/sbin/ipchains -F
/sbin/ipchains -A input -i eth0 -p tcp -d 0.0.0.0/0 53 -j DENY -l
/sbin/ipchains -A input -i eth0 -p udp -d 0.0.0.0/0 69 -j DENY -l
/sbin/ipchains -A input -i eth0 -p tcp -d 0.0.0.0/0 87 -j DENY -l
/sbin/ipchains -A input -i eth0 -p tcp -d 0.0.0.0/0 111 -j DENY -l
/sbin/ipchains -A input -i eth0 -p udp -d 0.0.0.0/0 111 -j DENY -l
/sbin/ipchains -A input -i eth0 -p tcp -d 0.0.0.0/0 2049 -j DENY -l
/sbin/ipchains -A input -i eth0 -p udp -d 0.0.0.0/0 2049 -j DENY -l
/sbin/ipchains -A input -i eth0 -p tcp -d 0.0.0.0/0 512 -j DENY -l
/sbin/ipchains -A input -i eth0 -p tcp -d 0.0.0.0/0 513 -j DENY -l
/sbin/ipchains -A input -i eth0 -p tcp -d 0.0.0.0/0 514 -j DENY -l
/sbin/ipchains -A input -i eth0 -p tcp -d 0.0.0.0/0 515 -j DENY -l
/sbin/ipchains -A input -i eth0 -p tcp -d 0.0.0.0/0 540 -j DENY -l
/sbin/ipchains -A input -i eth0 -p tcp -d 0.0.0.0/0 2000 -j DENY -l
/sbin/ipchains -A input -i eth0 -p udp -d 0.0.0.0/0 2000 -j DENY -l
/sbin/ipchains -A input -i eth0 -p tcp -d 0.0.0.0/0 6000 -j DENY -l

These rules block connections to certain services which cert says are bad and dangerous. If you are on a dialup, replace eth0 with ppp0.

Look at your logs

The logs on your system can tell you a lot about what is going on. All logs are stored in /var/log. In Redhat most important messages are logged to /var/log/messages. Watch this log file be using the command "tail -f /var/log/messages", so you can see the log file as it is being written to.

Run Bastille-Linux

Bastille is a set of hardening scripts for Redhat and Mandrake systems. Basicaly, you run a script which asks you a bunch of questions, it saves your responses to a config file, then it runs a script which hardens your box based on what you answered. Bastille can optimise use of tcp wrappers, shut down services, set more restictive permissions, and many other things. I highly recommend downloading and running this free tool from http://www.bastille-linux.org.

Install updates from RedHat

Now that your box is ready to get on the net, goto http://www.redhat.com/support/errata/rh62-errata-security.html, and downlaod and install the recomended updates for packages which may not be secure.

Conclusion

If you follow these steps, your box should be secure enough to be on the internet with. The most important thing is to shut down services you dont need, which in turn closes ports which may give potential access into your system.

 

<< previous                  back to main menu

1