Hey folks. One of our new clients has a redhat 6.1 server, and I'd assume that there are probably a number of services that are insecure on it. Does anyone have any suggestions in particular in terms of upgrading this machine and locking it down? I'm used to using current distros and simply upgrading the packages as the security holes are announced. I'm not sure what approach to take on an older machine that probably needs a number of things fixed.

Thanks a lot,
Justin

erm.. Redhat 6.1

Does not sound good at all.. If they havent been able to upgrade it, first thing you should do is reinstall it.. I could bet it has already been compromised.

Download for example chkrootkit (as a start) and run it.. I have a wild guess that it will report some rootkits.. dunno..

If in some really strange way it has managed to survive, then you should suggest them to change distribution. that is just my opinion...

If you didn't discover any legacy stuff that would break under upgrade, definately go for an upgrade I'd say. The major reason I can offer is the newer RH's upgrade facilities (dunno if that would really count like for lowering TCO tho), newer kernel for better performance, plus RH6.1 having the largest stock of xploits readily available :-]
Map out what the box *should* be serving, *who* it should be serving to, this and the usual CERT/SANS hardening docs should give you an overview what has to be there and what has to go.

Here's some docs to get you started if you like:
the CERT UNIX Security Checklist v2.0,
CERT's Techtips,
The SANS Reading room: Linux issues,
Bastille Linux Hardening System,
CERT, root compromise, part F,
LASG: Linux Administrator's Security Guide,
Security Quick-Start HOWTO for Linux,
Armoring Linux,
SAG: The Linux System Administrator's Guide,
Elementary security for your Linux box.

HTH

Thanks, I'll look at all those docs. I ran chkrootkit and it didn't turn up anything. I did check the list of dependencies for upgrading to the rh 7.3 kernel, and down the chain I would have to upgrade glibc which would break a number of packages. Pretty much I would have to upgrade everything... I'd be too worried that something would end up broken in the end. I can't really risk downtime with this server as it hosts their email and web. I think I'll probably just put the latest 2.2.x kernel on there, and upgrade sendmail and popd (I've already put the latest apache, sshd, and proftpd on there). Then a good ipchains rulset will hopefully hide all of the other security holes.

Does this seem like a good alternative, or is there something I'm missing?

Thanks,
Justin

If I were you I'd just kernel to 2.2.21 (rh6.1 has 2.2.5)
DO NOT UPDATE VIA RPMS IF YOU COMPILE FROM SOURCE ITLL BREAK NOTHING EVEN STUFF THAT DEPENDS!