This document describes some measures to make your Slackware system more secure. One of the most important things is that you disable services you do not use. When a security bug is found in a service it is often possible to break into a system. Reducing the number of available services makes the change your system is vurnerable smaller. Fortunately Slackware has a tool called nmap which can display which services are open to the public on your system. The most basic nmap syntax is nmap <IP address>, for example:
bash-2.05b$ nmap 127.0.0.1 Starting nmap V. 3.00 ( www.insecure.org/nmap/ ) Interesting ports on localhost (127.0.0.1): (The 1596 ports scanned but not shown below are in state: closed) Port State Service 21/tcp open ftp 22/tcp open ssh 23/tcp open telnet 80/tcp open http 6000/tcp open X11
In this output you can see that the ftp, ssh, telnet and http services are enabled. X11 is also running, the X11 port provides remote X access.
The internet super server, inetd, can be used to provide some important TCP/IP services like FTP, POP3 and telnet. Most people install inetd (package inetd of the "n" diskset) unknowingly or to provide services. By default inetd has some services open to the public, it is a good idea to disable all services by default and enable services you want to provide. Services can be disabled by putting the '#' character in front of a service line. For example, to disable the FTP service change the line:
ftp stream tcp nowait root /usr/sbin/tcpd proftpd
to:
#ftp stream tcp nowait root /usr/sbin/tcpd proftpd
Repeat this routine for all enabled services to make sure you have no services enabled. The inetd services are normally configured with tcpd as a wrapper. tcpd adds an extra layer of security, for example host-based security control. Access to services can be controlled using the /etc/hosts.deny and /etc/hosts.allow files. Both contain rules following this syntax: "service: class". Class is an IP addres, IP range, host nameor host range. Let\x{00B4}s look at an example. One machine is connected to a network and needs to provide ftp access for a machine with the IP adress 192.168.1.69, all other access should be blokked. First of all we want to make sure no hosts can access services on the machine by having the following line in /etc/hosts.deny:
ALL: ALL
In this example the wildcard "ALL" is used for both the to be denied services and the class to deny those services for. Now we can allow FTP acces for host 192.168.1.69 by adding
proftpd: 192.168.1.69
to /etc/hosts.allow. As you can see the service is specified by the command used to process the request. Please read the hosts_access(5) man page for more information by executing: man 5 hosts_access
Every now and then a vurnerability is found in some package. Patrick Volkerding officially makes and announces update packages for these packages. The security advisories can be found at: http://www.slackware.com/security/. It is a good idea to subscribe to the security mailinglist to get advisories by e-mail. Information about subribing to the list can be found over here: http://www.slackware.com/lists/
Precompiled update packages can usually be found in the patches/packages/ directory of the current stable distribution.