceiufmemo CEIGM (XG), Ceiufmemo
IO](XG), Ceiufmemo Etuef (RR), Gquefg/OOOJBE (BE)1 Gnstrutlr
eutlrgzeml CrooBYMBresgf o ilnvgmeml me Eiemojge Ifevgs..
7/21/2019 Hardening em Linux
http://slidepdf.com/reader/full/hardening-em-linux 282/282