Red Hat NETSCAPE MANAGEMENT SYSTEM 6.2 - COMMAND-LINE Guida di Installazione Scaricare il pdf (Pagina 18)

3.4. Exceptions

Above we used the criteria of turning off all unnecessary services. Sometimes that is not so obvious. And

sometimes what may be required for one person's configuration is not the same for another's. Let's look at a

few common services that fall in this category.

Again, our rule of thumb is if we don't need it, we won't run it. It's that simple. If we do need any of these,

they are prime candidates for some kind of restrictive policies via firewall rules or other mechanisms (see

below).

identd − This is a protocol that has been around for ages, and is often installed and running by

default. It is used to provide a minimal amount of information about who is connecting to a server.

But, it is not necessary in many cases. Where might you need it? Most IRC servers require it. Many

mail servers use it, but don't really require it. Try your mail setup without it. If identd is going to be a

problem, it will be because there is a time out before before the server starts sending or receiving

mail. So mail should work fine without it, but may be slower. A few ftp servers may require it. Most

don't though. Older versions of Red Hat started identd via inetd. Recent versions start this via init

scripts.

•

If identd is required, there are some configuration options that can greatly reduce the information that

is revealed:

/usr/sbin/in.identd in.identd −l −e −o −n −N

The −o flag tells identd to not reveal the operating system type it is run on and to instead always

return "OTHER". The −e flag tells identd to always return "UNKNOWN−ERROR" instead of the

"NO−USER" or "INVALID−PORT" errors. The −n flag tells identd to always return user numbers

instead of user names, if you wish to keep the user names a secret. The −N flag makes identd check

for the file .noident in the user's home directory for which the daemon is about to return a user

name. It that file exists then the daemon will give the error "HIDDEN−USER" instead of the normal

"USERID" response.

Mail server (MTA's like sendmail, qmail, etc) − Often a fully functional mail server like sendmail is

installed by default. The only time that this is actually required is if you are hosting a domain, and

receiving incoming mail directly. Or possibly, for exchanging mail on a LAN, in which case it does

not need Internet exposure and can be safely firewalled. For your ISP's POP mail access, you don't

need it even though this is a common configuration. One alternative here is to use fetchmail for POP

mail retrieval with the −m option to specify a local delivery agent: fetchmail −m procmail for

instance works with no sendmail daemon running at all. Sendmail, can be handy to have running, but

the point is, it is not required in many situations, and can be disabled, or firewalled safely.

•

BIND (named) − This often is installed by default, but is only really needed if you are an

authoritative name server for a domain. If you are not sure what this means, then you definitely don't

need it. BIND is probably the number one crack target on the Internet. BIND is often used though in

a "caching" only mode. This can be quite useful, but does not require full exposure to the Internet. In

other words, it should be restricted or firewalled. See special handling of individual

applications below.

•

Security Quick−Start HOWTO for Red Hat Linux

3.4. Exceptions 15

1 2 ... 13 14 15 16 17 18 19 20 21 22 23 ... 81 82

Commenti su questo manuale

Nessun commento

Red Hat NETSCAPE MANAGEMENT SYSTEM 6.2 - COMMAND-LINE Guida di Installazione Pagina 18

Commenti su questo manuale