Segmentation Fault: Core dumped..;-)

Reducing the “surface area” of your servers that is exposed to the world: A poor admin’s look at security

Posted : June 16, 2004 at 9:12 pm [America/Los_Angeles]

I did my Masters at ASU. In fact, I spent more than three years there. A good portion of that time was spent working in labs. If my memory serves me right, around 1997-1998, servers in College of Education started becoming sitting ducks to hackers and script kiddies out there. Not that we were running super secure server setups, mind you. Infact, there was this one time when Henry (Henry Biglin, really pain-in-the-ass but exceptionally smart fella) literally pulled me (and others) in as the whole drama was unfolding.

I was a rookie back then. CGI programming in Perl was my forte at best. I remember feeling all mesmerized and somewhat scared. Wow, these guys must be geniuses, heck super geniuses?. Quite a few years have passed since that time. I have gone from a loud, sometimes-obnoxious-sometimes-sweet kid to loud, mostly-obnoxious, folically challenged adult and I am still trying to get my arms around this

As a poor admin, here’s my take on security:

1. Since I know close to nothing about configuring routers and switches (neither do I get to administer the ones at my ISP), I can do jack about DOS attacks. Plain and simple.
2. Always think of the server that I am about to set up as my beautiful house that sits in a beautiful yet extremely vulnerable part of the town.
3. Try, try and try to expose as little “surface area” of my server to the outside world as I possibly know and can. Let’s break this down further:
   
   1. Try to minimize the ports that are open to the world. They are tantamount to having my beautiful house with wide-open doors (or windows) and with well-paved roads leading straight up to them
   2. Try to narrow down the innards of my server that is exposed to these public ports (basically, daemons listening in on these public ports). That’s like saying to myself: “I have to keep these windows open, but I will lock the indoors up thoroughly so that the only way out for someone who comes in through this public window is my way”. In other words, I will literally dictate what someone sees and how someone leaves once they’re in.
   3. Try to reduce the number of softwares that get installed on the server. If I don’t need it or plan on using it, I dump it. It’s like saying to myself: “Why in the world should I have my lotto money at home when I absolutely and positively have no plans on using the cash today anyways.”

So, what do I do about 3a, 3b and 3c:

3a

iptables, iptables, iptables. You get the idea. I am still really learning this, but it sure is powerful as hell.

3b

If a daemon can run in a chroot jail, do it. Do I do it? No. Why? Cause it takes time to figure it out. The default install is much easier. As I said, I am still learning

3c

I learnt Linux the easy way (or not). Basically, RedHat. Found the installers intuitive. Started getting to like things and got more into it. In fact, it’s still my preferred distribution. Fedora, that is. What I hate though is this - I have no idea and no control over the crap that gets installed, even if I choose the absolute minimum. In the absence of Fedora installer giving me such an option, there is really not much I can do? I just try to remove unnecessary stuff as and when I find out about them.

Frankly, it would be great if there was an easy way to select the absolute minimum set of softwares during a Fedora install. All I need is the bare minimum for a server type setup. No fancy XWindow Managers or MP3 players and stuff that folks crave for on a workstation. Just enough subset so as to be able to install my choice of server softwares using the good old “configure, make, make install” magic. Yes, I have heard about Knoppix, Feather Linux, Damn Small Linux, LFS. Any help will be much appreciated.

It’s safe to say that my adventures and unfortunate episodes vis-a-vis security will continue

- Anand

Category: Services and Software