Chapter 6. Securing network services

• Exporting home directories is a risk because some applications store passwords in plain text or in a weakly encrypted format. You can reduce the risk by reviewing and improving the application code.
• Some users do not set passwords on SSH keys which again leads to risks with home directories. You can reduce these risks by enforcing the use of passwords or using Kerberos.
• Restrict the NFS exports only to required clients. Use the showmount -e command on the NFS server to review what the server is exporting. Do not export anything that is not specifically required.
• Do not allow unnecessary users to log in to a server to reduce the risk of attacks. You can periodically check who and what can access the server.

Prerequisites

• The nfs-utils package is installed.
• The firewalld package is installed and running.

Procedure

• On NFSv4, the firewall must open TCP port 2049.

• On NFSv3, open four additional ports with 2049:

  1. rpcbind service assigns the NFS ports dynamically, which might cause problems when creating firewall rules. To simplify this process, use the /etc/nfs.conf file to specify which ports to use:

     1. Set TCP and UDP port for mountd (rpc.mountd) in the ` section in `port=<value> format.
     2. Set TCP and UDP port for statd (rpc.statd) in the ` section in `port=<value> format.

  2. Set the TCP and UDP port for the NFS lock manager (nlockmgr) in the /etc/nfs.conf file:

     1. Set TCP port for nlockmgr (rpc.statd) in the ` section in `port=value format. Alternatively, you can use the nlm_tcpport option in the /etc/modprobe.d/lockd.conf file.
     2. Set UDP port for nlockmgr (rpc.statd) in the ` section in `udp-port=value format. Alternatively, you can use the nlm_udpport option in the /etc/modprobe.d/lockd.conf file.

Verification

• List the active ports and RPC programs on the NFS server:

  $ rpcinfo -p

Procedure

• To define a single line message, add the following option to the /etc/vsftpd/vsftpd.conf file:

  ftpd_banner=Hello, all activity on ftp.example.com is logged.

• To define a message in a separate file:

  • Create a .msg file which contains the banner message, for example /etc/banners/ftp.msg:

    ######### Hello, all activity on ftp.example.com is logged. #########

    To simplify the management of multiple banners, place all banners into the /etc/banners/ directory.

  • Add the path to the banner file to the banner_file option in the /etc/vsftpd/vsftpd.conf file:

    banner_file=/etc/banners/ftp.msg

Verification

• Display the modified banner:

  $ ftp localhost
  Trying ::1…
  Connected to localhost (::1).
  Hello, all activity on ftp.example.com is logged.

Procedure

• Create a write-only directory in the /var/ftp/pub/ directory:

  # mkdir /var/ftp/pub/upload
  # chmod 730 /var/ftp/pub/upload
  # ls -ld /var/ftp/pub/upload
  drwx-wx---. 2 root ftp 4096 Nov 14 22:57 /var/ftp/pub/upload

• Add the following lines to the /etc/vsftpd/vsftpd.conf file:

  anon_upload_enable=YES
  anonymous_enable=YES

• Optional: If your system has SELinux enabled and enforcing, enable SELinux boolean attributes allow_ftpd_anon_write and allow_ftpd_full_access.

Procedure

• Disable all user accounts in the vsftpd server, by adding the following line to the /etc/vsftpd/vsftpd.conf file:

  local_enable=NO

• Disable FTP access for specific accounts or specific groups of accounts, such as the root user and users with sudo privileges, by adding the usernames to the /etc/pam.d/vsftpd PAM configuration file.
• Disable user accounts, by adding the usernames to the /etc/vsftpd/ftpusers file.

Procedure

• To disable version strings, modify the server_tokens configuration option:

  server_tokens off;

  This option stops displaying additional details such as server version number. This configuration displays only the server name in all requests served by Nginx, for example:

  $ curl -sI http://localhost | grep Server
  Server: nginx

• Add extra security headers that mitigate certain known web application vulnerabilities in specific /etc/nginx/ conf files:

  • For example, the X-Frame-Options header option denies any page outside of your domain to frame any content served by Nginx, mitigating clickjacking attacks:

    add_header X-Frame-Options "SAMEORIGIN";

  • For example, the x-content-type header prevents MIME-type sniffing in certain older browsers:

    add_header X-Content-Type-Options nosniff;

  • For example, the X-XSS-Protection header enables Cross-Site Scripting (XSS) filtering, which prevents browsers from rendering potentially malicious content included in a response by Nginx:

    add_header X-XSS-Protection "1; mode=block";

• You can limit the services exposed to the public and limit what they do and accept from the visitors, for example:

  limit_except GET {
      allow 192.168.1.0/32;
      deny  all;
  }

  The snippet will limit access to all methods except GET and HEAD.

• You can disable HTTP methods, for example:

  # Allow GET, PUT, POST; return "405 Method Not Allowed" for all others.
  if ( $request_method !~ ^(GET|PUT|POST)$ ) {
      return 405;
  }

• You can configure SSL to protect the data served by your Nginx web server, consider serving it over HTTPS only. Furthermore, you can generate a secure configuration profile for enabling SSL in your Nginx server using the Mozilla SSL Configuration Generator. The generated configuration ensures that known vulnerable protocols (for example, SSLv2 and SSLv3), ciphers, and hashing algorithms (for example, 3DES and MD5) are disabled. You can also use the SSL Server Test to verify that your configuration meets modern security requirements.

Procedure

• Configure a firewall in your LAN. If your Memcached server should be accessible only in your local network, do not route external traffic to ports used by the memcached service. For example, remove the default port 11211 from the list of allowed ports:

  # firewall-cmd --remove-port=11211/udp
  # firewall-cmd --runtime-to-permanent

• If you use a single Memcached server on the same machine as your application, set up memcached to listen to localhost traffic only. Modify the OPTIONS value in the /etc/sysconfig/memcached file:

  OPTIONS="-l 127.0.0.1,::1"

• Enable Simple Authentication and Security Layer (SASL) authentication:

  1. Modify or add the /etc/sasl2/memcached.conf file:

     sasldb_path: /path.to/memcached.sasldb

  2. Add an account in the SASL database:

     # saslpasswd2 -a memcached -c cacheuser -f /path.to/memcached.sasldb

  3. Ensure that the database is accessible for the memcached user and group:

     # chown memcached:memcached /path.to/memcached.sasldb

  4. Enable SASL support in Memcached by adding the -S value to the OPTIONS parameter in the /etc/sysconfig/memcached file:

     OPTIONS="-S"

  5. Restart the Memcached server to apply the changes:

     # systemctl restart memcached

  6. Add the username and password created in the SASL database to the Memcached client configuration of your application.

• Encrypt communication between Memcached clients and servers with TLS:

  1. Enable encrypted communication between Memcached clients and servers with TLS by adding the -Z value to the OPTIONS parameter in the /etc/sysconfig/memcached file:

     OPTIONS="-Z"

  2. Add the certificate chain file path in the PEM format using the -o ssl_chain_cert option.
  3. Add a private key file path using the -o ssl_key option.

• Do not share the /var/spool/postfix/ mail spool directory on a Network File System (NFS) shared volume. NFSv2 and NFSv3 do not maintain control over user and group IDs. Therefore, if two or more users have the same UID, they can receive and read each other’s mail, which is a security risk.

  Note

  This rule does not apply to NFSv4 using Kerberos, because the SECRPC_GSS kernel module does not use UID-based authentication. However, to reduce the security risks, you should not put the mail spool directory on NFS shared volumes.

• To reduce the probability of Postfix server exploits, mail users must access the Postfix server using an email program. Do not allow shell accounts on the mail server, and set all user shells in the /etc/passwd file to /sbin/nologin (with the possible exception of the root user).
• To protect Postfix from a network attack, it is set up to only listen to the local loopback address by default. You can verify this by viewing the inet_interfaces = localhost line in the /etc/postfix/main.cf file. This ensures that Postfix only accepts mail messages (such as cron job reports) from the local system and not from the network. This is the default setting and protects Postfix from a network attack. To remove the localhost restriction and allow Postfix to listen on all interfaces, set the inet_interfaces parameter to all in /etc/postfix/main.cf.

Prerequisites

• The dovecot package is installed on the system