InformationSecurity:CheckList:Unix
lastmod 2026-02-20created 2020-11-18149 edits
Checklist of security items for Unix-like systems.
[U-1] Restrict remote root login
Edit the /etc/securetty file to block Telnet.
- In
/etc/securetty(the configuration file restricting root access over Telnet), remove thepts/0~pts/xentries to delete those access paths. - In
/etc/pam.d/login, uncomment#auth required /lib/security/pam_securetty.so. (Blocks root login in the PAM configuration module)
OpenSSH's PermitRootLogin must be no or commented out.
The output is as follows:
[U-2] Set password complexity
Use pam_cracklib (Linux PAM). Add the following to the /etc/pam.d/common-password file.
You can check it with the following command.
[U-3] Set account lockout threshold
Use pam_tally (Linux PAM). Add the following to the /etc/pam.d/common-auth file.
You can check it with the following command.
[U-4] Protect the password file
With pwconv, the second field of the /etc/passwd file is shown as x.
The output is as follows:
[U-5] Prohibit UID '0' for accounts other than root
Only root is allowed to have 0 in the third field of the /etc/passwd file.
Only the root account should be printed, as below.
[U-6] Restrict su to root
Restrict the su command using pam_wheel (Linux PAM) so that only wheel users can access it.
Add or modify the following in the /etc/pam.d/su file:
Add users to the wheel group by editing the /etc/group file.
Change permissions so that regular users cannot use the su command and only users in the wheel group can.
[U-7] Set minimum password length
Set the PASS_MIN_LEN value in the /etc/login.defs file to 8 or more.
[U-8] Set maximum password age
Set the PASS_MAX_DAYS value in the /etc/login.defs file to 60 or less.
[U-9] Set minimum password age
Set the PASS_MIN_DAYS value in the /etc/login.defs file to 30.
[U-10] Remove unnecessary accounts
The Default accounts blocked by default as given in the "Critical Information Infrastructure Technical Vulnerability Analysis and Assessment Guide" are as follows.
- adm (separate account for the system administrator)
| WARNING |
| On Amazon Linux 2, the |
- lp (local printing)
- sync (remote sync)
- shutdown (system shutdown)
- halt (forced system shutdown)
- news (for newsgroup servers, needed when using nntp)
- uucp (protocol for copying files between Unix systems)
- operator (for special purposes such as backups, used for shared administration by multiple users)
- games (account for games on the x-window screen)
- gopher (a service used before web services existed)
- nfsnobody (account for the network file system)
- squid (proxy server)
How to remove them together with their home folders:
[U-11] Include the minimum number of accounts in the administrator group
Delete unnecessary accounts registered in the root group in /etc/group.
[U-12] Prohibit GIDs with no accounts
- Prohibit GIDs with no accounts - KISA Critical Information Infrastructure Technical Vulnerability Analysis and Assessment Detailed Guide
- (Account management) 1.12 CentOS 6.7 Prohibit GIDs with no accounts
After checking the /etc/group file, delete groups that have no members or are no longer used.
[U-13] Prohibit duplicate UIDs
There must be no users with the same UID number in the /etc/passwd file.
You can check with the following command:
[U-14] Check user shells
- Monble_Information Security :: Prohibit duplicate UIDs <- also has the user shell check item.
Since attackers could access the system through accounts that do not need to log in and have user commands interpreted and abused, set the default shell of such accounts to one of the following.
-
/bin/false -
/usr/sbin/nologin
Open the /etc/passwd file and edit the default shell of those accounts. After editing, it looks like the following.
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
You can check with the following command.
cat /etc/passwd | awk -F: '{ print $7, $1 }' | sort | grep -v /usr/sbin/nologin | grep -v /bin/false
[U-15] Set Session Timeout
Bourne shell compatible
When using sh, ksh, bash, or ash:
Add/modify the following in the /etc/profile(.profile) file. (Unit: seconds)
csh
Add/modify the following in the /etc/csh.login or /etc/csh.cshrc file. (Unit: minutes)
[U-16] root home and PATH directory permissions and PATH settings
Check the permissions of the /root directory. Also, the PATH environment variable must not contain directory shortcuts (e.g. ., ..).
The output should look like the following.
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin
[U-17] Set file and directory owners
Delete files and directories with no existing owner, or change their owner:
## (Docker 관련 파일 및 프로세스 관련 파일 제외)
find / -nouser -print | grep -v /var/lib/docker/ | grep -v /proc/
find / -nogroup -print | grep -v /var/lib/docker/ | grep -v /proc/
[U-18] Set owner and permissions of the /etc/passwd file
The /etc/passwd file must be owned by root, with permissions of 644 or less.
[U-19] Set owner and permissions of the /etc/shadow file
The /etc/shadow file must be owned by root, with permissions of 400.
[U-20] Set owner and permissions of the /etc/hosts file
The /etc/hosts file must be owned by root, with permissions of 600.
Depending on the business service, read permission may need to be given to the owning group or to other, so 644 should also be considered compliant.
[U-21] Set owner and permissions of the /etc/(x)inetd.conf file
The configuration file for the inetd service. Used to verify the identity of users requesting access to network equipment. When responses from the authentication daemon are received, their validity is not checked and they are handled entirely by the client, so authentication can be forged.
The /etc/inetd.conf or /etc/xinetd.conf file must be owned by root, with permissions of 600.
[U-22] Set owner and permissions of the /etc/syslog.conf file
The file that configures recording of key logs generated during system operation.
The /etc/syslog.conf file must be owned by root, with permissions of 644.
[U-23] Set owner and permissions of the /etc/services file
Used for service management.
The /etc/services file must be owned by root, with permissions of 644.
[U-24] Check files with SUID, SGID, and Sticky bit set
setuid and setgid (SUID, SGID, Sticky bit) can be checked with the following commands.
## (Docker 관련 파일 및 Snapcraft 관련 파일 제외)
find / -perm -04000 | grep -v /var/lib/docker/ | grep -v /snap/
find / -perm -02000 | grep -v /var/lib/docker/ | grep -v /snap/
find / -perm -01000 | grep -v /var/lib/docker/ | grep -v /snap/
[U-25] Set owner and permissions of user and system startup files and environment files
Environment variable files in home directories must be as follows.
- Owned by root or by the account name.
- Write permission granted only to root and the owner.
These files include .profile, .kshrc, .cshrc, .bashrc, .bash_profile, .login, .exrc, .netrc, and so on.
You can check with the following command in the home directory:
[U-26] Check world writable files
If there are files with permissions that let all users access and modify them (world writable), you must identify them precisely.
There are surprisingly many such files, which makes checking hard.
## 몇가지 패턴을 제외한 검사 방법:
find / -perm -2 -ls | grep -v /var/lib/docker/ | grep -v /snap/ | grep -v /run/ | grep -v /usr/ | grep -v /lib/ | grep -v /home/ | grep -v /dev/ | grep -v /proc/ | grep -v /sys/ | grep -v /tmp/
[U-27] Check for nonexistent device files in /dev
[U-28] Prohibit use of $HOME/.rhosts and hosts.equiv
Remote access via r-commands is sometimes used for NET Backup or other purposes, but it is very weak in terms of security, and if the service port is open it can cause incidents such as leaks of important information and system failures. If its use is unavoidable, set the owner of the /etc/hosts.equiv file and the .rhosts file to root or the relevant account, set the permissions to 600, and make sure the file settings do not include a + setting (allow all hosts).
You can check with the commands below.
ls -al /etc/hosts.equiv
ls -al $HOME/.rhosts
cat /etc/hosts.equiv | grep '+'
cat $HOME/.rhosts | grep '+'
[U-29] Restrict access by IP and port
Apply an ALL Deny setting in the /etc/hosts.deny file:
Enter the allowed services and IPs in the /etc/hosts.allow file.
[U-30] Set owner and permissions of the hosts.lpd file
Check file permissions/owner to prevent IP spoofing in the Line Printer Daemon protocol (LPD) / Line Printer Remote protocol (LPR).
The file must be owned by root, and Other must not have write permission. (Keeping the permissions at 600 is best)
[U-31] Disable the NIS service
The service must be turned off.
[U-32] Manage UMASK settings
Set the umask value to 022 or less. Modify or add the following in the /etc/profile file.
To see the current value, just run the umask command.
[U-33] Set home directory owner and permissions
The home directory must be owned by the corresponding account, and write permission for regular users must be removed.
You can check with the following command:
[U-34] Manage the existence of directories designated as home directories
Check that every user account in the /etc/passwd file has an appropriate home directory. If an account without a home directory is found, apply one of the methods below
- Delete user accounts without a home directory
- Assign a home directory to user accounts without one
You can check with the following command:
[U-35] Search for and remove hidden files and directories
Look for hidden files and delete them if unnecessary.
[U-36] Disable the Finger service
The finger command shows account information for local or remote users. It reads the information of the specified account user from the /etc/passwd file and displays it.
If the service is running, stop it.
[U-37] Disable Anonymous FTP
If there is an ftp or anonymous account in the /etc/passwd file, remove it.
Check with the following command:
[U-38] Disable r-family services
Stop all Remote Shell services.
[U-39] Set owner and permissions of cron files
cron access control files must be owned by root, with permissions of 640 or less.
How to check:
[U-40] Disable services vulnerable to DoS attacks
Disable the echo, discard, daytime, and chargen services, which are vulnerable to Dos attacks.
[U-41] Disable the NFS service
Stop the NFS daemons (nfsd, statd, mountd).
[U-42] NFS access control
List only the shared directories that are strictly necessary in the /etc/exports file.
[U-43] Remove automountd
Remove all Automounter/AutoFS related services.
[U-44] Check RPC services
RPC (Remote Procedure Call) services offer many advantages for development in distributed processing environments, but the services below have many buffer overflow (Buffer Overflow) vulnerabilities, with a risk of root privilege acquisition and security incidents, so they must be stopped.
- rpc.cmsd
- rpc.ttdbserverd
- sadmind
- rusersd
- walld
- sprayd
- rstatd
- rpc.nisd
- rexd
- rpc.pcnfsd
- rpc.statd
- rpc.ypupdated
- rpc.rquotad
- kcms_server
- cachefsd
[U-45] Check NIS and NIS+
NIS (Network Information Service) shares important system database files over the network, and NIS+ is a later version that adds security and convenience features. Using NIS or NIS+, which are insecure services, can allow root privileges to be obtained, so it is best not to use them; but if NIS must be used, using NIS+ is recommended over NIS, which has many problems for user information security.
[U-46] Disable tftp and talk services
The ftp, tftp, telnet, and talk services, which are unnecessary for service operation, must not be used.
[U-47] Check Sendmail version
Because Sendmail is so widely used, many vulnerabilities are known and it is an easy target for attacks; so review why Sendmail is used on the server, and if there is no need for it, it is best to remove the service. If it must be run, keep a Sendmail version without vulnerabilities and apply patches promptly when they are released for vulnerabilities. Otherwise, there is a risk of system privilege acquisition and leaks of important information through buffer overflow (Buffer Overflow) attacks. Keep Sendmail at version 8.13.8 or later.
[U-48] Restrict spam mail relaying
If the relay function of an SMTP (Simple Mail Transfer Protocol) server is not restricted, it may be abused as a spam mail server or the server load may increase. Therefore, set relay restrictions so that only authenticated users can send mail, or stop the SMTP service if it is not needed.
[U-49] Prevent regular users from running Sendmail
When using the SMTP service, prevent regular users from running Sendmail with the q option, blocking the ability to view the mail queue contents and the sendmail configuration or to forcibly Drop the mail queue. Otherwise, unauthorized users may cause SMTP service errors.
[U-50] Apply DNS security version patches
For BIND (Berkeley Internet Name Domain), version BIND 9.5.0 has been released, and earlier versions have many vulnerabilities. BIND 8.x is a new version number used to align BIND's distribution with Sendmail's version; compared to the Production version of BIND 4 it improved stability, performance, and security, but BIND 8.3.4 and earlier have vulnerabilities such as denial-of-service attacks, buffer overflow (Buffer Overflow), and remote intrusion into DNS servers.
Conclusion: just don't use DNS services.
[U-51] DNS ZoneTransfer settings
DNS Zone Transfer is a feature used to keep Zone information consistent between the Primary Name Server and the Secondary Name Server, and it must be restricted to transfer Zone information only to the Secondary Name Server. If Zone Transfer is allowed to unauthorized users, an attacker can use the received Zone information to learn a great deal, such as host information, system information, and network topology.
Conclusion: like I said, turn off the DNS service
[U-52] Remove Apache directory listing
Just don't use crappy Apache!!
[U-53] Restrict Apache web process privileges
Just don't use crappy Apache!!
[U-54] Prohibit access to parent directories in Apache
Just don't use crappy Apache!!
[U-55] Remove unnecessary Apache files
Just don't use crappy Apache!!
[U-56] Prohibit link use in Apache
Just don't use crappy Apache!!
[U-57] Restrict file uploads and downloads in Apache
Just don't use crappy Apache!!
[U-58] Separate the Apache web service area
Just don't use crappy Apache!!
[U-59] Allow remote access via ssh
In short, use SSH for remote access.
[U-60] Check the ftp service
The FTP service sends IDs and passwords unencrypted, so they can be sniffed even by a simple Sniffer; use of the FTP service must therefore be restricted except where strictly necessary.
[U-61] Restrict the ftp account shell
Don't use a default shell for the ftp account. Use /bin/false.
[U-62] Set owner and permissions of the Ftpusers file
Keep the /etc/ftpusers file owned by root, with permissions of 640 or less.
[U-63] Ftpusers file settings
Edit the configuration file so that direct login as the root account is not possible over FTP.
[U-64] Set owner and permissions of at files
Keep the /etc/at.allow access control file owned by root, with permissions of 640 or less.
[U-65] Check whether the SNMP service is running
The SNMP (Simple Network Management Protocol) service is used to monitor or configure the system state in real time. Since the SNMP service can lead to leaks of important system information and illegal modification of information, it is best to stop the SNMP service if it is not used.
[U-66] Set complexity of the SNMP service community string
The SNMP (Simple Network Management Protocol) service is provided by default on UNIX systems for an NMS (Network Management System) that monitors system state in real time, and it uses a Community String, a kind of password, to receive information. The Community String is often set to public or private by Default, and if it is not changed, this String can be abused to learn important system information and settings. Therefore, the SNMP Community name must not be public or private.
[U-67] Display a warning message at logon
If no login banner is set, the server OS version and service versions may be exposed to attackers in the banner, and attackers can use this information to attempt attacks exploiting vulnerabilities in that OS and those services.
Edit each of the files below.
- /etc/issue: Message file shown on console (local) login attempts. (Before login)
- /etc/issue.net: Message file shown on remote login attempts. (Before login)
- /etc/motd: Applies to both local and remote access; message file shown after a successful login (After login)
For the text shown on ssh login, edit the banner in the configuration file.
[U-68] Access permissions for NFS configuration files
The NFS access control configuration file, /etc/export, must be owned by root, with permissions of 644 or less.
[U-69] Restrict the expn and vrfy commands
SMTP (Simple Mail Transfer Protocol) has many vulnerabilities and carries potential risks. Review why SMTP is used on the server and remove the service if it is not needed; when running the SMTP service, block VRFY and EXPN, basic services of Sendmail, to prevent Sendmail Abuse.
- VRFY: The command an SMTP client sends to an SMTP server to verify whether mail exists for a specific ID
- EXPN (mailing list expansion): The command for forwarding when sending mail
Set the noexpn and novrfy options.
[U-70] Hide Apache web service information
Just don't use crappy Apache!!
[U-71] Apply the latest security patches and vendor recommendations
Establish a patch policy and manage patches periodically.
[U-72] Regular review and reporting of logs
Review and analysis of log records, writing reports, and reporting must be done regularly.
[U-73] Configure system logging according to policy
A logging policy must be established and configured according to policy.
Documentation
- Korea East-West Power security checklist by system
- Korea_east-west_power_-_security_checklist.xls.zip (2020-11-18)
- Unix servers, Windows servers, control PCs (Client), security equipment, network equipment, control systems, databases, application systems (web), special systems
- KISA Critical Information Infrastructure Technical Vulnerability Analysis and Assessment Methods
- ??
See also
- Unix
- Information Security
- Linux:Syslog: Log file guide ETC.
- Linux:User: Linux user management.