Suggested improvements

Quickly checking the GPG signatures from the CD-ROM or web site

The gpgchktree.csh gpgchktree.csh script can be downloaded and used to check the GPG signatures of a directory tree of files, such as a copy of the CD-ROM supplied with the book. First, you will want to manually check the GPG signature of this script by downloading gpgchktree.csh.sig and issuing the command

gpg --verify gpgchktree.csh.sig

Remove nullok from all files in /etc/pam.d

Remove nullok from all files in /etc/pam.d. This will prevent the use of empty passwords that would allow logging into accounts without specifying a password. After doing this, if any account does not have a password, have the user invoke the "passwd" program to set a password. Assuming shadowed passwords, any account in /etc/passwd or /etc/shadow that has an empty second colon-separated field is lacking a password.

An easy to remove nullok is to invoke the commands

cd /etc/pam.d
favorite_editor `grep -l nullok *`

and search for " nullok", that is, a space followed by nullok and delete this pattern. In vi this deletion can be done via

dfk

Increase minimum password length in /etc/login.defs

Edit /etc/login.defs to change PASS_MIN_LEN from 5 to 8. This feature is known to exist in Red Hat, Mandrake, and Slackware.

Log successful su invocations under Slackware

In Slackware, in /etc/login.defs, uncomment the line to read:

SULOG_FILE /var/log/sulog

This causes both successful and unsuccessful su invocations to be logged to this file.

System Log files should be readable only by root

Make sure that any log file that contains passwords, such as PPP passwords during the expect/send sequence, are not readable except by root. This should include most log files under /var/log. If in doubt make it mode 600.

Remote logging must not include clear text passwords

Make sure that any log file analysis programs, such as Logcheck and techniques discussed in the book, do not send any passwords (typically from the log files) in clear text or to vulnerable accounts on the remote system that might be broken into.

By having added a remote user to the email list of those receiving Logcheck email, a PPP password started transiting the Internet in clear text. This is a serious security violation.

The best solution is to modify Logcheck (or other log file scanners) to filter out said passwords. (I've suggested this to Psionic so it might be incorporated into the next version of Logcheck.) The following filter added to /usr/local/etc/logcheck.sh right before the

# Perform Searches

comment is a good solution:

     # Bob: filter out PPP chat password, etc.
     sed -e 's/\.*send.*/cmpsolv chat...send CENSORED/' \
       < $TMPDIR/check.$$ > $TMPDIR/check2.$$
     mv $TMPDIR/check2.$$ $TMPDIR/check.$$

An alternative is to filter the output through gpg before piping it to the mail program. To encrypt for the foo@bar.com recipient, the gpg part of the command to add would be

| gpg -ea -r foo@bar.com

Note that foo@bar.com is the GPG name and may not be the same as his email address. Since you are not signing the encrypted message, gpg will not prompt for your GPG passphrase.

Return to Real World Linux Security Home Page.