Installing and Securing a DNS/Mail Server Using Red Hat 7.1 Linux

131 Pages·2016·2.13 MB·English

Global Information Assurance Certification Paper
Copyright SANS Institute
Author Retains Full Rights
This paper is taken from the GIAC directory of certified professionals. Reposting is not permited without express written permission.
Installing and Securing a DNS/Mail Server

Using Red Hat 7.1 Linux

.
s
Submission for GCUX Version 1.6d, Option 1 t
h
Baltimore SANS, 2001
g
i
r
12 Aug 2001
l
l
u

Janice D. Pryor f

s
n
Step 1: i
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 0a6E4 A169 4E46
Gathering Information about your System 2
t
Step 2: e
r
Planning Y our Installation 3

r
Step 3:
o
Installation of the Red Hat 7.1 Linux Operating System h 5
Step 4: t
u
Updating the base installation 11
A
Step 5:

Configuring DNS , 23
5
Step 6
0
Configurin g Sendmail 0 31

Step 7: 2

Securing an d optimizing the system - 34

Step 8: 0
Initial backup 0 42
0
Conclusion 44
References 2 45
e
Appendix A: Packages for Red Hat 7.1 47
t
u

The follo wing checklist will servei tas a guide for installing and securing a Red Hat 7.1 Linux
t
system in tended to be used as s the DNS/Mail Server. This is the internal server of a split
n
horizon D NS or the DNS/MaiIl server for an isolated internal LAN (no Internet connectivity).
Access to this server is via Sc onsole only (no remote login) or via applications.

N

All internal mail (incom iAng/outgoing) will be handled by this server. Outgoing external mail

will be passed to the Sbastion host. Administrators will be able to make use of scripting

languages such as © perl, awk, and shell scripts, but will not have access to compilers. Printing

will not be supported on this server.

This machine will be a Linux only Operating System (not dual boot w/ another OS like

Windows.)

Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46
Configuring the Mail Server is not covered in this paper due to time constraints. However, the

security related configuration for the mail server is covered.
© SANS Institute 2000 - 2005 Author retains fu1ll rights.
Step 1:

Gathering Information about your System

.
s
Before starting, you need to gather information about your hardware. If you are ordering
t
h
hardware, check the compatibility list prior to placing your order. Some vendors like Compaq,
g
IBM, HP and Dell have started shipping LINUX configured machines. i
r

l
Most systems come with some form of Windows installed. Before beginunling the LINUX

installation, you'll need to document the hardware in your system. Fofr Windows 95/98

s
systems, most of this information can be obtained from Start/Settings/Control Panel/System
n
and then use the Device Manager Tab. For Windows 2000, the eqiuivalent is also under
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 0a6E4 A169 4E46
Start/Settings/Control Panel/System. Windows NT also has an atnalogous location.
e
r

____________ Disk Drive r

o
____________ Video Card
h
__ __________ Hard Drive Controller t
u
__ __________ Mouse A
__ __________ Processor
,
__ __________ Sound Card 5
0
__ __________ RAM
0

__ __________ Monitor 2

__ __________ Hostname -

__ __________ IP Address 0
0

__ __________ Subnet Mas0k

__ __________ Gateway 2

e
____________ DNS prim ary
t
__ __________ DNS se u condary

t
____________ DNS i tertiary
t
s
n

Now compare the hardware I from your system to the compatibility list to verify that LINUX

supports your hardware. R SedHat has a listing of hardware certified to support RedHat 7.1 at

N
http://hardware.red hat.com/hcl/genpage2.cgi and there is a compatibility list at

A
http://www.redhat .com/support/hardware/. If you do have hardware that is not on

S
the compatibility list, check http://lhd.datapower.com/ to see if there is a workaround

©
for your hardware posted.

Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46

© SANS Institute 2000 - 2005 Author retains fu2ll rights.
Step 2:

Planning Your Installation

.
s
2.1) Supplies t
h
Recommend having the following on hand prior to starting your installation:
g
i
r
_____ Sealable envelopes
l
l
_____ Folder to contain the documentation on this installation u

f
__ ___ Any extra drivers determined to be needed from Step 1.
s
__ ___ Any documentation/research needed for configurationn (When you are in the
mKidedyl efi nogf earpnr iinnts =ta AllaFt1io9n F Ait’2s7 t h2Fe9 w4 r9o9n8gD t FimDeB 5to D dEe3cDid Fe 8yBo5u 0na6ieEe4d A t1o6 l9o o4kE 4s6o mething up
on the net). et
__ ___ Floppy disk for boot disk configuration. r

__ ___ Xerox copy of this guide (so you can check offr the steps and document as you
o
go ) h
t
u
2.1) D etermining Partitions A
For a DN S/ Mail server, using a single 10GB hard dis k, a reasonable partition table might look
,
like this: 5
0

0

/ 512M 2

-
/usr 1024M
0
/home 2000M 0

/u sr/local 750M (to keep add- o0 n applcations separate from the core binaries)
/v ar 1500M (if sending 2l ogs to a remote syslog, reduce this considerably)
e
/var/spool 2000M (large ent ough for several user accounts mail)
/tm p 1024M u
t
<swap> 512M (swat pi generally is set at RAM * 2)
s
n

Be sure t o designate a sepa r I ate /tmp and /var partition to help deter denial of service attacks
based on filling up the /tm Sp and /var volumes. This is particularly true in the case of shell

N
account servers where u sers have direct access to the /tmp directory.

A

S
NOTE: If this server will be used to service a large number of user accounts, a separate hard

©
disk shou ld be con sidered for housing the /var/spool partition.

Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46

© SANS Institute 2000 - 2005 Author retains fu3ll rights.
a) ___Fill in your partition layout below:

Partition Size
.
s
/ _______
t
h
/usr _______
g
_______ _______ i
r
_______ _______
l
_______ _______ ul

_______ _______ f

s
_______ _______
n
_______ _______ i
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 0a6E4 A169 4E46
t
e
(This information will be used in step 3.6) r

r

o
2.2) Determining packages to install
h
t
u
The best time to determine what to install and not insAtall is before you begin. It’s all too easy
to install something that you are not sure about with the intention of researching it and
,
uninstalli ng it later if you don’t need it, and then ne5ver making it back. Again the time to
0
research is before you begin, not in the middle o f the installation. The following lists some of
0

the issue s and concerns you need to evaluate f2 or your site and the recommended packages to

install/no t install. A full listing of all the pack- ages, a description of the packages and their

security concerns are listed in Appendix A. 0
0

0

1. Don’t install anything you do n2 ’t need.

e
2. Know what the packages y ou are installing do. It does no good to secure a feature,
t
if you install another packag ue that performs the same function that is not secure.

t
i
t
3. If you decide to acce ps t the risk of installing a package, document that it is installed.
n

That way if there is a I security issue in the future, you (or other sys admins) will know

that this box is affec Sted.

N

A
4. Know how to secure the packages you install. This guide will assist you in doing

S
that for the pa ckages it recommends. If you elect to install others you will need to

research the © m yourself. The best time to do this is BEFORE they are installed.

Appendix A shows the packages covered by this guide.

Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46

© SANS Institute 2000 - 2005 Author retains fu4ll rights.
Step 3:

Installation of the Red Hat 7.1 Linux Operating System

.
s
Before starting, make sure that the computer you will be installing on is not actually
t
h
connected to the network. Simply unplugging the Ethernet cable from the NIC will suffice.
g
You will need to connect to the network later in the process, so be sure thati your system is
r
located in an area where you will be able to plug in to the network.
l
l
u

3.1) ___ Verify that the computer is not physically connectedf to the network.

s
n
3.2) ___ Boot from the Red Hat 7.1 installation CD. i
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 0a6E4 A169 4E46
t
e
If your BIOS will not allow you to boot from the CDROMr drive, use the Red Hat 7.1

Boot Floppy that comes with the distribution. Hit ‘entrer’ at the LILO boot prompt.

o
h
3.3) Be ginning install t
u
A
a) ___ Select appropriate language, key board, and mouse settings suitable
,
for your hardware. 5
0

0

3.4) In stall Type 2

-

a) ___ Select ‘custom system’ 0
0

0

3.5) Ch oice of Auto Partition, Dis k2 Druid or fdisk - OR -

e
May state Auto Partitioning Failed
t
u

t
a) ___ Select Disk Duidi
t
s
n

3.2) Partition layout I

S

N
a)____Partition s configured in accordance with Step 2.

A

S
3.3) Partitions to format

©

a) ___ Checkmark all partitions for formatting

b) ___ Do not check for bad blocks

M odern IDE drives map bad blocks internally. Checking for bad blocks takes a LONG
timKeey. fUinngleerspsr inyto =u AarFe1 9u sFiAng2 7a 2 vFe9r4y 9O98LDD FdDrivBe5 aDnEd3 iDt wF8oBul5d 0 m6Ea4k eA y1o6u9 4feEe4l6 b etter to run
th e check, don’t bother.
© SANS Institute 2000 - 2005 Author retains fu5ll rights.
3.4) LI LO configuration

Stick with the defaults.
.
s
t
a) ___ Create boot disk (yes) h
b) ___ Install LILO on Master Boot Record (yes) g
i
r

3.5) N etwork configuration l
l
u

f
a) ___ Deselect DHCP configuration
s
n
The server should use a static IP address if possible. i
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 0a6E4 A169 4E46
t
e
b) ___ Activate on boot? (select yes) r

r

o
____________ IP address
h
__ __________ Netmask t
u
__ __________ Network A
__ __________ Broadcast
,
__ __________ Hostname 5
0
__ __________ Gateway
0

__ __________ DNS primary 2

__ __________ DNS secondary-

__ __________ DNS tertiary 0
0

0

3.6) Fi rewall Configuration 2

e

t
a) ____Choose High u

b) ____Choose Customi tze
i
t
s
n
____ Select SS H
I
____ Select S MTP
S

N

3.7) La nguage Sele Ac tion

S

a) ____ Eng lish (USA)
©

3.8) Ti me zone selection

If your h ardware clock is set to Universal Time Coordinated (UTC), which is Greenwich Mean
Time (GM T) updated with leap seconds, be sure to check the box labeled “System clock uses
UTC”. TKheeny fsinegleecrpt rtihnet =p AroFp1e9r FtiAm2e7 2zoFn94e 9fo9r8 Dth FeD loBc5a DtioEn3 Dw hFe8rBe5 t0h6eE b4o Ax1 w69il l4 bEe4 6o perating or

UTC if all your systems are on GMT.
a) ___Time Zone:___________
© SANS Institute 2000 - 2005 Author retains fu6ll rights.
3.9) Ac count Configuration

a) ___ Root password
.
s
t
h
Select a strong root password, be sure that it is not a word found in the dictionary (any
g
language dictionary). Good passwords use upper AND lower case letiters, numbers,
r
and some special characters such as ~!@#$%^&*()_+|{}:"<>?/., ';][\=-`. Using a
l
password based on an acronym is easier to remember (i.e. “Wheunl I wish upon a star”

could equate to "W1wua*”). f

s
n
b) ____ Document the root password i
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 0a6E4 A169 4E46
Put it in one of the sealable envelopes. Write root on thet outside of the envelope and
e
seal it. r

r

o
c) ___ Add at least one non-root user
h
t
u
M ake it a practice not to log into the system asA root and don’t su to root except when
pe rforming required administrative tasks. On ce done with administrative tasks always
,
dr op back down to regular user level. 5
0

0

3.10) Au thentication Configuration 2

-

Go with the defaults. 0
0

0

a) ___ Enable md5 password 2s (yes)

e

t
b) ___ Enable shadow pa u ssword (yes)

t
i
t
c) ___ Do not enable sN IS.
n

I

d) ___ Do not ena Sble LDAP.

N

A
e) ___ Do not enable Kerberos.

S

3.11) Selecting P © ackage Groups

a) ___ DNS Server

3.12) __ _ Check ‘Select individual packages’
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46
Getting r id non-essentials is a good step toward a more secure system. On the other hand,
there are a few handy tools that need to be selected. So, we go through it all, package by
package.
© SANS Institute 2000 - 2005 Author retains fu7ll rights.
a) ___ Individual selections and removals
M ake the changes listed below plus the selections made in section 2.3.

Amusements
.
s
Games Remove All Don’t want users playing games
t
h
Graphics Remove All Not needed for DNS/Mail
g
Applications i
r
Archiving Add dump-static statically linked vers ion of dump
l
Add pax cpio and tar ul

Keep rmt Remote access tfo a tape drive

s
Comms Remove All Not needed for DNS/Mail
n
Databases Remove All Not needed ifor DNS/Mail
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 0a6E4 A169 4E46
Editiors Remove All Not needetd for DNS/Mail
e
Engineering Remove All Not neerded for DNS/Mail

File Add stat Size, prerms, linkcount and inode of files

o
Internet Add fetchmail Mail client server
h
Remove finger Retveals information about system
u
Remove ftp ACould be used to download malware
Remove ncftp Could be used to download malware
,
Remove openldap-clien5ts Not needed for DNS/Mail
0
Keep openssh Security replacement for ‘r’ commands
0

Keep openssh-client2 s SSH client

Add pine - Mail client

Remove rsh 0 Significant security risk
0

Keep stunnel0 Secure imap server

Remove talk 2 Not needed for DNS/Mail

e
Add tcpdu mp Monitor system activity
t
Remove u telnet Security risk; Not needed for DNS/Mail

t
Keep i traceroute Network debugging tool
t
Rem s ove wget Could be used to download malware
n

RI emove whois Reveals information about system

Multimedia SRemove All Not needed for DNS/Mail

N
Productivity Remove All Not needed for DNS/Mail

A
Publishin g Remove All Not needed for DNS/Mail

S
System Keep bind-utils Mail server

© Remove gnupg Not needed for DNS/Mail

Remove rdate Use ntp instead

Keep sysstat Provides sar & iostat

Add tripwire Monitor changes in files

Add vlock Provides session locks
Key fiTnegxertprint = AFK1e9e FpA m274 2F94 998D FDB5 DEEd3Dit mF8aBil5 c 0o6nEfi4g Afi1le6s9 4E46
De velopment
Debuggers Add lsof Useful security tool
Languages Remove Python Not needed for DNS/Mail
Libraries Remove 4Suite Not needed for DNS/Mail
© SANS Institute 2000 - 2005 Author retains fu8ll rights.
Remove python-xmlrpc Not needed for DNS/Mail
Remove rpm-python Not needed for DNS/Mail
System Remove All Not needed for DNS/Mail

Tools Keep make Needed for m4
.
s
Documentation Remove indexhtml Not needed for DNS/Mail
t
h
Add manpages Linux documentation
g
Add sendmail-doc Sendmail documentatiion
r
System Environment
l
Base Remove alchemist Not needed for DNulS/Mail

Remove chkfontpath Not needed for DfNS/Mail

s
Keep iptables Needed for Mail Server
n
Remove nss_ldap Not needed ifor DNS/Mail
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 0a6E4 A169 4E46
Remove pam_krb5 Not using tKerberos
e
Remove rhn_register Not neerded for DNS/Mail

Remove up2date Automratically downloads information

o
Remove yptools Not using
h
Daemons Remove LPRng Not Printers
u
Remove XFree86-xfs ANot needed for DNS/Mail
Remove autofs Can be eploited
,
Keep bind 5 Needed for DNS
0
Keep caching-namese rver Needed for DNS
0

Remove finger-serv2 er Do not answer finger queries

Add imap - For Dos Mail clients

Keep iputils 0 Contains ping
0

Remove nfsut0 ils Not needed for DNS/Mail

Keep nscd 2 Helps with DNS

e
Add ntp Time server to sync audit logs
t
Remove u openssh-server Not remotely administered

t
Remoi ve pidentd Can be exploited;
t
Rem s ove portmap Can be used to scan systems
n

RI emove printconf No printers

SRemove rsh-server Use ssh instead

N
Remove rusers Use ssh instead

A
Remove rusers-server Use ssh instead

S
Remove rwall-server Not needed for DNS/Mail

© Remove rwho Reveals information about the system

Add sendmail-cf Needed for sendmail

Remove talk-server Not needed for DNS/Mail

Keep tcp_wrappers Monitor/filter incoming ip svc requests

Remove telnet-server Secuirty Risk
Key fingerprint = AFK1e9e FpA x2i7n e2tFd94 998D FDB5 DSEe3cDu Fre8 Bin5e 0td6E4 A169 4E46
Remove ypbind NIS daemon; Can be exploited
Remove ypserv NIS server; Can be exploited
Kernal Remove All Not needed for DNS/Mail
Libraries Remove VFlib2 Vector Fonts; Not needed
© SANS Institute 2000 - 2005 Author retains fu9ll rights.