Confessions of a Real-World Linux Admin: “I Always Login As Root.”
This is not funny but it is a hard reality. Many new sys admin prefer to login as root.
FTA, "There are over ten million businesses in America that support fewer than 20 employees, each. Many are start-ups or otherwise minimally capitalized, and Linux fills a networking need without straining the budget... especially when they don’t bother hiring professional help."
Kurt manages the office for one of them (via).
As an experienced admin, I do not recommend running anything as root:
- Take advantage of this - most services are able to drop root access/rights as soon as they go into background
- Do not grant root access to anyone use sudo
- Do not grant shell access to everyone (e.g. FTP and email users). Also consider securing and auditing the shell access with Enterprise Audit Shell
- Default firewall policy - close all doors open required windows i.e. only open or filter required ports
- Run critical services in chrooted jail
- Run only required network servers or services
- Take advantage of LDAP and/or PAM to implement more advanced authentication security schema
- If possible bound service to only loopback device 127.0.0.1 (for example MySQL should always bound to 127.0.0.1)
- Monitor logs using logwatch or other automated softwares
- Subscribe to your distribution security alert mailing list
- Restrict access using iptables/PF, acl, user rights etc
- And most important backup regularly
Always remember that no computer system can ever be completely secure, you can make crackers job hard only 
Other www tutorials
- Tons of HOWTO and FAQ documents for Linux and other aspects of Security
- Linux Security HOWTO
- Securing Linux Production Systems - This article is a practical step-by-step guide for securing Linux production systems.
Recommended books
- Secure Architectures with OpenBSD
- Building Firewalls with OpenBSD and PF
- Real World Linux Security
- SELinux: NSA's Open Source Security Enhanced Linux
- Linux Security Cookbook
Hope this small list helps someone to secure Linux/UNIX box.
You may also be interested in other helpful articles:
- Linux How do I display failed login attempt?
- Allow normal user to dialout Internet
- Understanding Linux initrd - initial RAM disk
- FreeBSD > Displaying System-Specific Messages at Login
- Howto: Building a Self-Healing Network with NAGIOS and Cfengine
Leave a Reply
We encourage your comments, and suggestions. But please stay on topic, be polite, and avoid spam. Thank you very much for stopping by our site!
Recent Comments
Today ~ 2 Comments
Yesterday ~ 16 Comments
Yesterday ~ 5 Comments
Yesterday ~ 20 Comments
Yesterday ~ 35 Comments