Additional security enhancements for pSPTs

From @arlake228 on March 14, 2015 12:3

Original issue 854 created by arlake228 on 2014-02-26T17:31:24.000Z:

The following were suggested as options for future pSPT releases to enhance the security profile of the system:

a) SELinux enhancements - are we running in permissive right now?

b) changing filesystem components to immutable (RNP may be able to assist with this)

c) enforcing stronger passwords for users, restricting previous use, password timeouts/locksouts, and perhaps enforcing time limits.

I am not a fan of some of these in general, since it will force bad sociological behavior. E.g. writing down passwords, or '+1'ing the numbers in the password each expiration date.

d) better set of instructions for integrating host with campus wide configuration management (CFengine, Puppet, etc.) and authentication systems (kerberos)

e) review running services, and disable everything we don't need on this host. E.g. running this on a live CD:

chkconfig --list | grep '3:on'

Produces a long list of things we may not need.

Relatedly, see what is listening and make sure it needs to be listening:

netstat -tulpn

f) Harden sysctl. These suggestions are a little old (~2010?) so they may need to be updated:

# Turn on execshield
kernel.exec-shield=1
kernel.randomize_va_space=1
# Enable IP spoofing protection
net.ipv4.conf.all.rp_filter=1
# Disable IP source routing
net.ipv4.conf.all.accept_source_route=0
# Ignoring broadcasts request
net.ipv4.icmp_echo_ignore_broadcasts=1
net.ipv4.icmp_ignore_bogus_error_messages=1
# Make sure spoofed packets get logged
net.ipv4.conf.all.log_martians = 1

g) Disable Unwanted SUID and SGID Binaries.  This has a couple of parts:

#See all set user id files:
find / -perm +4000
# See all group id files
find / -perm +2000

YMMV on what we want to correct.  

Cutting down on world writeable things:

find /dir -xdev -type d \( -perm -0002 -a ! -perm -1000 \) -print

As well as things with no owner:

find /dir -xdev \( -nouser -o -nogroup \) -print

This last one is a bit of a problem for us:

[root@localhost ~]# find / -xdev \( -nouser -o -nogroup \) -print
/etc/aliases.db
/opt/perfsonar_ps/ls_registration_daemon/etc/ls_registration_daemon.conf
/opt/perfsonar_ps/snmp_ma/etc/daemon.conf
/opt/perfsonar_ps/PingER/etc/daemon.conf
/opt/perfsonar_ps/PingER/etc/pinger-landmarks.xml
/opt/perfsonar_ps/toolkit/etc/enabled_services
/opt/perfsonar_ps/toolkit/etc/external_addresses
/opt/perfsonar_ps/perfsonarbuoy_ma/etc/daemon.conf

h) Consolidate logging, and offer a couple of log scraping/identification tools.  We have done a good job lately on this, it could use a review.  A thread I found that outlines a couple of these:

http://serverfault.com/questions/89923/what-tool-or-scripts-do-you-use-to-audit-a-linux-box

We may want to enable logwatch/logcheck and send a daily email to the root user or use auditd, at a minimum.  

i) BCP rules for SSH:

http://www.cyberciti.biz/tips/linux-unix-bsd-openssh-server-best-practices.html

j) other host IDSs:

SNORT: http://www.snort.org

AIDE: http://aide.sourceforge.net

Copied from original issue: perfsonar/project#852