Chapter 8. Securing network services

• Exporting home directories is a risk because some applications store passwords in plain text or in a weakly encrypted format. You can reduce the risk by reviewing and improving the application code.
• Some users do not set passwords on SSH keys, which again leads to risks with home directories. You can reduce these risks by enforcing the use of passwords or using Kerberos.
• Restrict the NFS exports only to required clients. Use the showmount -e command on the NFS server to review what the server is exporting. Do not export anything that is not specifically required.
• Do not allow unnecessary users to log in to a server to reduce the risk of attacks. You can periodically check who and what can access the server.

Prerequisites

• The nfs-utils package is installed.
• The firewalld package is installed and running.

Procedure

• To define a single line message, add the following option to the /etc/vsftpd/vsftpd.conf file:

  ftpd_banner=Hello, all activity on ftp.example.com is logged.

• To define a message in a separate file:

  • Create a .msg file which contains the banner message, for example /etc/banners/ftp.msg:

    ######### Hello, all activity on ftp.example.com is logged. #########

    To simplify the management of multiple banners, place all banners into the /etc/banners/ directory.

  • Add the path to the banner file to the banner_file option in the /etc/vsftpd/vsftpd.conf file:

    banner_file=/etc/banners/ftp.msg

Verification

• Display the modified banner:

  $ ftp localhost
  Trying ::1…
  Connected to localhost (::1).
  Hello, all activity on ftp.example.com is logged.

• Disable all user accounts in the vsftpd server, by adding the following line to the /etc/vsftpd/vsftpd.conf file:

  local_enable=NO

• Disable FTP access for specific accounts or specific groups of accounts, such as the root user and users with sudo privileges, by adding the usernames to the /etc/pam.d/vsftpd PAM configuration file.
• Disable user accounts, by adding the usernames to the /etc/vsftpd/ftpusers file.

• To disable version strings, modify the server_tokens configuration option:

  server_tokens off;

  This option stops displaying additional details such as server version number. This configuration displays only the server name in all requests served by Nginx, for example:

  $ curl -sI http://localhost | grep Server
  Server: nginx

• Add security headers in your server or location blocks within /etc/nginx/nginx.conf or /etc/nginx/conf.d/*.conf files:

  • For example, the X-Frame-Options header option denies any page outside of your domain to frame any content served by Nginx, mitigating clickjacking attacks:

    add_header X-Frame-Options "SAMEORIGIN";

  • For example, the x-content-type header prevents MIME-type sniffing in certain older browsers:

    add_header X-Content-Type-Options nosniff;

  • For example, the X-XSS-Protection header enables Cross-Site Scripting (XSS) filtering, which prevents browsers from rendering potentially malicious content included in a response by Nginx:

    add_header X-XSS-Protection "1; mode=block";

• You can limit the services exposed to the public and limit what they do and accept from the visitors, for example:

  limit_except GET {
      allow 192.168.1.0/32;
      deny  all;
  }

  The snippet will limit access to all methods except GET and HEAD.

• You can disable HTTP methods, for example:

  # Allow GET, PUT, POST; return "405 Method Not Allowed" for all others.
  if ( $request_method !~ ^(GET|PUT|POST)$ ) {
      return 405;
  }

• Configure TLS to protect data served by your Nginx web server. Serve content over HTTPS only. You can generate a secure configuration profile for enabling TLS in your Nginx server using the Mozilla SSL Configuration Generator. The generated configuration ensures that known vulnerable protocols, ciphers, and hashing algorithms are disabled. Use the SSL Server Test to verify that your configuration meets modern security requirements.

• Limit access to your local network. Configure your firewall to block external traffic. Remove the default port 11211:

  # firewall-cmd --remove-port=11211/udp
  # firewall-cmd --runtime-to-permanent

• Limit Memcached to local connections only. Edit the OPTIONS value in /etc/sysconfig/memcached:

  OPTIONS="-l 127.0.0.1,::1"

• Enable Simple Authentication and Security Layer (SASL) authentication:

  1. Create /etc/sasl2/memcached.conf and set the SASL database path:

     sasldb_path: /path.to/memcached.sasldb

  2. Add an account in the SASL database:

     # saslpasswd2 -a memcached -c cacheuser -f /path.to/memcached.sasldb

  3. Set permissions for the memcached user and group:

     # chown memcached:memcached /path.to/memcached.sasldb

  4. Enable SASL support. Add -S to OPTIONS in /etc/sysconfig/memcached:

     OPTIONS="-S"

  5. Restart Memcached:

     # systemctl restart memcached

  6. Add the SASL username and password to your application’s Memcached client configuration.

• Encrypt communication between Memcached clients and servers with TLS:

  1. Enable TLS encryption. Add -Z to OPTIONS in /etc/sysconfig/memcached:

     OPTIONS="-Z"

  2. Add the certificate chain file path. Append -o ssl_chain_cert=/path/to/cert.pem to OPTIONS:

     OPTIONS="-Z -o ssl_chain_cert=/path/to/cert.pem"

  3. Add the private key file path. Append -o ssl_key=/path/to/key.pem to OPTIONS:

     OPTIONS="-Z -o ssl_chain_cert=/path/to/cert.pem -o ssl_key=/path/to/key.pem"

• Do not share the /var/spool/postfix/ mail spool directory on a Network File System (NFS) volume. NFSv2 and NFSv3 do not maintain control over user and group IDs, allowing users with the same UID to receive and read each other’s mail. NFSv4 using Kerberos does not have this limitation because the SECRPC_GSS kernel module does not use UID-based authentication. However, avoid placing the mail spool directory on NFS volumes to reduce security risks.
• Require mail users to access Postfix using an email program only. Do not allow shell accounts on the mail server. Set all user shells in the /etc/passwd file to /sbin/nologin, with the possible exception of the root user. This prevents users from directly accessing the mail server and reduces the attack surface.
• To protect Postfix from a network attack, it is configured to only listen to the local loopback address by default. You can verify this by viewing the inet_interfaces = localhost line in the /etc/postfix/main.cf file. This ensures that Postfix only accepts mail messages, such as cron job reports, from the local system and not from the network. This is the default setting and protects Postfix from a network attack. To remove the localhost restriction and allow Postfix to listen on all interfaces, set the inet_interfaces parameter to all in /etc/postfix/main.cf.

Prerequisites

• The dovecot package is installed on the system