Forwarding the syslog to another server on network

quinta-feira, 25 de outubro de 2012

I'm using a linux to receive my logs for this explanation.

LogServer:
usually the syslog conf path for syslog on linux is /etc/sysconfig/syslog (red hat for example)
Setup the syslog on linux with the bellow options:

SYSLOGD_OPTIONS="-m 0 -r"
*.* /var/adm/messages

Refresh the syslog
# kill -HUP syslogPid

HP-UX :
Setup the syslog on HP-UX with the bellow options:
syslog conf path: /etc/syslog.conf
*.debug @LogServer

Get the syslog pid to refresh the process:
ps -ef | grep syslog

# kill -HUP syslogPid

Wrapper - Block the root password change

sábado, 20 de outubro de 2012

For security reason is good dont give the "power" to change the root password for everyone :-)

Create a list of users that you want to deny the change of password.:
# vi /usr/local/etc/passwd_not_allowed
root
bin

Now create the wrapper:
# vi /tmp/passwd
file=/usr/local/etc/passwd_not_allowed
user=$1
grep -q ${user] ${file} && echo "${user} - You don't have access to change this passwd"  && exit
/usr/bin/passwd.dist ${User}

Set the right permissions:
# chmod 755 /tmp/passwd

Move the real passwd for another place:
# mv /usr/bin/passwd /usr/bin/passwd.dist

Put your wrapper in the place of passwd:
# mv /tmp/passwd /usr/bin/

Now you can configure a sudo for this script, if you don't want move the passwd bin you can create the wrapper in another place.

Disable password age for all user

sábado, 4 de fevereiro de 2012

Sure, there's another methods to do that less fun :)
#for i in `awk -F ":" '{print $1}' /etc/passwd`
do
        passwd -x -1 $i
done

Allow only direct root logins on the system console

segunda-feira, 9 de janeiro de 2012

Allow only direct root logins on the system console. Create the /etc/securetty file with the single entry, console, as follows:

# echo console > /etc/securetty

This restriction applies to all login names that have a UID of zero (0).
The purpose of the /etc/securetty file is to specify where root can log in.

[11.31] Disabling last login msgs

sexta-feira, 6 de janeiro de 2012

You can set the following variable in /etc/default/security:

DISPLAY_LAST_LOGIN=0

Edit the ssh configuration too /opt/ssh/etc/sshd_config:

PrintLastLog no
Restart the sshd do apply the changes in ssh:

# /sbin/init.d/secsh stop && /sbin/init.d/secsh start

Security

sábado, 3 de dezembro de 2011

Changing minimum requirement to password

Password policies - Trusted and Non-Trusted

untrusted <-> trusted system

Enable/Disable non-root login

Setting the minimum password size

Users without home dir isn't able to login

Prevent re-use a password


Allowing logins specified period


Disabling last login information


Ipfilter

Ipfilter - logging tcp/upd connections


Allow only direct root logins on the system console


Using the Restricted SMH Builder for Limited Superuser Access 


Recovery root password (system non-trusted)


Adding timestamp after each command typed, using a trap


Restrict the access to the /etc/passwd file through ftp