Securing Debian HOWTO

Alexander Reelsen <ar@rhwd.net>

1. Introduction

• 1.1 Disclaimer & License
• 1.2 Download the HOWTO
• 1.3 Organizational Notes/Feedback
• 1.4 Prior knowledge
• 1.5 TODO
• 1.6 Changelog
• 1.7 Credits

2. Before and during the installation

• 2.1 Choose a BIOS password
• 2.2 Choose an intelligent partition scheme
• 2.3 Set a root password
• 2.4 Activate shadow passwords and MD5 passwords
• 2.5 Run the minimum number of services required
• 2.6 Read the debian security mailinglists

3. After Installation

• 3.1 Set a LILO or GRUB password
• 3.2 Disallow floppy booting
• 3.3 Mounting partitions the right way
• 3.4 PAM - Pluggable Authentication Modules
• 3.5 The limits.conf file
• 3.6 Edit /etc/inetd.conf
• 3.7 Edit /etc/login.defs
• 3.8 Editing /etc/ftpusers
• 3.9 Using tcp wrappers
• 3.10 Using su
• 3.11 Using sudo
• 3.12 Using chroot
• 3.13 Configuring some kernel features
• 3.14 Do not use software depending on svgalib
• 3.15 Secure file transfers
• 3.16 Using quotas
• 3.17 Logfile permissions
• 3.18 chattr/lsattr
• 3.19 Your filesystem integrity

4. Securing services running on your system

• 4.1 Securing ssh
• 4.2 Realize the insecurity of X over network
• 4.3 The lpd and lprng issue
• 4.4 Using mail securely
• 4.5 Using a loghost
• 4.6 Securing BIND
• 4.7 Using snort

5. Before the compromise

• 5.1 Follow Debian security updates
• 5.2 Exchange software
• 5.3 Useful kernel patches
• 5.4 Genius/Paranoia Ideas, what you could do

6. After the compromise

• 6.1 General behavior