Step-By-Step Installation Of A Secure Linux Web, DNS, And Mail S...

John Holbrook

Step by Step Installation of a Secure Linux Web, DNS and Mail Server

Feb 10, 2004

GIAC GSEC Practical – Version 1.4b, Option 1

1

Table of Contents

Abstract...............................................................................................................................4

Configuration Notes............................................................................................................8

The New Setup...............................................................................................................8

Layers of Protection........................................................................................................9

Verifying Integrity of Downloaded Files...........................................................................9

RPMs..........................................................................................................................9

Md5sums..................................................................................................................10

PGP/GPG Keys........................................................................................................11

A Word About Passwords.............................................................................................12

Openna Linux 1.0 Installation............................................................................................12

Adding a User ..............................................................................................................13

Vpopmail Install.............................................................................................................32

Apache Installation............................................................................................................34

Mod_security Installation..............................................................................................39

Mod_Dosevasive Installation........................................................................................40

PHP Installation................................................................................................................41

Giptables Installation.........................................................................................................43

Giptables Customization...............................................................................................45

Snort Installation...............................................................................................................46

MySQL Snort Configuration .........................................................................................48

ACID Installation...........................................................................................................49

AIDE..................................................................................................................................53

Final Cleanup....................................................................................................................56

Chattr of key files..........................................................................................................56

2

Remove Development RPMs........................................................................................56

Removal of Downloaded Files......................................................................................56

Autoupdate ...................................................................................................................56

Mailing Lists and other sources of information..............................................................57

Appendix A BIND Configuration File – named.conf...........................................................59

Appendix B – named Initialization Script...........................................................................61

small company. This server is co-located at a local ISP.

Because of budget limitations, the company can only locate one physical box at the ISP

which limits what security measures that can be installed. The author will seek to explain

the choices made. The paper will include instructions on how to build a secure web and e-

mail server with an emphasis on two key security areas:

)1 Keeping crackers out

)2 Detecting any signs of cracker activity and limiting the changes a cracker can make

This document expects the reader to have a good understanding of installing Linux and

the various tools included for text editing, configuration etc.

Introduction

➔ Openssh

Reasons for new install

The current server has been in service for approximately 30 months. When it was

originally configured the author's knowledge of securing Linux was somewhat limited.

Specifically the following items were not installed on the server or configured correctly:

1) Firewall

2) Intrusion Detection System

3) Bind was not configured in a chroot jail

The author has since set up several Linux servers and has standardized on locations for

configuration files, etc which make it easier to administer. This wasn't done on the

as of December 31, 2003 and is discontinuing their freely available download distribution

in favor of a commercially packaged version.

Their new free version is now called the “Fedora Project” (http://fedora.redhat.com/

server.

The author looked at several Linux distributions including Mandrake (

www.mandrake.com

(www.openna.com). After comparing these distributions, the decision was made to use

Openna Linux 1.0 which is available as a free download or can be purchased in a retail

package.

Why the author chose Openna Linux:

➔ Secure distribution. What isn't needed isn't installed by default. With Red Hat the

author usually spends several hours disabling unneeded services and removing

unnecessary packages.

➔ All software packages for Openna Linux are compiled for the i686 processor which

gives us better performance on newer CPUs

users) the ability to run some (or all) commands as root or another user while logging the

commands and arguments."

Here's an example of how you can fine tune Sudo. I have a user named “bob” who I want

to allow to start and stop Apache and make changes to the Apache configuration files

under /etc/httpd. Normally, I would have to give “bob” root access by making him a

member of the 'wheel' group, give him the root password, and trust that he does not do

anything beyond administering Apache. With sudo here's what I can do:

visudo is the administration tool for the sudo configuration file - /etc/sudoers.