Apéndice B. Appendix

Install the system, taking into account the information regarding partitioning included earlier in this document. After base installation, go into custom install. Do not select task packages.

Vaya através de dselect y remueva lo que no es necesario, si no selecciono paquetes antesv de ser (I)instalados. Deje la menor cantidad de programas necesarios en el servidor.

Actualice todo el software desde los utimos paquetes disponibles en security.debian.org como se expuso previamente en update.

implemente las sugerencias presentadas en este manual , considerando las cuotas del usuario, definiciones de login y lilo.

Make a list of services currently running on your system. Try:

$ ps -aux
$ netstat -pn -l -A inet 
# /usr/sbin/lsof -i | grep LISTEN

Necesitará instalar lsof-2.2 para que el tercer comando funcione (corralo como root). Debería ser consiente que lsof puede transladar la palabra LISTEN a su configuraciones de los locales.

In order to remove unnecessary services, first determine what package provides the service and how it is started. This can be accomplished by checking the program that listens in the socket. The following shell script, which uses the programs lsof and dpkg, does just that:

#!/bin/sh
# ARREGLAME: this is quick and dirty; replace with a more robust script snippet
for i in `sudo lsof -i | grep LISTEN | cut -d " " -f 1 |sort -u` ; do
 pack=`dpkg -S $i |grep bin |cut -f 1 -d : | uniq`
 echo "Service $i is installed by $pack";
 init=`dpkg -L $pack |grep init.d/ `
 if [ ! -z "$init" ]; then
 echo "and is run by $init"
 fi
done

Once you find any unwanted services, remove the associated package (with dpkg --purge), or disable the service from starting automatically at boot time using update-rc.d (see Sección 3.5.1, “Deshabilitar servicios”).

For inetd services (launched by the superdaemon), check which services are enabled in /etc/inetd.conf using:

  $ grep -v "^#" /etc/inetd.conf | sort -u

Then disable those services that are not needed by commenting out the line that includes them in /etc/inetd.conf, removing the package, or using update-inetd.

Si se tienen servicios de cubierta (usando estos /usr/sbin/tcpd) revise que los /etc/hosts.allow y /etc/hosts.deny estén configurados acorde a su política de servicios.

If the server uses more than one external interface, depending on the service, you may want to limit the service to listen on a specific interface. For example, if you want internal FTP access only, make the FTP daemon listen only on your management interface, not on all interfaces (i.e, 0.0.0.0:21).

Reinicie la máquina, o cámbiela para entrar a single user y vuelva a multiusuario con

  # init 1
  (....)
  # init 2

Revise los servicios disponibles actualmente, y si es necesario repita estos pasos de nuevo.

Instale, ahora los servicios necesarios, si usted todavia no lo ha hecho, y configurelos apropiadamente.

Use the following shell command to determine what user each available service is running as:

  # for i in `/usr/sbin/lsof -i |grep LISTEN |cut -d " " -f 1 |sort -u`; \
  > do user=`ps ef |grep $i |grep -v grep |cut -f 1 -d " "` ; \
  > echo "Service $i is running as user $user"; done

Consider changing these services to a specific user/group and maybe chroot'ing them for increased security. You can do this by changing the /etc/init.d scripts which start the service. Most services in Debian use start-stop-daemon, which has options (--change-uid and --chroot) for accomplishing this. A word of warning regarding the chroot'ing of services: you may need to put all the files installed by the package (use dpkg -L) providing the service, as well as any packages it depends on, in the chroot'ed environment. Information about setting up a chroot environment for the ssh program can be found in Sección B.7, “Chroot environment for SSH”.

Repita los pasos anteriores para revisar que los solamente los servicios deseados corran, y que lo hagan como el usuario o grupo desea.

Pruebe la instalación de servicios para saber si trabajan como se esperaba.

Compruebe el sistema usando un revisor de aseguramiento de vulnerabilidades (como nessus) para determinar las vulnerabilidades del sistema (configuraciones erróneas, servicios viejos o innecesarios)

Install network and host intrusion measures like snort and logcheck.

Repita el paso del revisor de red y verifique que los sistemas de detección de intrusiónd trabajan correctamente.

Agregar capacidades de cortafuegos al sistema, aceptando conexiones entrantes solamente para los servicios ofrecidos y limite conexiones salientes para los autorizados.

Vuelva a revisar la instalación con una nueva herramienta de revisión de vulnerabilidades.

Using a network scanner, check outbound connections from the system to an outside host and verify that unwanted connections do not find their way out.