Solaris安全设置和日志管理ppt课件

1、Solaris平安设置和日志管理 PROM OpenBoot平安级别 nNone:不需求任何口令 nCommand：除了boot和go之外一切命令都需求口令 nFull:除了go命令之外一切命令都需求口令 nn设置OpenBoot口令 eeprom security-password n改动平安级别 setenv security-mode=command 防止堆栈的缓冲区溢出 n#cp /etc/system /etc/system.backup n#vi /etc/systemset noexec_user_stack=1 set noexec_user_stack_log=1 SUID/

2、SGID nreal user ID 用户登录IDwho am ineffective user ID 用户会话过程IDwhoaminE.g. 获得bash的root SUIDn#cp /bin/bash /home/badman/.bashn#chmod 4777 /home/badman/.bash n定期察看系统中SUID和SGID文件 系统的启动和封锁 n更改不用要的启动文件 n检查一切在/etc/rc2.d和/etc/rc3.d以S开头的文件，去掉不用要的效力n以下/etc/init.d/中的效力是必需的：nK15rrcd S05RMTMPFILES K15solved nS20sy

3、setup S72inetsvc S99audit S21perf S99dtlogin K25snmpd S30sysid S99netconfig K50pop3 S74syslog S75cron S92rtvc-config K60nfs.server K65nfs.client S69inet K92volmgt README S95SUNWmd.sync S01MOUNTFSYS S71sysid.sys S88utmpd S95rrcd 备份 n系统初装时的备份n定期备份n增量式备份 n特别备份 ntarnufsdumpne.g.Perform a full level 0 ba

4、ckup of the /export/home file systemn# umount /export/homen# fsck /export/homen# ufsdump 0uf /dev/rmt/0 /export/homenufsrestore用户账号和环境平安n口令管理npasswd -n 30 user #强迫用户每30天修正一次密码npasswd -f user #强迫用户在下一次登录时修正口令npasswd -n 2 -x 1 user #制止用户修正口令npasswd -l user #封锁用户账号，制止登录n删除不用要的帐号 sys uucp nuucp listen等等

5、n在/etc/shadow的password域中放上NP字符n取消ROOT的远程登陆 n/etc/default/loginn/etc/ftpusers /etc/shellsn配置ROOT的环境n将umask设为077或者027 查看用户环境中途径设置情况，不要有./ nNIS的平安问题n/var/yp/securenets参与信任主机n采用NIS+ 用户账号和环境平安(cont.)nTelnet和ftpninetd 守护进程n /etc/inetd.conf ftp stream tcp nowait root /usr/local/bin/tcpd /usr/local/bin/wu-f

6、tpd telnet stream tcp nowait root /usr/local/bin/tcpd /usr/sbin/in.telnetdn/etc/servicesnftp 21/tcpntelnet 23/tcp取消不用要的效力，然后kill HUP inetdPID网络效力网络效力(cont.)nr效力见下页图n1)/etc/hosts.equivn2)$HOME/.rhostsn 3)修正/etc/inetd.confntcpd的访问控制 nfirst check /etc/hosts.allowne.g.nALL: /nseco

7、nd check /etc/hosts.denyne.g.nALL: /usr/bin/mailx -s %d: connection attempt from %c rootmydomainn 网络效力(cont.)网络效力(cont.)n取消NFS效力n修正/etc/dfs/dfstabnNFS server启动脚本: /etc/rc3.d/S15nfs.servernNFS client启动脚本: /etc/rc2.d/S73nfs.client nrpcbind平安n依托远程系统的IP地址和远程用户的UID来验证 /etc/rc2.d/S71RPC nddn修正中心和TCP/IP的设备

8、参数n ndd /dev/arp ? n ndd /dev/icmp ? n ndd /dev/ip ? n ndd /dev/tcp ? n#ndd -set /dev/arp arp_debug 0 0： 代表特性制止 #ndd -set /dev/arp arp_debug 1 1： 代表特性允许 ndd (cont.)n 减少ARP过期时间 #ndd -set /dev/arp arp_cleanup_interval 60000 #ndd -set /dev/ip ip_ire_flush_interval 60000 60000=60000 ms 默许是300000n 建立静态AR

9、P表 n#more file1ntestns 08:00:20:ba:a1:f2nuser. cnns 08:00:20:ee:de:1f n#arp -f file1n制止ARPn#ifconfig interface -arp(前提是运用静态的ARP表 )ndd (cont.)n封锁IP转发n#ndd -set /dev/ip ip_forwarding 0n严厉限定多主宿主机n#ndd -set /dev/ip ip_strict_dst_multihoning 1n封锁转发包广播n#ndd -set /dev/ip ip-forward_directed_broadcasts 0 n封

10、锁转发源路由包n#ndd -set /dev/ip ip_forward_src_routed 0 ndd (cont.)n封锁对echo广播的呼应n#ndd -set /dev/ip ip_respond_to_echo_boadcast 0 n封锁呼应时间戳广播 n#ndd -set /dev/ip ip_respond_to_timestamp_broadcast 0 n封锁地址掩码广播n#ndd -set /dev/ip ip_respind_to_address_mask_broadcast 0 n忽略ICMP重定向错误报文n#ndd -set /dev/ip ip_ignore_r

11、edirect 1 ndd (cont.)n制止本机发送错误重定向报文n#ndd -set /dev/ip ip_send_redirects 0 n封锁时间戳呼应 n#ndd -set /dev/ip ip_respond_to_timestamp 0 n提高未衔接队列大小(SYN flood attack)n#ndd -set /dev/tcp tcp_conn_req_max_q0 4096 n提高衔接队列大小(衔接耗尽攻击)n#ndd -set /dev/tcp tcp_conn_req_max_q 1024 IP 欺骗 n攻击过程n1)使被信任主机的网络暂时瘫痪2)衔接到目的机的某个

12、端口来猜测ISN基值和添加规律3)把源址址伪装成被信任主机，发送带有SYN标志的数据段恳求衔接 4)等待目的机发送SYN+ACK包给曾经瘫痪的主机5)再次伪装成被信任主机向目的机发送的ACK，此时发送的数据段带有预测的目的机的ISN+1 6)衔接建立，发送命令恳求n改良方法n修正/etc/default/inetinit运用更好的随机ISN生成方法 TCP_STRONG_ISS=2 cron 和 at n查看一切的cron义务n#crontab ln/var/spool/cron/crontabs ncron日志n/etc/default/cron里设置CRONLOG=yes ncron用户配

13、置 n/etc/cron.d/cron.allow和/etc/cron.d/cron.deny nat 用户配置n/etc/cron.d/at.allow和/etc/cron.d/at.deny 系统日志 n/etc/syslog.confn Example:n*.err /var/adm/messagesn*.err is the selector field; * is the facility, . is the delimiter, and err is the level of the messagen/var/adm/messages Is the action fieldnNot

14、encan use the * to select all facilities (for example *.err); ncannot use it to select all levels for a facility (for example, kern.*)系统日志(cont.)nAnother sample /etc/syslog.confn#user1 and user2 receive alert messages if they are logged in.n*.alert user1,user2n#All logged-in users will receive emerg

15、 messages.n*.emerg *n#If the LOGHOST variable was evaluated as TRUE, messages are #forwarded to the syslogd of the remote system.nmail.debug ifdef(LOGHOST, /var/log/authlog, loghost)nLOGHOSTnexample in host1n#more /etc/hostsn host1 loghost /LOGHOST is TRUE系统日志(cont.)nEnables TCP tracingn#

16、 grep inetd /etc/init.d/inetsvcn/usr/sbin/inetd -s -t &/Add the t optionn# grep daemon.notice /etc/syslog.confn*.err;kern.debug;daemon.notice;mail.crit /var/adm/messagesn#/etc/init.d/syslog stopn#/etc/init.d/syslog start/restart the syslogd daemonnForward the messages to the printer #vi /etc/syslog.confn*.err;kern.debug;daemon.notice;mail.crit/dev/lp0 系统日志(cont.)Example of syslog Logged Entry补丁管理n显示系统中安装的一切patch及版本nshowrev p pa