Tips

With DoubleClick and others apparently harvesting your Netscape cookies to target advertising to you (and selling this data), you way want to "auto-remove" cookies. Many sites you visit, especially web merchants and banks, require cookies during your session to operate. However, these could be removed periodically, e.g., daily to solve this problem. Some may find this to require them to log in to sites more often than otherwise but this too is a security feature.

On Linux or UNIX, each user (or root for each user) may cause Netscape to not remember cookies after Netscape exits with the following commands:

rm $HOME/.netscape/cookies
ln -s /dev/null $HOME/.netscape/cookies

If you experience difficulty using scp or sftp, especially between systems not running the same distribution of ssh (OpenSSH vs. the SSH2), try having ssh invoke dd.

To copy foo to the local (client) system do:

ssh -lsomeone remote.com dd if=foo > foo

To copy foo from the local (client) system do:

ssh -lsomeone remote.com dd of=foo < foo

If it fails, typically with an unexpected error, try doing the appropriate command from the remote system (after having done a normal ssh to it).

The book did not encourage the use of Logcheck, Portsentry, and Hostsentry enough. These are really good tools for detecting attacks. See section 16.2.1 "Logcheck and Friends" on page 488 for the details.

It appears that the file "rlogin" was added to the /etc/pam.d directory in Red Hat 6.2. If you enabled "shadow" and "md5" to the files in this directory before upgrading to Red Hat 6.2, you need to apply these to the "rlogin" file too. They are discussed in 2.4.1 "Shadowed MD5 Passwords for Good Security" on page 42. This section says to add "shadow" and "md5" to the end of certain lines in each file in /etc/pam.d so you simply can redo those instructions after each system upgrade or after installation of new RPMs that use PAM.

In section 4.4.2 "FTP Proxy Dangers" on page 183, the book covers how to use "nmap" to detect if your FTP server is vulnerable to proxy attack. While all recent distributions of Linux and UNIX should be immune to this, older versions are vulnerable. The attack makes use of anonymous FTP.

Thus, older FTP servers can be protected by disabling anonymous FTP (if this is viable). I do strongly recommend against solution, however, because most older FTP servers, especially WU-FTP, are vulnerable to many other attacks including remote root exploits.

The recommended solution is to upgrade to a recent distribution, then apply all current security patches, and get on the distribution's security mailing list and apply all new security patches. Large sites will want to arrange for a system administrator to be paged when email from from one of these mailing lists, including alerts from X-Force, CERT, and similar organizations.

Undocumented Cisco commands are listed at the following site. Use at your own risk.

http://www.boerland.com/dotu/

If you have a LAN behind a firewall but receive email from your ISP only via POP, you might want your systems configured to allow sendmail to receive packets on port 25 but only from your internal machines. While IP Chains can be used to protect this port from outside use, there is an additional option.

Add the following line to your /etc/sendmail.cf file, assuming that your firewall's internal address is 10.0.0.1. Note that to get this affect with the new versions of Sendmail, you will want to edit the configuration file that is used to generate /etc/sendmail.cf. Then you will need to restart sendmail.

0 DaemonPortOptions=Addr=10.0.0.1

A Linux firewall always should defragment ("defrag") packets to protect against crackers attacking internal systems (not running recent Linux kernels, including Windows, some UNIX systems, and other vulnerable systems). An easy way to enable this is by adding the following to /etc/rc.d/rc.local.

echo 1 > /proc/sys/net/ipv4/ip_always_defrag

Return to Real World Linux Security Home Page.