{"id":347,"date":"2012-10-17T14:49:44","date_gmt":"2012-10-17T12:49:44","guid":{"rendered":"http:\/\/clark.tipistrani.it\/?p=347"},"modified":"2016-04-19T17:36:18","modified_gmt":"2016-04-19T15:36:18","slug":"hardening-del-sistema","status":"publish","type":"post","link":"http:\/\/clark.tipistrani.it\/?p=347","title":{"rendered":"Hardening del sistema"},"content":{"rendered":"<p>Una volta installata la macchina base passiamo a fare un minimo di hardening del sistema a livello di kernel e di applicativi che ci possono essere d&#8217;aiuto.<br \/>\nPer prima cosa rimuoviamo i pacchetti non necessari, tipicamente tutti i -dev possibili anche se ad onor del vero ubuntu-server non installa molta roba inutile, giusto il necessario per girare l&#8217;installazione base e&#8217; davvero base, una volta individuati e rimossi\u00a0 i pacchetti inutili conviene secondo me installare quei tools utili anche se non indispensabili per facilitarci la vita nell&#8217;amministrazione della macchina un esempio per tutti logchek e relative dipendenze.<br \/>\nRiconfiguriamo la shared memory, Per impostazione predefinita, \/dev\/shm \u00e8 montato in lettura \/ scrittura, con il permesso di eseguire programmi, negli ultimi anni, molte mailing list di sicurezza hanno notato molti exploit in cui si usa \/dev\/shm in un attacco contro un servizio in esecuzione, ad esempio httpd.<br \/>\nLa maggior parte di questi attacchi tuttavia si basano su applicazioni insicure piuttosto che una vulnerabilit\u00e0 di Apache o Ubuntu, in linea di massima salvo applicazioni particolari ad esempio un touchpad synaptics\u00a0 non serve montare \/dev\/shm su un server per\u00f2 giusto perch\u00e8 non ho idea precisa di come funzioni tutto il sistema riduco i permessi su \/dev\/shm aggiungendo a \/etc\/fstab la riga:<\/p>\n<pre>tmpfs     \/dev\/shm     tmpfs     defaults,noexec,nosuid     0     0\r\ne rendo operativo il cambiamento con un <tt>mount\u00a0-o\u00a0remount\u00a0\/dev\/shm<\/tt>\r\nSuccessivamente\u00a0 andiamo a modificare il file \/etc\/ssh\/sshd_config\r\n[orig]#Port 22\r\n[mod] Port 30922\r\n[orig] LoginGraceTime 120\r\n[mod]LoginGraceTime 20\r\n[orig] PermitRootLogin yes\r\n[mod] PermitRootLogin no\r\n[orig] #X11Forwarding yes\r\n[mod] X11Forwarding no\r\n[orig] Subsystem sftp \/usr\/lib\/openssh\/sftp-server\r\n[mod] #Subsystem sftp \/usr\/lib\/openssh\/sftp-server<\/pre>\n<p>In altre parole spostiamo la porta su cui il demone ascolta molto in alto per evitare che gli scan facciano infinite query, riduciamo il tempo in cui un utente pu\u00f2 autenticarsi riducendo cos\u00ec la possibilit\u00e0 di DoS,\u00a0 impediamo la login come root,disabilitiamo la possibilit\u00e0 di forwardare X via ssh (non \u00e8 installato ma va bene inibirlo lo stesso) e disabilitiamo sftp che almeno adesso come adesso non ci serve.<\/p>\n<p>Finita la modifica al demone di ssh passiamo a istruire il kernel tramite \/etc\/sysctl.conf poich\u00e9 le modifiche a questo file sono molte e importanti riporto interamente il file<\/p>\n<p>#<br \/>\n# \/etc\/sysctl.conf &#8211; Configuration file for setting system variables<br \/>\n# See \/etc\/sysctl.d\/ for additional system variables<br \/>\n# See sysctl.conf (5) for information.<br \/>\n#<\/p>\n<p>#kernel.domainname = example.com<\/p>\n<p># Uncomment the following to stop low-level messages on console<br \/>\nkernel.printk = 3 4 1 3<br \/>\n### attivato il 15\/10\/2012<br \/>\n##############################################################3<br \/>\n# Functions previously found in netbase<br \/>\n##disable ipv6<br \/>\nnet.ipv6.conf.all.disable_ipv6 = 1<br \/>\nnet.ipv6.conf.default.disable_ipv6 = 1<br \/>\nnet.ipv6.conf.lo.disable_ipv6 = 1<\/p>\n<p># Uncomment the next two lines to enable Spoof protection (reverse-path filter)<br \/>\n# Turn on Source Address Verification in all interfaces to<br \/>\n# prevent some spoofing attacks<br \/>\n#net.ipv4.conf.default.rp_filter=1<br \/>\nnet.ipv4.conf.all.rp_filter=1<br \/>\n### abilitato in data 15\/10\/2012<br \/>\n# Uncomment the next line to enable TCP\/IP SYN cookies<br \/>\n# See http:\/\/lwn.net\/Articles\/277146\/<br \/>\n# Note: This may impact IPv6 TCP sessions too<br \/>\nnet.ipv4.tcp_syncookies=1<br \/>\nnet.ipv4.tcp_max_syn_backlog = 2048<br \/>\nnet.ipv4.tcp_synack_retries = 2<br \/>\n### attivato il 15\/10\/2012<br \/>\n# Uncomment the next line to enable packet forwarding for IPv4<br \/>\n#net.ipv4.ip_forward=1<\/p>\n<p># Uncomment the next line to enable packet forwarding for IPv6<br \/>\n#\u00a0 Enabling this option disables Stateless Address Autoconfiguration<br \/>\n#\u00a0 based on Router Advertisements for this host<br \/>\n#net.ipv6.conf.all.forwarding=1<\/p>\n<p>###################################################################<br \/>\n# Additional settings &#8211; these settings can improve the network<br \/>\n# security of the host and prevent against some network attacks<br \/>\n# including spoofing attacks and man in the middle attacks through<br \/>\n# redirection. Some network environments, however, require that these<br \/>\n# settings are disabled so review and enable them as needed.<br \/>\n#<br \/>\n# Do not accept ICMP redirects (prevent MITM attacks)<br \/>\nnet.ipv4.conf.all.accept_redirects = 0<br \/>\nnet.ipv6.conf.all.accept_redirects = 0<br \/>\n### abilitati in data 15\/10\/2012<br \/>\n# _or_<br \/>\n# Accept ICMP redirects only for gateways listed in our default<br \/>\n# gateway list (enabled by default)<br \/>\n# net.ipv4.conf.all.secure_redirects = 1<br \/>\n#<br \/>\n# Do not send ICMP redirects (we are not a router)<br \/>\n#net.ipv4.conf.all.send_redirects = 0<br \/>\n#<br \/>\n# Do not accept IP source route packets (we are not a router)<br \/>\nnet.ipv4.conf.all.accept_source_route = 0<br \/>\nnet.ipv6.conf.all.accept_source_route = 0<br \/>\n# Log Martian Packets<br \/>\nnet.ipv4.conf.all.log_martians = 1<br \/>\n### attivato in data 15\/10\/2012<br \/>\n#<br \/>\n### aggiunti in data 15\/10\/2012<br \/>\nnet.ipv4.icmp_echo_ignore_broadcasts = 1<br \/>\nnet.ipv4.icmp_ignore_bogus_error_responses = 1<br \/>\n### aggiunti in data 17\/10\/2012<br \/>\n# Controls the System Request debugging functionality of the kernel<br \/>\nkernel.sysrq = 0<br \/>\n# Controls whether core dumps will append the PID to the core filename.<br \/>\n# Useful for debugging multi-threaded applications.<br \/>\nkernel.core_uses_pid = 1<\/p>\n<p># Modify system limits for Ensim WEBppliance<br \/>\nfs.file-max = 65000<\/p>\n<p># Decrease the time default value for tcp_fin_timeout connection<br \/>\nnet.ipv4.tcp_fin_timeout = 15<\/p>\n<p># Decrease the time default value for tcp_keepalive_time connection<br \/>\nnet.ipv4.tcp_keepalive_time = 1800<\/p>\n<p># Turn off the tcp_window_scaling<br \/>\nnet.ipv4.tcp_window_scaling = 0<\/p>\n<p># Turn off the tcp_sack ( Need to turn on for traffic to internet)<br \/>\n#net.ipv4.tcp_sack = 0<\/p>\n<p># Turn off the tcp_timestamps<br \/>\nnet.ipv4.tcp_timestamps = 0<\/p>\n<p># Set maximum amount of memory allocated to shm to 256MB<br \/>\nkernel.shmmax = 268435456<\/p>\n<p># Increase the maximum total TCP buffer-space allocatable<br \/>\nnet.ipv4.tcp_mem = 57344 57344 65536<\/p>\n<p># Increase the maximum TCP write-buffer-space allocatable<br \/>\nnet.ipv4.tcp_wmem = 32768 65536 524288<\/p>\n<p># Increase the maximum TCP read-buffer space allocatable<br \/>\nnet.ipv4.tcp_rmem = 98304 196608 1572864<\/p>\n<p># Increase the maximum and default receive socket buffer size<br \/>\nnet.core.rmem_max = 524280<br \/>\nnet.core.rmem_default = 524280<\/p>\n<p># Increase the maximum and default send socket buffer size<br \/>\nnet.core.wmem_max = 524280<br \/>\nnet.core.wmem_default = 524280<\/p>\n<p># Increase the tcp-time-wait buckets pool size<br \/>\nnet.ipv4.tcp_max_tw_buckets = 1440000<\/p>\n<p># Allowed local port range<br \/>\nnet.ipv4.ip_local_port_range = 16384 65536<\/p>\n<p># Increase the maximum memory used to reassemble IP fragments<\/p>\n<p>net.ipv4.ipfrag_high_thresh = 512000<br \/>\nnet.ipv4.ipfrag_low_thresh = 446464<\/p>\n<p># Increase the maximum amount of option memory buffers<br \/>\nnet.core.optmem_max = 57344<\/p>\n<p><a href=\"http:\/\/clark.tipistrani.it\/?attachment_id=409\" rel=\"attachment wp-att-409\">sysctl.conf.tar<\/a><\/p>\n<p>Controlliamo che porte abbiamo aperte sul server con un:<br \/>\nnetstat -tulp<\/p>\n<p>root@crm:\/etc# netstat -tulp<br \/>\nActive Internet connections (only servers)<br \/>\nProto Recv-Q Send-Q Local Address\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Foreign Address\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 State\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 PID\/Program name<br \/>\ntcp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0\u00a0\u00a0\u00a0 0 localhost:mysql\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 *:*\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 LISTEN\u00a0\u00a0\u00a0\u00a0\u00a0 867\/mysqld<br \/>\ntcp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0\u00a0\u00a0\u00a0 0 *:http\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 *:*\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 LISTEN\u00a0\u00a0\u00a0\u00a0\u00a0 1621\/apache2<br \/>\ntcp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0\u00a0\u00a0\u00a0 0 localhost:smtp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 *:*\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 LISTEN\u00a0\u00a0\u00a0\u00a0\u00a0 1196\/master<br \/>\ntcp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0\u00a0\u00a0\u00a0 0 *:1722\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 *:*\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 LISTEN\u00a0\u00a0\u00a0\u00a0\u00a0 778\/sshd<br \/>\ntcp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0\u00a0\u00a0\u00a0 0 *:https\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 *:*\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 LISTEN\u00a0\u00a0\u00a0\u00a0\u00a0 1621\/apache2<br \/>\ntcp6\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0\u00a0\u00a0\u00a0 0 [::]:1722\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 [::]:*\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 LISTEN\u00a0\u00a0\u00a0\u00a0\u00a0 778\/sshd<br \/>\nudp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0\u00a0\u00a0\u00a0 0 crm.zincometal.com:ntp\u00a0 *:*\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 2326\/ntpd<br \/>\nudp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0\u00a0\u00a0\u00a0 0 localhost:ntp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 *:*\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 2326\/ntpd<br \/>\nudp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0\u00a0\u00a0\u00a0 0 *:ntp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 *:*\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 2326\/ntpd<br \/>\nudp6\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0\u00a0\u00a0\u00a0 0 [::]:ntp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 [::]:*\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 2326\/ntpd<\/p>\n<p>da rivedere perch\u00e9 nonostante abbia disabilitato ipv6 ci siano ancora tcp6 e udp6 ma al momento non mi preoccupa e proseguiamo con un nmap<br \/>\npc0:\/home\/clark# nmap -sTU crm.myfirm.com<\/p>\n<p>Starting Nmap 5.00 ( http:\/\/nmap.org ) at 2012-10-17 14:19 CEST<br \/>\nInteresting ports on 213.215.xxx.xxx:<br \/>\nNot shown: 1000 open|filtered ports, 999 filtered ports<br \/>\nPORT\u00a0\u00a0\u00a0 STATE SERVICE<br \/>\n443\/tcp open\u00a0 https<\/p>\n<p>Nmap done: 1 IP address (1 host up) scanned in 12.74 seconds<\/p>\n<p>Appare aperta solo la 443 che e&#8217; quello che ci serve, per quanto possibile abbiamo messo in sicurezza la macchina a livello di sistema.<\/p>\n<div id=\"link64_adl_tabid\" style=\"display: none;\" data-url=\"http:\/\/clark.tipistrani.it\/wp-admin\/post.php?post=347&amp;action=edit\">686<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Una volta installata la macchina base passiamo a fare un minimo di hardening del sistema a livello di kernel e di applicativi che ci possono essere d&#8217;aiuto. Per prima cosa rimuoviamo i pacchetti non necessari, tipicamente tutti i -dev possibili anche se ad onor del vero ubuntu-server non installa molta roba inutile, giusto il necessario [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,7,6],"tags":[],"class_list":["post-347","post","type-post","status-publish","format-standard","hentry","category-linux","category-sistemi-operativi","category-work"],"_links":{"self":[{"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=\/wp\/v2\/posts\/347","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=347"}],"version-history":[{"count":16,"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=\/wp\/v2\/posts\/347\/revisions"}],"predecessor-version":[{"id":1299,"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=\/wp\/v2\/posts\/347\/revisions\/1299"}],"wp:attachment":[{"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=347"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=347"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=347"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}