Turn off and Tightening Daemon
|
|
Killing Daemons
|
- Some daemons run standalone with its own wrappers
- Most of the daemons startup scripts are in:
-
Debian: /etc/init.d
-
Redhat: /etc/rc.d/init.d
-
Suse: /etc/init.d
-
Slackware: /etc/rc.d
- Comment out the un-used daemons from the startup scripts in /etc/rc.d/*
- Kill the processes from /etc/rc.d/rc.local if needed
- The Infamous
Turn Off All Unused Daemons
- See what is on
- chkconfig --list | grep on
- Turn off your daemons
- chkconfig --level 2345 named off
- Repeat the command for each unused daemon
- Manually Turn Off, Turn On, Check the Status the Daemons
- /etc/rc.d/init.d/named stop
- /etc/rc.d/init.d/named start
- /etc/rc.d/init.d/named status
- Another way to kill daemons
- The Infamous
Turn Everything Off in inetd
|
| System Daemons |
- System Daemon you probably want to keep
|
- kerneld
- keytable
- random
- rawdevices
|
Generic system stuff
|
|
Run jobs at certains times of the day - usually for regular maintenace
|
|
For logging the server activities
|
|
Allow network connectivity
|
|
Secure login into the server
|
|
For automouting remote file systems
|
|
Allow cut-n-paste in normal console ( NOT X11 )
|
|
|
|
| Client WorkStations |
- X11
- xfs
- /etc/X11/*
- Users will need to run xfs for X11 ( netscape, xterm, etc )
- Running X11 security
|
|
| Dedicated Server Daemons |
|
|
|
- Firewalls
- ipchains, netfilter
- /etc/rc.d/rc.firewall
- Use a secure distro
- Configure it carefully
|
- LogHost Servers
- syslog
- /etc/syslog.conf
- Use a secure distro
- Keep logfiles secure from tampering on an extremely secure server
|
- Backup Servers
- Backup your important data to multiple backup servers
- Encrypt backup files with confidential data
|
|
|
- Local Pop3 Mail Servers
- identd/inetd, pop3d/imapd
- used in conjuction with inetd
- Run Secure POP3 server
- Run Anti-Virus Scanners
- identd - authenticate incoming email adresses
- pop3d - allow netscape/IE users to get email via pop3/imap
|
|
|
|
- File/Home Servers
- smbd, nmbd
- /etc/smb.conf
- For user login and authentication
- Run secure-NIS
- Use encrypted samba passwds for MS windows users
- smb - For MS windows users to write into ther home directories
|
- NTP Servers
- xntpd
- /etc/ntp.conf
- Use ntpdate to initially synchronize to the outside world public NTP servers
|
- NTP Clients
- /etc/ntp.conf
- Use ntpdate, rdate to synchronize local workstations to your local NTP server
|
- Printer Servers
- lpd
- /etc/printcap
- For printing
|
- X11 Servers
- X
- /etc/X11/XF86-Config-4
- Turn off X11 for exposed servers
|
|
| Misc Daemons |
|
|
Turn if off unless you have an RS232 connected to your UPS
|
|
Turn it off if you dont use ISDN service ( similar to DSL )
|
|
Turn if off if this is NOT a laptop
|
|
|