Red Hat ENTERPRISE LINUX 5 - VIRTUAL SERVER ADMINISTRATION, Руководство по развертыванию

Страница: 644 / 848

Chapter 43. Securing Your Network
618
•
Buffer Overflow Attacks
— Services that connect to ports numbered 0 through 1023 must run as
an administrative user. If the application has an exploitable buffer overflow, an attacker could gain
access to the system as the user running the daemon. Because exploitable buffer overflows exist,
crackers use automated tools to identify systems with vulnerabilities, and once they have gained
access, they use automated rootkits to maintain their access to the system.
Note
The threat of buffer overflow vulnerabilities is mitigated in Red Hat Enterprise Linux by
ExecShield
, an executable memory segmentation and protection technology supported
by x86-compatible uni- and multi-processor kernels. ExecShield reduces the risk of buffer
overflow by separating virtual memory into executable and non-executable segments. Any
program code that tries to execute outside of the executable segment (such as malicious
code injected from a buffer overflow exploit) triggers a segmentation fault and terminates.
Execshield also includes support for
No eXecute
(NX) technology on AMD64 platforms
and
eXecute Disable
(XD) technology on Itanium and Intel
®
64 systems. These
technologies work in conjunction with ExecShield to prevent malicious code from running
in the executable portion of virtual memory with a granularity of 4KB of executable code,
lowering the risk of attack from stealthy buffer overflow exploits.
Tip
To limit exposure to attacks over the network, all services that are unused should be
turned off.
43.1.5.2. Identifying and Configuring Services
To enhance security, most network services installed with Red Hat Enterprise Linux are turned off by
default. There are, however, some notable exceptions:
•
cupsd
— The default print server for Red Hat Enterprise Linux.
•
lpd
— An alternative print server.
•
xinetd
— A super server that controls connections to a range of subordinate servers, such as
gssftp
and
telnet
.
•
sendmail
— The Sendmail
Mail Transport Agent
(MTA) is enabled by default, but only listens for
connections from the localhost.
•
sshd
— The OpenSSH server, which is a secure replacement for Telnet.
When determining whether to leave these services running, it is best to use common sense and err
on the side of caution. For example, if a printer is not available, do not leave
cupsd
running. The
same is true for
portmap
. If you do not mount NFSv3 volumes or use NIS (the
ypbind
service), then
portmap
should be disabled.
Red Hat Enterprise Linux ships with three programs designed to switch services on or off. They are
the
Services Configuration Tool
(
system-config-services
),
ntsysv
, and
chkconfig
. For
information on using these tools, refer to
Chapter 16, Controlling Access to Services
.