Installation et sécurisation d'une station Debian 3.0 stable

15/05/2004

mount -o remount,rw /usr
cd /usr/src
cp -r kernel-2.2.20-fw kernel-2.2.20-fwow
ln -s kernel-2.2.20-fwow linux-ow
md5sum /home/system/download/linux-2_2_23-ow1_tar.gz
cb51cfdd978eba987ca39d09960e17c3\
  /home/system/download/linux-2_2_23-ow1_tar.gz
cp /home/system/download/linux-2_2_23-ow1_tar.gz .
tar zxvf linux-2_2_23-ow1_tar.gz
cd linux-ow
patch -p1 < ../linux-2.2.23-ow1/linux-2.2.23-ow1.diff

find . -name *.rej
./fs/fat/inode.c.rej
./fs/select.c.rej

sed 's/^EXTRAVERSION\ =\ -fw$/EXTRAVERSION\ =\ -fw-ow/' Makefile > .fwow
cat .fwow > Makefile && rm -f .fwow

make dev && make modules && make bzImage

mount -o remount,rw /boot
cp arch/i386/boot/bzImage /boot/vmlinuz-2.2.20-fw-ow
cp System.map /boot/System.map-2.2.20-fw-ow
cd /boot/
ln -s vmlinuz-2.2.20-fw-ow linux-ow

cd - && make modules_install

image=/boot/linux-ow
 	label=linux22ow
	read-only
	restricted

cd /home/system/applis
md5sum ../download/libsafe-2_0-16.tgz
    6b7b6e6df84d4afb469ccc66d04fc24d  ../download/libsafe-2_0-16.tgz
tar zxvf ../download/libsafe-2_0-16.tgz
find ./libsafe-2.0-16/ -type f \( -perm -004000 -o -perm -002000 \) -exec  ls\
    -la {} \
chown -R root:root libsafe-2.0-16/
chmod 750 libsafe-2.0-16/
cd libsafe-2.0-16/
make
mount -o remount,rw /usr
make install => Entrer Yes au prompt.
mount -o remount,ro /usr

export LD_PRELOAD=/home/system/applis/libsafe-2.0-16/src/libsafe.so
Lancez les exploits dans /home/system/applis/libsafe-2.0-16/exploits.

ll /etc/ld.so.preload || echo /lib/libsafe.so.2 > /etc/ld.so.preload
chmod 644 /etc/ld.so.preload

mount -o remount,rw /usr

mount -o remount,ro /usr

chmod 750 /etc/aide
cp /etc/aide/aide.conf /etc/aide/aide.conf.orig
chmod 640 /etc/aide/*
mkdir /home/system/aide

[...]
database=file:/home/system/aide/aide.db
database_out=file:/home/system/aide/aide.db.new
[...]
# MD5 sum files - especially useful with debsums -g
/var/lib/dpkg/info/([^\.]+).md5sums Databases
[...] et a la fin du fichier [...]
/etc ConfFiles
/home/system Binlib
!/home/system/aide
[...]

mount /dev/fd0 /mnt
cp /home/system/aide/aide.db.new /home/system/aide/aide.db
/usr/bin/md5sum /home/system/aide/aide.db.new > /mnt/aide.db.md5
mv /home/system/aide/aide.db.new /mnt/aide.db
cp /usr/bin/aide /mnt/
/usr/bin/md5sum /usr/bin/aide > /mnt/aide.md5
sed 's/file:\/home\/system\/aide\//file:.\//' /etc/aide/aide.conf >\
  /mnt/aide.conf
sync
cd /mnt
grep `/usr/bin/md5sum aide | cut -d ' ' -f 1` aide.md5
  => Doit vous renvoyer le contenu du fichier aide.md5
grep `/usr/bin/md5sum aide.db | cut -d ' ' -f 1` aide.db.md5
  => Doit vous renvoyer le contenu du fichier aide.db.md5
diff /etc/aide/aide.conf ./aide.conf 
  3,4c3,4
  < database=file:/home/system/aide/aide.db
  < database_out=file:/home/system/aide/aide.db.new
  ---
  > database=file:./aide.db
  > database_out=file:./aide.db.new
cd && umount /mnt

mount -o ro /dev/fd0 /mnt && cd /mnt
./aide -c ./aide.conf --check -V200
cd && umount /mnt

aide --update -V200
cd /home/system/aide
mv aide.db.new aide.db
puis sauvegardez cette nouvelle base comme pour la création.

=> 'Send daily reminders' -> No

/dev/sda6  /var     ext2  nodev,usrquota,grpquota                      0 2
/dev/sda7  /var/log ext2  noexec,nosuid,nodev,sync,usrquota,grpquota   0 2
/dev/sda8  /tmp     ext2   noexec,nosuid,nodev,usrquota,grpquota       0 2
[...]
/dev/sda10 /home    ext2   nodev,usrquota,grpquota                     0 2

for i in `echo /var /var/log /tmp /home` ; do \
	touch $i/quota.user && touch $i/quota.group ; done
for i in `echo /var /var/log /tmp /home` ; do \
	chmod 600 $i/quota.user && chmod 600 $i/quota.group ; done
for i in `echo /var /var/log /tmp /home` ; do \
	chown root:root $i/quota.user && chown root:root $i/quota.group ; done

for i in `echo /var /var/log /tmp /home` ; do \
	mount -v -o remount $i ; done

update-rc.d -f quotarpc remove

/sbin/quotacheck -am

/dev/sda8          0      20000      20000          0     5000     5000
/dev/sda10        17     100000     100000          9    10000    10000

/dev/sda8          0       5000      10000          0    10000    10000
/dev/sda10        17     200000     250000          9    50000    50000

adduser --no-create-home --disabled-password --quiet --ingroup users quotauser
Changing the user information for quotauser
Enter the new value, or press return for the default
	Full Name []: Quota template user    
	Room Number []: 
	Work Phone []: 
	Home Phone []: 
	Other []: Disabled
  Is the information correct? [y/n] y
passwd -l quotauser
chsh -s /bin/false quotauser

/dev/sda8          0       2000       2000          0      500      500
/dev/sda10         0      10000      10000          0     1000     1000

QUOTAUSER="quotauser"

*		hard	core		0
*		hard	memlock		4096
*		hard	fsize		10000
*		hard	maxlogins	3
*		hard	cpu		10

@adm	hard	nofile		1024
@adm	hard	nproc		256
@adm	hard	maxlogins	5

@users	hard	nofile		256
@users	hard	nproc		32

cd /home/system/applis
/usr/bin/md5sum /home/system/download/tomsrtbt-2.0.103.tar.gz 
    d5ee50efb28986d564547d5da5de2483 \
/home/system/download/tomsrtbt-2.0.103.tar.gz              
tar zxvf /home/system/download/tomsrtbt-2.0.103.tar.gz

cd tomsrtbt-2.0.103/

./install.s

* Resolution de l'ecran.
* map du clavier.

< Paxmod   -   .* PAX: .*
> #Paxmod   -   .* PAX: .*

< file = /var/log/auth.log
< file = /var/log/messages
> file = /var/log/sécurité.log
> file = /var/log/fw_accept.log
> file = /var/log/fw_deny.log

< ruleset=/home/prelude/etc/prelude-lml/ruleset/simple.rules;
> #ruleset=/home/prelude/etc/prelude-lml/ruleset/simple.rules;
> ruleset=/home/prelude/etc/prelude-lml/ruleset/debian-secinst.rules

# Customized prelude-lml rules file from debian-secinst v0.1.7 doc 
# Simon Castro <scastro [at] entreelibre.com>
# These one are from the simple.rules standard file.
regex=PAM_unix\[([0-9]+)\][^(]+\(uid=([0-9]+)\) -> ([^ ]+);\
class.name=Authentication Failure; impact.completion = failed;\
impact.type = other; impact.severity = high;\
impact.description=Process $1 attempted to change UID from $2 to $3; 
regex=entered promiscuous mode; class.name=Promiscuous mode detected;\
impact.completion = succeeded; impact.type = other;\
impact.severity = medium; impact.description=A sniffer is probably\
running on this machine;
# A few of rules only of this file will be used as we don't configure\
prelude-lml to look into auth.log
include = ssh.rules;
# These are personal rules...
regex=left promiscuous mode; class.name=Promiscuous mode end detected;\
impact.completion = succeeded; impact.type = other;\
impact.severity = medium; impact.description=A sniffer is probably\
running on this machine;
# Uncomment one of the two ruleset below
#include = ipchains.rules;
#include = netfilter.rules;

cd /home/prelude/etc/prelude-lml/ruleset/
chown prelude:prelude debian-secinst.rules ipchains.rules
chmod 640 debian-secinst.rules ipchains.rules

/etc/init.d/preludelogmonitor.sh restart

mount -o remount,rw /usr
mount -o remount,exec /tmp
cd /usr/src
mv /home/system/download/linux-2.4.22.tar.bz2 .
tar jxvf linux-2.4.22.tar.bz2
chown -R root:root linux-2.4.22
chmod 750 linux-2.4.22
mv linux-2.4.22 kernel-source-2.4.22
ln -s kernel-source-2.4.22 linux-2.4.22

cd /usr/src
patch -p0 < /home/system/download/grsecurity-1.9.12-2.4.22.patch

for i in `echo grsec_tpe grsec_sockall grsec_sock_cl grsec_sock_srv grsec\
	_audit`; do groupadd $i; done

/sbin/sysctl -p /etc/sysctl.conf.grsecurity

#!/bin/sh
/sbin/sysctl -p /etc/sysctl.conf.grsecurity

cd /etc/rc2.d
ln -s /home/system/security/apply_grsec.sh S{XX}apply_grsec

kern.* %regex -m "PAX" %classic /var/log/sécurité.log
kern.* %regex -m "grsec" %classic /var/log/sécurité.log

[...] kernel: grsec: From a.b.c.d: Proc handler: being fed garbage 2  bytes\
      sent 208 require
[...] kernel: PAX: From a.b.c.d: terminating task: /usr/local/websphere500/\
      appserver/java/jre/bin/exe/java(java):4773, uid/euid: [...]
[...] kernel:grsec: From a.b.c.d: attempted resource overstep by requesting\
      4096 for RLIMIT_CORE against limit 0 by (java:4773) [...],  parent (start\
      Server.sh:19644) [...]

cd /home/system/applis/chpax-0.5/
./chpax -s /usr/local/websphere500/appserver/java/jre/bin/exe/java

* Paging based PAGE_EXEC       : enabled
* Trampolines                  : not emulated
* mprotect()                   : restricted
* mmap() base                  : randomized
* ET_EXEC base                 : not randomized
* Segmentation based PAGE_EXEC : disabled

cd /home/system/applis/
tar zxvf ../download/gradm-1.9.12.tar.gz
chown -R root:root gradm/
find . -type f -exec chmod 640 {} \;
find . -type d -exec chmod 750 {} \;
make && make install

=> Le mot de passe vous est demande et est stocke dans /etc/grsec/pw.

cd /etc/grsec/
cp -r /home/system/applis/gradm/debian_secure_acls .
chmod 700 debian_secure_acls/
chmod 600 debian_secure_acls/*
mv acl acl.orig
mv debian_secure_acls/default acl

cd debian_secure_acls/
rm -f apache cron inetd ipop3d klogd mysqld postfix syslogd tcpd xfree86

cd /etc/grsec
chmod 700 debian-secinst
chmod 600 debian-secinst/*

cd /etc/grsec
patch < patch
=> File to patch ? entrez acl puis supprimez le patch