Slackware, security

Knightron · 07-06-2011, 01:58 AM

Hi, i'm pretty new to linux, but have been working at it and setting up Slackware. I've used Ubuntu in the past, and quite frankley, used it the way it comes, and assumed it was safe. What things should i do to secure Slackware. Anything special?

dh2k · 07-06-2011, 02:14 AM

First action is to join the security mailing list with the phrase "subscribe [name of list]" in the body of the email.:

Code:

To: majordomo@slackware.com.
Subject: 
Message body: subscribe slackware-security

http://www.slackware.com/lists/ for more info

...and here for (older) archived security announcements,
http://www.slackware.com/security/

Second action is to update when required or when advised by the security mailing-list:
To do this,install slackpkg
http://www.slackpkg.org/stable/ for recent stable releases.

*Then uncomment (remove the # ) from a mirror for your slackware-version in /etc/slackpkg/mirrors, then run as root:

Code:

# slackpkg update

# slackpkg install-new

# slackpkg upgrade-all

*Quoting "brianL; Senior Member"
http://www.linuxquestions.org/questi...03#post4404283

mRgOBLIN · 07-06-2011, 02:18 AM

Pretty much boils down to:

Staying up to date (slackpkg can help here)

Making sure you aren't running any services that you don't need.

Create a normal user account for day to day use and only use the root account for Administration purposes.

Use trusted sources for any software you build/install (Verify these using the md5/asc files provided)

Use some common sense... read before you click... etc..

H_TeXMeX_H · 07-06-2011, 05:17 AM

Make sure to install a firewall script:
http://connie.slackware.com/~alien/efg/

Also I always disable TCP connections to X by editing /usr/bin/startx:

Code:

serverargs="-nolisten tcp"

I also check for rootkits once in a while using rkhunter, chkrootkit.

Also, use strong passwords.

Hangdog42 · 07-06-2011, 07:11 AM

There are also probably additional steps you could take depending upon how you use the machine. For example, if you're planning on using this as a server connected to the Internet 24/7, I'd be very tempted to install a file integrity checker like Aide, Samhain, Osiris or Tripwire. Depending on what services you're exposing there may be additional hardening steps you could take.

hitest · 07-06-2011, 08:44 AM

Quote:

Originally Posted by mRgOBLIN

Use trusted sources for any software you build/install (Verify these using the md5/asc files provided)

Further to mRgOBLIN's post. The trusted sources that I use to build software or install packages are as follows:

1. http://www.slackbuilds.org/

2. Robby's packages

3. Eric's packages

There are other Slackware repositories of packages out there, but, I do not use them. Robby and Eric are Slackware developers. Their packages are completely trustworthy.

Knightron · 07-06-2011, 08:08 PM

Thanks guys, it seems to be simpler than i thought. it's a laptop, and i'm just using it for personal use, not a server. Thanks guys. I'm not going to mark this solved incase anyone has anything else to add

prol · 07-06-2011, 08:31 PM

is there a website where stuff like this is documented, or does slackware assume that user should know his/her way around?

BCarey · 07-06-2011, 08:42 PM

If it is a laptop you may want to consider encryption in case it walks away one day. Check out the README: ftp://slackware.mirrors.tds.net/pub/...ADME_CRYPT.TXT

Brian

bonixavier · 07-06-2011, 11:01 PM

System hardening by dentonj. Aimed at 10.2, but the ideas are nice.

Knightron · 07-07-2011, 02:54 AM

Quote:

Originally Posted by mRgOBLIN

Making sure you aren't running any services that you don't need

How do i do that?

Quote:

Originally Posted by H_TeXMeX_H

Make sure to install a firewall script:
http://connie.slackware.com/~alien/efg/

I tried the link but it asks what type of internet connection i use. I use mobile broadband, what do i put in that box?

Quote:

Originally Posted by dh2k

Then uncomment (remove the # ) from a mirror for your slackware-version in /etc/slackpkg/mirrors, then run as root:
[code]

I did this for the Australian mirror, but i got an error. i first tried the http, but when that didn't work i tried the ftp, but that didn't work either. I'm pretty sure i'm doing it right, and that there's something wrong with the mirror. Can someone confirm the Australian mirror is/isn't working, or provide an alternative Australiain mirror?

dh2k · 07-07-2011, 03:18 AM

Quote:

Originally Posted by Knightron

Can someone confirm the Australian mirror is/isn't working, or provide an alternative Australiain mirror?

I can verify problem with that mirror

# Australia, 250Mbit
# http://mirror.pacific.net.au/linux/s...lackware-13.0/
# ftp://mirror.pacific.net.au/linux/sl...lackware-13.0/

Code:

root@slackware13:/etc/slackpkg# slackpkg update

Updating the package lists...
	Downloading...
			Downloading http://mirror.pacific.net.au/linux/slackware/slackware-13.0/ChangeLog.txt...
--2011-07-07 09:16:19--  http://mirror.pacific.net.au/linux/slackware/slackware-13.0/ChangeLog.txt
Resolving mirror.pacific.net.au... failed: Name or service not known.
wget: unable to resolve host address `mirror.pacific.net.au'

Error downloading from http://mirror.pacific.net.au/linux/slackware/slackware-13.0/.
Please, check your mirror and try again.

root@slackware13:/etc/slackpkg#

Choose a different mirror then try again ;-P

Forwarded upstream at slackpkg.org

H_TeXMeX_H · 07-07-2011, 03:19 AM

Put in the name of the internet interface. See the output of 'ifconfig'. It's probably ppp0, but do check.

Diantre · 07-07-2011, 03:27 AM

Quote:

Originally Posted by Knightron

How do i do that?

Remove the executable bit on the service scripts. If you run ls -l /etc/rc.d you'll see something like this:

Code:

-rwxr-xr-x 1 root root  572 Dec 18  2010 rc.consolekit
-rw-r--r-- 1 root root 4.3K Jan 21 22:23 rc.cups
-rw-r--r-- 1 root root  512 Mar 15 23:33 rc.dnsmasq
-rwxr-xr-x 1 root root  22K Jun 10 11:05 rc.firewall
-rwxr-xr-x 1 root root  132 Jun 27 14:37 rc.font

In the first column you see the file permissions, r - read, w - write, x - executable. In this case rc.cups and rc.dnsmasq don't have the executable bit, so that means I'm not running those services. The others have the bit set, so they're executed at startup. If you want to prevent a service being executed at startup, remove the executable bit with chmod:

Code:

chmod -x /etc/rc.d/rc.font

And to enable a service, type:

Code:

chmod +x /etc/rc.d/rc.font

Quote:

Originally Posted by Knightron

I tried the link but it asks what type of internet connection i use. I use mobile broadband, what do i put in that box?

You mean the one that says "Select Type of Internet Address"? If so, most probably you're using "Dynamic Internet IP Address". Click on the "Help" link next to the option for information.

Quote:

Originally Posted by Knightron

Can someone confirm the Australian mirror is/isn't working, or provide an alternative Australiain mirror?

I can't reach it either. But I suppose you can use any other mirror close to your location.

allend · 07-07-2011, 07:57 AM

I can confirm that mirror.pacific.net.au has been down for a long time. I do not believe that it is coming back. In my unsuccessful search to find the last post I saw on http://forums.whirlpool.net.au/ (where the sysadmin reported that the server had gone down), I came across this as a possible replacement. http://ftp.iinet.net.au/pub/slackware/
I have not tried this, but will certainly be doing so in the future.

On the security question, if you use secure shell (the sshd daemon), then disable root logins. The LQ Security forum has had some unhappy threads recently where the likely point of entry leading to the server being pwned was an attack on the ssh root password.